# OPC UA Secure Connections Fail with BadSecurityChecksFailed Despite Trusted Certificate - Plain Connections Work

**URL:** <https://forum.inductiveautomation.com/t/opc-ua-secure-connections-fail-with-badsecuritychecksfailed-despite-trusted-certificate-plain-connections-work/111581>\
**Category:** Ignition\
**Created:** [October 19, 2025, 3:40am UTC](https://forum.inductiveautomation.com/t/opc-ua-secure-connections-fail-with-badsecuritychecksfailed-despite-trusted-certificate-plain-connections-work/111581 "2025-10-19T03:40:51Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![alcalaf](https://avatars.discourse-cdn.com/v4/letter/a/7feea3/32.png) [@alcalaf](https://forum.inductiveautomation.com/u/alcalaf)\
**Post date:** [October 19, 2025, 3:40am UTC](https://forum.inductiveautomation.com/t/opc-ua-secure-connections-fail-with-badsecuritychecksfailed-despite-trusted-certificate-plain-connections-work/111581/1 "2025-10-19T03:40:51Z")

</div>

**## Problem Description**

I'm experiencing a persistent issue with OPC UA secure connections to Ignition Gateway 8.1+ where secure connections consistently fail with `BadSecurityChecksFailed` during the secure channel establishment phase, despite the client certificate being properly trusted in the Gateway interface.

**Environment Details**

- **\*\*Ignition Gateway\*\*** : Version 8.1+ (localhost:62541)

- **\*\*OPC UA Client\*\*** : Python `opcua` library

- **\*\*Operating System\*\*** : Windows 10/11

- **\*\*Security Configuration\*\*** : Basic256Sha256 + SignAndEncrypt + Username/Password authentication

- **\*\*Credentials\*\*** : admin/admin123

- **\*\*Certificate\*\*** : Self-signed client certificate (SHA-1: 4b82a8e5658d4591a8bf31ef00ca4f0642e52141)

**## What Works**

✅ **\*\*Plain OPC UA connections\*\*** (no security) work perfectly

✅ **\*\*Certificate is trusted\*\*** - verified in Ignition Gateway \> Config \> OPC UA \> Server \> Security \> Certificates (shows as trusted)

✅ **\*\*Same certificate works\*\*** with other OPC UA servers (Prosys OPC UA Simulation Server) using identical security settings

✅ **\*\*Gateway services\*\*** are running properly

**## What Fails**

❌ **\*\*All secure connection attempts\*\*** fail with `BadSecurityChecksFailed`

❌ **\*\*Error occurs during secure channel establishment\*\*** (before authentication)

❌ **\*\*Multiple security modes tested\*\*** : Sign, SignAndEncrypt, different policies - all fail

❌ **\*\*Anonymous secure connections\*\*** also fail (not user authentication issue)

**## Detailed Testing Performed**

**### 1. Certificate Verification**

- Created CA and client certificates using OpenSSL

- Imported CA certificate into Ignition Gateway trusted certificates

- Verified certificate appears as "Trusted" in Gateway interface

- Certificate fingerprint matches exactly: `4b82a8e5658d4591a8bf31ef00ca4f0642e52141`

**### 2. Connection Testing Matrix**

┌─────────────────┬─────────────┬────────────────┐

│ Connection Type │ Security │ Result │

├─────────────────┼─────────────┼────────────────┤

│ Plain │ None │ ✅ SUCCESS │

│ Secure Sign │ Basic256Sha256 │ ❌ BadSecurityChecksFailed │

│ Secure Sign+Encrypt │ Basic256Sha256 │ ❌ BadSecurityChecksFailed │

│ Anonymous Secure │ Basic256Sha256 │ ❌ BadSecurityChecksFailed │

│ Different Policies │ Basic128Rsa15, etc │ ❌ BadSecurityChecksFailed │

└─────────────────┴─────────────┴────────────────┘

**### 3. Service Restart Testing**

- Restarted Ignition Gateway service completely

- Restarted OPC UA Server module specifically

- Waited for full initialization

- Issue persists after restarts

**### 4. Comparison Testing**

- **\*\*Prosys OPC UA Server\*\*** : Same certificate, same code, same security settings = ✅ SUCCESS

