# OPC UA Certificate User Token Policy **URL:** \ **Category:** Ignition\ **Tags:** ignition81\ **Created:** [July 9, 2025, 5:08pm UTC](https://forum.inductiveautomation.com/t/opc-ua-certificate-user-token-policy/108281 "2025-07-09T17:08:00Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![connor.lewellyn](https://avatars.discourse-cdn.com/v4/letter/c/96bed5/32.png) [@connor.lewellyn](https://forum.inductiveautomation.com/u/connor.lewellyn)\ **Post date:** [July 9, 2025, 5:08pm UTC](https://forum.inductiveautomation.com/t/opc-ua-certificate-user-token-policy/108281/1 "2025-07-09T17:08:00Z")
I am trying to connect to an Ignition OPC UA server with UA Agent (as well as a C# client I am writing). I want this to use certificate authentication, not username and password. In UA Agent, when I discover the server, it defaults to username and password. When using username and password, it connects and I can view nodes. When attempting to use certificate authentication instead, I get the following error in Ignition: ```python at org.eclipse.milo.opcua.stack.server.transport.uasc.UascServerAsymmetricHandler.lambda$openSecureChannel$5(UascServerAsymmetricHandler.java:454) at java.base/java.util.Optional.orElseThrow(Unknown Source) at org.eclipse.milo.opcua.stack.server.transport.uasc.UascServerAsymmetricHandler.openSecureChannel(UascServerAsymmetricHandler.java:444) at org.eclipse.milo.opcua.stack.server.transport.uasc.UascServerAsymmetricHandler.lambda$sendOpenSecureChannelResponse$3(UascServerAsymmetricHandler.java:355) at org.eclipse.milo.opcua.stack.core.channel.SerializationQueue.lambda$encode$0(SerializationQueue.java:59) at org.eclipse.milo.opcua.stack.core.util.TaskQueue$TaskWrapper.run(TaskQueue.java:273) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) at java.base/java.lang.Thread.run(Unknown Source) ``` When using my .NET client to connect with a Ceritifcate identity, I get the same error as above. When attempting to connect with a Username identity, I get the following error: ```python io.netty.handler.codec.DecoderException: UaException: status=Bad_SecurityChecksFailed, message=An error occurred verifying security. at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:500) at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:290) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444) ``` Oddly enough, in the Security -\> Server, the certificate shows up both in the Trusted Certificates tab and the Quarantined Certificates tab. I am unsure if these are related, or if there's something I missed in the documentation, but any guidance would be appreciated in resolving this. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [July 9, 2025, 5:53pm UTC](https://forum.inductiveautomation.com/t/opc-ua-certificate-user-token-policy/108281/2 "2025-07-09T17:53:19Z")
Ignition does not support Session authentication via certificate, neither as Client nor Server. ---
**Author:** ![connor.lewellyn](https://avatars.discourse-cdn.com/v4/letter/c/96bed5/32.png) [@connor.lewellyn](https://forum.inductiveautomation.com/u/connor.lewellyn)\ **Post date:** [July 9, 2025, 7:26pm UTC](https://forum.inductiveautomation.com/t/opc-ua-certificate-user-token-policy/108281/3 "2025-07-09T19:26:31Z")
Understood. So my UaExpert works as expected. Since I need to use UserName for session authentication, I'm still running into an issue with my .NET code (using Traeger's SDK). The application certificate is the same, and the username and password are the same, but I receive ```python Caused by: org.eclipse.milo.opcua.stack.core.UaException: status=Bad_SecurityChecksFailed, description=An error occurred verifying security. at org.eclipse.milo.opcua.stack.server.security.DefaultServerCertificateValidator.validateCertificateChain(DefaultServerCertificateValidator.java:87) at org.eclipse.milo.opcua.stack.server.transport.uasc.UascServerAsymmetricHandler.onOpenSecureChannel(UascServerAsymmetricHandler.java:198) at org.eclipse.milo.opcua.stack.server.transport.uasc.UascServerAsymmetricHandler.decode(UascServerAsymmetricHandler.java:120) at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:530) ``` Any directions to be pointed in? Misconfigured client? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [July 9, 2025, 7:40pm UTC](https://forum.inductiveautomation.com/t/opc-ua-certificate-user-token-policy/108281/4 "2025-07-09T19:40:09Z")
It looks like the Ignition server doesn’t trust your client certificate for some reason. Have you marked it trusted in the server security settings area under the Server tab? If you can attach/upload a copy of your client certificate I can take a look at it to see if anything is wrong with the way it was generated. ---
**Author:** ![connor.lewellyn](https://avatars.discourse-cdn.com/v4/letter/c/96bed5/32.png) [@connor.lewellyn](https://forum.inductiveautomation.com/u/connor.lewellyn)\ **Post date:** [July 9, 2025, 7:46pm UTC](https://forum.inductiveautomation.com/t/opc-ua-certificate-user-token-policy/108281/5 "2025-07-09T19:46:30Z")
Here's the certificate. It is marked as trusted in the Server tab. [DevCertificate.cer](https://forum.inductiveautomation.com/uploads/short-url/9Mw3BBkk4a2QfRJs2P5KnDaDfMM.cer) (1.4 KB) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [July 9, 2025, 9:15pm UTC](https://forum.inductiveautomation.com/t/opc-ua-certificate-user-token-policy/108281/6 "2025-07-09T21:15:13Z")
This certificate has an issuer that needs to be added as a trusted certificate as well. Or whatever the root CA is, if not the direct issuer. In addition to that, it's missing 2 of the required 4 Key Usage bits. It has `digitalSignature` and `keyEncipherment`, it also needs `nonRepudiation` and `dataEncipherment`. See [UA Part 6: Mappings - 6.2.2 Application Instance Certificate](https://reference.opcfoundation.org/Core/Part6/v105/docs/6.2.2#:~:text=For%20RSA%20keys%2C%20the%20keyUsage%20shall%20include%20digitalSignature%2C%20nonRepudiation%2C%20keyEncipherment%20and%20dataEncipherment). It's also missing the application URI in the Subject Alternative Name extension.