## Problem Description
I'm experiencing a persistent issue with OPC UA secure connections to Ignition Gateway 8.1+ where secure connections consistently fail with `BadSecurityChecksFailed` during the secure channel establishment phase, despite the client certificate being properly trusted in the Gateway interface.
Environment Details
- **Ignition Gateway**: Version 8.1+ (localhost:62541)
- **OPC UA Client**: Python `opcua` library
- **Operating System**: Windows 10/11
- **Security Configuration**: Basic256Sha256 + SignAndEncrypt + Username/Password authentication
- **Credentials**: admin/admin123
- **Certificate**: Self-signed client certificate (SHA-1: 4b82a8e5658d4591a8bf31ef00ca4f0642e52141)
## What Works
**Plain OPC UA connections** (no security) work perfectly
**Certificate is trusted** - verified in Ignition Gateway > Config > OPC UA > Server > Security > Certificates (shows as trusted)
**Same certificate works** with other OPC UA servers (Prosys OPC UA Simulation Server) using identical security settings
**Gateway services** are running properly
## What Fails
**All secure connection attempts** fail with `BadSecurityChecksFailed`
**Error occurs during secure channel establishment** (before authentication)
**Multiple security modes tested**: Sign, SignAndEncrypt, different policies - all fail
**Anonymous secure connections** also fail (not user authentication issue)
## Detailed Testing Performed
### 1. Certificate Verification
- Created CA and client certificates using OpenSSL
- Imported CA certificate into Ignition Gateway trusted certificates
- Verified certificate appears as "Trusted" in Gateway interface
- Certificate fingerprint matches exactly: `4b82a8e5658d4591a8bf31ef00ca4f0642e52141`
### 2. Connection Testing Matrix
┌─────────────────┬─────────────┬────────────────┐
│ Connection Type │ Security │ Result │
├─────────────────┼─────────────┼────────────────┤
│ Plain │ None │ SUCCESS │
│ Secure Sign │ Basic256Sha256 │ BadSecurityChecksFailed │
│ Secure Sign+Encrypt │ Basic256Sha256 │ BadSecurityChecksFailed │
│ Anonymous Secure │ Basic256Sha256 │ BadSecurityChecksFailed │
│ Different Policies │ Basic128Rsa15, etc │ BadSecurityChecksFailed │
└─────────────────┴─────────────┴────────────────┘
### 3. Service Restart Testing
- Restarted Ignition Gateway service completely
- Restarted OPC UA Server module specifically
- Waited for full initialization
- Issue persists after restarts
### 4. Comparison Testing
- **Prosys OPC UA Server**: Same certificate, same code, same security settings = SUCCESS
- **Ignition OPC UA Server**: Identical setup = BadSecurityChecksFailed
## Error Details
**Primary Error**: `BadSecurityChecksFailed` during secure channel establishment
**Python Client Code** (simplified):
python
from opcua import Client, ua
from opcua.crypto import security_policies
client = Client("opc.tcp://localhost:62541")
client.set_security(
security_policies.SecurityPolicyBasic256Sha256,
certificate_path="trusted_client_cert.pem",
private_key_path="trusted_client_key.pem",
mode=ua.MessageSecurityMode.SignAndEncrypt
)
client.set_user("admin")
client.set_password("admin123")
client.connect() # ← Fails here with BadSecurityChecksFailed
## Troubleshooting Attempted
1. **Certificate Trust Verification**: Confirmed in Gateway interface
2. **Certificate File Locations**: Tried copying to `C:\Program Files\Inductive Automation\Ignition\data\opcua\pki\trusted\certs\`
3. **Security Policy Testing**: Tested Basic128Rsa15, Basic256, Basic256Sha256
4. **Security Mode Testing**: Tested Sign only, SignAndEncrypt
5. **Authentication Testing**: Tested anonymous, username/password
6. **Application URI Verification**: Ensured certificate Application URI matches client
7. **Gateway Log Review**: No specific certificate errors found in logs
8. **Service Restarts**: Full Ignition Gateway and OPC UA module restarts
9. **Firewall Testing**: Disabled Windows Firewall temporarily
10. **Alternative Libraries**: Issue appears to be server-side, not client library
## Questions for Community
1. **Are there additional Ignition-specific certificate validation settings** beyond the main certificate trust interface?
2. **Does Ignition OPC UA Server require certificates in specific filesystem locations** in addition to the Gateway trust store?
3. **Are there OPC UA Server security policy configurations** that might cause certificate validation to fail even when certificate is trusted?
4. **Has anyone experienced similar issues** where plain connections work but secure connections fail with trusted certificates?
5. **Are there specific Ignition Gateway logs** that would show detailed certificate validation failures?
## Additional Context
- This is a development/testing environment on localhost
- Same client code and certificates work perfectly with other OPC UA servers
- The issue appears to be specific to Ignition's certificate validation during secure channel establishment
- Plain connections confirm that basic OPC UA functionality works
- Certificate trust is confirmed through Gateway interface
Any insights into Ignition-specific OPC UA security configuration would be greatly appreciated!
---
**Environment**: Ignition Gateway 8.1+, Windows, Python opcua library
**Scope**: OPC UA secure connections, certificate authentication
**Priority**: Development blocking - cannot establish secure OPC UA connections