- **\*\*Ignition OPC UA Server\*\*** : Identical setup = ❌ BadSecurityChecksFailed

**## Error Details**

**\*\*Primary Error\*\*** : `BadSecurityChecksFailed` during secure channel establishment

**\*\*Python Client Code\*\*** (simplified):

```python
python

from opcua import Client, ua

from opcua.crypto import security_policies

client = Client("opc.tcp://localhost:62541")

client.set_security(

    security_policies.SecurityPolicyBasic256Sha256,

    certificate_path="trusted_client_cert.pem",

    private_key_path="trusted_client_key.pem", 

    mode=ua.MessageSecurityMode.SignAndEncrypt

)

client.set_user("admin")

client.set_password("admin123")

client.connect() # ← Fails here with BadSecurityChecksFailed

```

**## Troubleshooting Attempted**

1. **\*\*Certificate Trust Verification\*\*** : Confirmed in Gateway interface

2. **\*\*Certificate File Locations\*\*** : Tried copying to `C:\Program Files\Inductive Automation\Ignition\data\opcua\pki\trusted\certs\`

3. **\*\*Security Policy Testing\*\*** : Tested Basic128Rsa15, Basic256, Basic256Sha256

4. **\*\*Security Mode Testing\*\*** : Tested Sign only, SignAndEncrypt

5. **\*\*Authentication Testing\*\*** : Tested anonymous, username/password

6. **\*\*Application URI Verification\*\*** : Ensured certificate Application URI matches client

7. **\*\*Gateway Log Review\*\*** : No specific certificate errors found in logs

8. **\*\*Service Restarts\*\*** : Full Ignition Gateway and OPC UA module restarts

9. **\*\*Firewall Testing\*\*** : Disabled Windows Firewall temporarily

10. **\*\*Alternative Libraries\*\*** : Issue appears to be server-side, not client library

**## Questions for Community**

1. **\*\*Are there additional Ignition-specific certificate validation settings\*\*** beyond the main certificate trust interface?

2. **\*\*Does Ignition OPC UA Server require certificates in specific filesystem locations\*\*** in addition to the Gateway trust store?

3. **\*\*Are there OPC UA Server security policy configurations\*\*** that might cause certificate validation to fail even when certificate is trusted?

4. **\*\*Has anyone experienced similar issues\*\*** where plain connections work but secure connections fail with trusted certificates?

5. **\*\*Are there specific Ignition Gateway logs\*\*** that would show detailed certificate validation failures?

**## Additional Context**

- This is a development/testing environment on localhost

- Same client code and certificates work perfectly with other OPC UA servers

- The issue appears to be specific to Ignition's certificate validation during secure channel establishment

- Plain connections confirm that basic OPC UA functionality works

- Certificate trust is confirmed through Gateway interface

Any insights into Ignition-specific OPC UA security configuration would be greatly appreciated!

---

**\*\*Environment\*\*** : Ignition Gateway 8.1+, Windows, Python opcua library

**\*\*Scope\*\*** : OPC UA secure connections, certificate authentication

**\*\*Priority\*\*** : Development blocking - cannot establish secure OPC UA connections

---

<div class="post-metadata">

**Author:** ![michael.flagler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/michael.flagler/32/26272_2.png) [@michael.flagler](https://forum.inductiveautomation.com/u/michael.flagler)\
**Post date:** [October 19, 2025, 10:09am UTC](https://forum.inductiveautomation.com/t/opc-ua-secure-connections-fail-with-badsecuritychecksfailed-despite-trusted-certificate-plain-connections-work/111581/2 "2025-10-19T10:09:52Z")

</div>

Did you create the user with that password in the OPC-UA user source? That's the one thing I didn't see you mention anywhere.

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [October 19, 2025, 10:13am UTC](https://forum.inductiveautomation.com/t/opc-ua-secure-connections-fail-with-badsecuritychecksfailed-despite-trusted-certificate-plain-connections-work/111581/3 "2025-10-19T10:13:51Z")

</div>

More Ignition logs and Wireshark capture, less LLM text.

