# OPC UA Niagara 4 **URL:** \ **Category:** Ignition Early Access\ **Created:** [June 9, 2022, 8:38pm UTC](https://forum.inductiveautomation.com/t/opc-ua-niagara-4/60581 "2022-06-09T20:38:04Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Ken\_Watson](https://avatars.discourse-cdn.com/v4/letter/k/74df32/32.png) [@Ken\_Watson](https://forum.inductiveautomation.com/u/Ken_Watson)\ **Post date:** [June 9, 2022, 8:38pm UTC](https://forum.inductiveautomation.com/t/opc-ua-niagara-4/60581/1 "2022-06-09T20:38:04Z")
I have issue where I move two certificates from the rejected directory to the trusted certs directory, but then as soon as my OPC UA client sends another request to the server (open secure channel), the same certificates end up in the rejected directory again, and the server responds with an error message: (Frame 13: 189 bytes on wire (1512 bits), 189 bytes captured (1512 bits) on interface \Device\NPF\_{3970287E-D220-49EA-B769-B19BFAE3CC5C}, id 0 Ethernet II, Src: LCFCHeFe\_a5:47:3f (8c:16:45:a5:47:3f), Dst: RedLionC\_07:ff:47 (00:05:e4:07:ff:47) Internet Protocol Version 4, Src: 192.168.1.220, Dst: 192.168.1.45 Transmission Control Protocol, Src Port: 4840, Dst Port: 41234, Seq: 1, Ack: 2709, Len: 135 OpcUa Binary Protocol Message Type: ERR Chunk Type: F Message Size: 135 Error: 0x80130000 [BadSecurityChecksFailed] Reason: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target ) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 9, 2022, 8:40pm UTC](https://forum.inductiveautomation.com/t/opc-ua-niagara-4/60581/2 "2022-06-09T20:40:07Z")
It’s hard to say without a copy of the certificate to look at, but it’s probably either invalid in some manner or signed by one or more CAs that need to be manually added to one of Ignition’s OPC UA server PKI dirs. ---
**Author:** ![Ken\_Watson](https://avatars.discourse-cdn.com/v4/letter/k/74df32/32.png) [@Ken\_Watson](https://forum.inductiveautomation.com/u/Ken_Watson)\ **Post date:** [June 9, 2022, 8:42pm UTC](https://forum.inductiveautomation.com/t/opc-ua-niagara-4/60581/3 "2022-06-09T20:42:28Z")
I tried uploading the certificates to my message, but because I’m new user, it would not let me do so. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 9, 2022, 8:43pm UTC](https://forum.inductiveautomation.com/t/opc-ua-niagara-4/60581/4 "2022-06-09T20:43:53Z")
I just DM’d you a dropbox link you can upload to. ---
**Author:** ![Ken\_Watson](https://avatars.discourse-cdn.com/v4/letter/k/74df32/32.png) [@Ken\_Watson](https://forum.inductiveautomation.com/u/Ken_Watson)\ **Post date:** [June 9, 2022, 9:10pm UTC](https://forum.inductiveautomation.com/t/opc-ua-niagara-4/60581/5 "2022-06-09T21:10:54Z")
Uploaded the offending certificates. ---
**Author:** ![Ken\_Watson](https://avatars.discourse-cdn.com/v4/letter/k/74df32/32.png) [@Ken\_Watson](https://forum.inductiveautomation.com/u/Ken_Watson)\ **Post date:** [June 9, 2022, 9:17pm UTC](https://forum.inductiveautomation.com/t/opc-ua-niagara-4/60581/6 "2022-06-09T21:17:46Z")
I tried enabling some DEBUG options in the Status/logging section of “ignition” and restarting the OPCUA module, but it really did not provide any more information on why the certificates were being added to the rejected directory (even though I had marked both as trusted). ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 9, 2022, 9:51pm UTC](https://forum.inductiveautomation.com/t/opc-ua-niagara-4/60581/7 "2022-06-09T21:51:55Z")
It looks like the certs should work if you put the CA cert into `$IGNITION/data/opcua/server/security/pki/issuers/certs` and the leaf cert into `$IGNITION/data/opcua/server/security/pki/trusted/certs`. If it still doesn’t work see if there are there any entries in the Ignition logs at the time your client tries to connect or go ahead and upload them to the same dropbox link.