# OPC UA connection "unable to find valid certification path to requested target" **URL:** \ **Category:** Ignition\ **Tags:** ignition80\ **Created:** [October 15, 2021, 6:28pm UTC](https://forum.inductiveautomation.com/t/opc-ua-connection-unable-to-find-valid-certification-path-to-requested-target/52006 "2021-10-15T18:28:58Z")\ **Posts on this page:** 1\ **Showing post:** 9
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [July 26, 2024, 11:49pm UTC](https://forum.inductiveautomation.com/t/opc-ua-connection-unable-to-find-valid-certification-path-to-requested-target/52006/9 "2024-07-26T23:49:21Z")
It looks like this certificate is being generated by software written against a more recent version of the OPC UA spec, which now definitively states that for a self-signed certificate the `cA` bit of the `BasicConstraints` extension _shall_ be set to `false`, with `true` being accepted for backwards compatibility as long as the pathLength constraint is 0. Unfortunately Ignition is still looking for the `cA` bit to be true instead. We'll have to update this validation in a future version. However, under these new rules, all self-signed certificates must have the `keyCertSign` KeyUsage bit set, so even if we were up to date on the validation rules it would still fail. For now you'll just have to leave the validation disabled. --- _[View the full topic](https://forum.inductiveautomation.com/t/opc-ua-connection-unable-to-find-valid-certification-path-to-requested-target/52006)._