---

<div class="post-metadata">

**Author:** ![diamond](https://avatars.discourse-cdn.com/v4/letter/d/e79b87/32.png) [@diamond](https://forum.inductiveautomation.com/u/diamond)\
**Post date:** [October 19, 2025, 10:27am UTC](https://forum.inductiveautomation.com/t/opc-ua-secure-connections-fail-with-badsecuritychecksfailed-despite-trusted-certificate-plain-connections-work/111581/4 "2025-10-19T10:27:40Z")

</div>

I have experienced this before with certificates missing some key parameters. Compare your certificate with the certificate Ignition uses for it’s loopback connection for differences.

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [October 19, 2025, 11:16am UTC](https://forum.inductiveautomation.com/t/opc-ua-secure-connections-fail-with-badsecuritychecksfailed-despite-trusted-certificate-plain-connections-work/111581/5 "2025-10-19T11:16:14Z")

</div>

> [@alcalaf](#):
>
> `client = Client("opc.tcp://localhost:62541")`

This is the Session endpoint and it only allows _secured_ connections (in the default configuration with only `Basic256Sha256` configured in Ignition).

Most clients connect first without security to call GetEndpoints, then again with security after choosing an endpoint. The chosen endpoint will have the Session endpoint URL in it.

You probably need configure your client to use discovery endpoint at `opc.tcp://localhost:62541/discovery`, which will allow that initial unsecured connection for the discovery services.

---

<div class="post-metadata">

**Author:** ![alcalaf](https://avatars.discourse-cdn.com/v4/letter/a/7feea3/32.png) [@alcalaf](https://forum.inductiveautomation.com/u/alcalaf)\
**Post date:** [October 19, 2025, 1:36pm UTC](https://forum.inductiveautomation.com/t/opc-ua-secure-connections-fail-with-badsecuritychecksfailed-despite-trusted-certificate-plain-connections-work/111581/6 "2025-10-19T13:36:44Z")

</div>

[wrapper.log](https://forum.inductiveautomation.com/uploads/short-url/v54op23WISNiR4J1rggwmXvlazP.log) (372.3 KB). Thanks. See the log file, and see the analysis done by the LLM. What I found odd is that the certificate is being trusted as expected.

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/0/4/0482b384e04c2144fa64a734f4740e148df4a376.png)

See the comparison test with Prosys (OPC Server Emulation)

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/0/7/0774168a0eb4667c9d53ff13e31cfd8d79b9c03f.png)

Log analysis.

Short version: your **Ignition OPC UA server is rejecting the client at SecureChannel open due to a certificate validation failure**. It never gets to the session/identity step. The log shows repeated `Bad_SecurityChecksFailed` raises by Milo’s **DefaultServerCertificateValidator.validateCertificateChain** when a client on **127.0.0.1** tries to connect. That’s a straight-up **cert trust/chain mismatch** (untrusted, wrong chain, stale/rotated cert, or similar), not a username/password problem.

### What the log proves

- **Security check fails during OpenSecureChannel** → `UascServerAsymmetricHandler` emits `Bad_SecurityChecksFailed`.

- The failure source is **certificate validation** (`validateCertificateChain`).

- Connections are coming from **localhost** (likely Ignition’s own OPC UA Client connection or UAExpert on the same box).

- The revocation-checker warning (“Failed to add custom revocation checker; REVOCATION\_LIST\_FOUND check will be ignored.”) is **non-fatal** and not the cause; it just disables CRL checking. The hard stop is still `Bad_SecurityChecksFailed`.

### Most likely causes (ranked)

1. **Client cert not trusted by the Ignition OPC UA Server** (sitting in Quarantined/Rejected).

2. **Wrong/rotated client certificate** being presented (server still trusts an older one).

3. **Broken chain** (missing intermediate CA) or **clock skew,** making the cert not-yet-valid/expired.

4. Less common: **ApplicationUri/SAN mismatch** triggering validation failure (still shows up under “security checks failed”).

### Fix it (do all 5 — fast)

1. **Trust the client cert** : Gateway → **Config → OPC UA → Security → Server**.

2. **Purge stale entries** : remove old client certs from **Trusted** if you regenerated the client cert recently; you want **exactly one** valid client cert.

3. **Check system time** on both sides (Windows service host and any local client). A skew can invalidate otherwise good certs.

4. **If using a CA-signed chain** , upload the **full chain** (intermediate(s)+root) to the server’s trust store, or re-export the client cert with the bundled chain.

5. **Re-test with a known-good client** (UAExpert on the same host) using the same endpoint, policy, and cert. If UAExpert is trusted and connects, the problem is the Ignition-as-client connection; if UAExpert gets the same `Bad_SecurityChecksFailed`, it’s the server trust store.

### Quick isolation steps (if you need to move now)

- Temporarily enable a **NoSecurity** endpoint on the server and connect; if it works, the issue is 100% in the **certificate path** , not networking or identity.

- In the failing OPC UA **Client connection** (Ignition → Config → OPC Client → OPC Connections), **delete & recreate** it so it presents a fresh client cert; then **trust it** on the server side.

If you want, share a redacted screenshot of:

- **OPC UA → Security → Server → Quarantined/Trusted** lists, and

- The **OPC Client → OPC Connections → (connection) → Status** page,  
and I’ll point to the exact item(s) to fix.

---

<div class="post-metadata">

**Author:** ![alcalaf](https://avatars.discourse-cdn.com/v4/letter/a/7feea3/32.png) [@alcalaf](https://forum.inductiveautomation.com/u/alcalaf)\
**Post date:** [October 19, 2025, 1:44pm UTC](https://forum.inductiveautomation.com/t/opc-ua-secure-connections-fail-with-badsecuritychecksfailed-despite-trusted-certificate-plain-connections-work/111581/7 "2025-10-19T13:44:37Z")

</div>

> [@alcalaf](#):
>
> I try that recommendation the discovery process is working properly. However, the root issue is still the certificate validation during secure channel establishment.

```python
INFO | jvm 1 | 2025/10/19 09:29:42 | W [o.e.m.o.s.c.u.v.CertificateValidationUtil] [09:29:42.648]: Failed to add custom revocation checker; REVOCATION_LIST_FOUND check will be ignored.
INFO | jvm 1 | 2025/10/19 09:29:42 | E [o.e.m.o.s.t.s.u.UascServerAsymmetricHandler] [09:29:42.649]: [remote=/127.0.0.1:55541] Exception caught; sent ErrorMessage{error=StatusCode[name=Bad_SecurityChecksFailed, value=0x80130000, quality=bad], reason=status=Bad_SecurityChecksFailed, description=An error occurred verifying security.}
INFO | jvm 1 | 2025/10/19 09:29:42 | io.netty.handler.codec.DecoderException: UaException: status=Bad_SecurityChecksFailed, message=An error occurred verifying security.
INFO | jvm 1 | 2025/10/19 09:29:42 | at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:500)
INFO | jvm 1 | 2025/10/19 09:29:42 | at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:290)
INFO | jvm 1 | 2025/10/19 09:29:42 | at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444)
INFO | jvm 1 | 2025/10/19 09:29:42 | at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
INFO | jvm 1 | 2025/10/19 09:29:42 | at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
INFO | jvm 1 | 2025/10/19 09:29:42 | at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1357)
INFO | jvm 1 | 2025/10/19 09:29:42 | at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440)
INFO | jvm 1 | 2025/10/19 09:29:42 | at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
INFO | jvm 1 | 2025/10/19 09:29:42 | at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:868)
INFO | jvm 1 | 2025/10/19 09:29:42 | at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166)
INFO | jvm 1 | 2025/10/19 09:29:42 | at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:796)
INFO | jvm 1 | 2025/10/19 09:29:42 | at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:732)
INFO | jvm 1 | 2025/10/19 09:29:42 | at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:658)
INFO | jvm 1 | 2025/10/19 09:29:42 | at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:562)
INFO | jvm 1 | 2025/10/19 09:29:42 | at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:998)
INFO | jvm 1 | 2025/10/19 09:29:42 | at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)
INFO | jvm 1 | 2025/10/19 09:29:42 | at java.base/java.lang.Thread.run(Unknown Source)
INFO | jvm 1 | 2025/10/19 09:29:42 | Caused by: org.eclipse.milo.opcua.stack.core.UaException: status=Bad_SecurityChecksFailed, description=An error occurred verifying security.
INFO | jvm 1 | 2025/10/19 09:29:42 | at org.eclipse.milo.opcua.stack.core.security.DefaultServerCertificateValidator.validateCertificateChain(DefaultServerCertificateValidator.java:126)
INFO | jvm 1 | 2025/10/19 09:29:42 | at org.eclipse.milo.opcua.stack.transport.server.uasc.UascServerAsymmetricHandler.onOpenSecureChannel(UascServerAsymmetricHandler.java:273)
INFO | jvm 1 | 2025/10/19 09:29:42 | at org.eclipse.milo.opcua.stack.transport.server.uasc.UascServerAsymmetricHandler.decode(UascServerAsymmetricHandler.java:177)
INFO | jvm 1 | 2025/10/19 09:29:42 | at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:530)
INFO | jvm 1 | 2025/10/19 09:29:42 | at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:469)
INFO | jvm 1 | 2025/10/19 09:29:42 | ... 16 common frames omitted
INFO | jvm 1 | 2025/10/19 09:38:18 | W [o.e.m.o.s.c.u.v.CertificateValidationUtil] [09:38:18.699]: Failed to add custom revocation checker; REVOCATION_LIST_FOUND check will be ignored.
INFO | jvm 1 | 2025/10/19 09:38:18 | E [o.e.m.o.s.t.s.u.UascServerAsymmetricHandler] [09:38:18.700]: [remote=/127.0.0.1:50830] Exception caught; sent ErrorMessage{error=StatusCode[name=Bad_SecurityChecksFailed, value=0x80130000, quality=bad], reason=status=Bad_SecurityChecksFailed, description=An error occurred verifying security.}
INFO | jvm 1 | 2025/10/19 09:38:18 | io.netty.handler.codec.DecoderException: UaException: status=Bad_SecurityChecksFailed, message=An error occurred verifying security.
INFO | jvm 1 | 2025/10/19 09:38:18 | at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:500)
INFO | jvm 1 | 2025/10/19 09:38:18 | at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:290)
INFO | jvm 1 | 2025/10/19 09:38:18 | at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444)
INFO | jvm 1 | 2025/10/19 09:38:18 | at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
INFO | jvm 1 | 2025/10/19 09:38:18 | at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
INFO | jvm 1 | 2025/10/19 09:38:18 | at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1357)
INFO | jvm 1 | 2025/10/19 09:38:18 | at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440)
INFO | jvm 1 | 2025/10/19 09:38:18 | at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
INFO | jvm 1 | 2025/10/19 09:38:18 | at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:868)
INFO | jvm 1 | 2025/10/19 09:38:18 | at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166)
INFO | jvm 1 | 2025/10/19 09:38:18 | at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:796)
INFO | jvm 1 | 2025/10/19 09:38:18 | at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:732)
INFO | jvm 1 | 2025/10/19 09:38:18 | at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:658)
INFO | jvm 1 | 2025/10/19 09:38:18 | at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:562)
INFO | jvm 1 | 2025/10/19 09:38:18 | at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:998)
INFO | jvm 1 | 2025/10/19 09:38:18 | at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)
INFO | jvm 1 | 2025/10/19 09:38:18 | at java.base/java.lang.Thread.run(Unknown Source)
INFO | jvm 1 | 2025/10/19 09:38:18 | Caused by: org.eclipse.milo.opcua.stack.core.UaException: status=Bad_SecurityChecksFailed, description=An error occurred verifying security.
INFO | jvm 1 | 2025/10/19 09:38:18 | at org.eclipse.milo.opcua.stack.core.security.DefaultServerCertificateValidator.validateCertificateChain(DefaultServerCertificateValidator.java:126)
INFO | jvm 1 | 2025/10/19 09:38:18 | at org.eclipse.milo.opcua.stack.transport.server.uasc.UascServerAsymmetricHandler.onOpenSecureChannel(UascServerAsymmetricHandler.java:273)
INFO | jvm 1 | 2025/10/19 09:38:18 | at org.eclipse.milo.opcua.stack.transport.server.uasc.UascServerAsymmetricHandler.decode(UascServerAsymmetricHandler.java:177)
INFO | jvm 1 | 2025/10/19 09:38:18 | at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:530)
INFO | jvm 1 | 2025/10/19 09:38:18 | at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:469)
INFO | jvm 1 | 2025/10/19 09:38:18 | ... 16 common frames omitted
INFO | jvm 1 | 2025/10/19 09:38:26 | W [o.e.m.o.s.c.u.v.CertificateValidationUtil] [09:38:26.982]: Failed to add custom revocation checker; REVOCATION_LIST_FOUND check will be ignored.
INFO | jvm 1 | 2025/10/19 09:38:26 | E [o.e.m.o.s.t.s.u.UascServerAsymmetricHandler] [09:38:26.983]: [remote=/127.0.0.1:54668] Exception caught; sent ErrorMessage{error=StatusCode[name=Bad_SecurityChecksFailed, value=0x80130000, quality=bad], reason=status=Bad_SecurityChecksFailed, description=An error occurred verifying security.}
INFO | jvm 1 | 2025/10/19 09:38:26 | io.netty.handler.codec.DecoderException: UaException: status=Bad_SecurityChecksFailed, message=An error occurred verifying security.
INFO | jvm 1 | 2025/10/19 09:38:26 | at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:500)
INFO | jvm 1 | 2025/10/19 09:38:26 | at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:290)
INFO | jvm 1 | 2025/10/19 09:38:26 | at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444)
INFO | jvm 1 | 2025/10/19 09:38:26 | at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
INFO | jvm 1 | 2025/10/19 09:38:26 | at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
INFO | jvm 1 | 2025/10/19 09:38:26 | at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1357)
INFO | jvm 1 | 2025/10/19 09:38:26 | at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440)
INFO | jvm 1 | 2025/10/19 09:38:26 | at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
INFO | jvm 1 | 2025/10/19 09:38:26 | at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:868)
INFO | jvm 1 | 2025/10/19 09:38:26 | at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166)
INFO | jvm 1 | 2025/10/19 09:38:26 | at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:796)
INFO | jvm 1 | 2025/10/19 09:38:26 | at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:732)
INFO | jvm 1 | 2025/10/19 09:38:26 | at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:658)
INFO | jvm 1 | 2025/10/19 09:38:26 | at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:562)
INFO | jvm 1 | 2025/10/19 09:38:26 | at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:998)
INFO | jvm 1 | 2025/10/19 09:38:26 | at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)
INFO | jvm 1 | 2025/10/19 09:38:26 | at java.base/java.lang.Thread.run(Unknown Source)
INFO | jvm 1 | 2025/10/19 09:38:26 | Caused by: org.eclipse.milo.opcua.stack.core.UaException: status=Bad_SecurityChecksFailed, description=An error occurred verifying security.
INFO | jvm 1 | 2025/10/19 09:38:26 | at org.eclipse.milo.opcua.stack.core.security.DefaultServerCertificateValidator.validateCertificateChain(DefaultServerCertificateValidator.java:126)
INFO | jvm 1 | 2025/10/19 09:38:26 | at org.eclipse.milo.opcua.stack.transport.server.uasc.UascServerAsymmetricHandler.onOpenSecureChannel(UascServerAsymmetricHandler.java:273)
INFO | jvm 1 | 2025/10/19 09:38:26 | at org.eclipse.milo.opcua.stack.transport.server.uasc.UascServerAsymmetricHandler.decode(UascServerAsymmetricHandler.java:177)
INFO | jvm 1 | 2025/10/19 09:38:26 | at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:530)
INFO | jvm 1 | 2025/10/19 09:38:26 | at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:469)
INFO | jvm 1 | 2025/10/19 09:38:26 | ... 16 common frames omitted
INFO | jvm 1 | 2025/10/19 09:38:35 | W [o.e.m.o.s.c.u.v.CertificateValidationUtil] [09:38:35.277]: Failed to add custom revocation checker; REVOCATION_LIST_FOUND check will be ignored.
INFO | jvm 1 | 2025/10/19 09:38:35 | E [o.e.m.o.s.t.s.u.UascServerAsymmetricHandler] [09:38:35.277]: [remote=/127.0.0.1:54762] Exception caught; sent ErrorMessage{error=StatusCode[name=Bad_SecurityChecksFailed, value=0x80130000, quality=bad], reason=status=Bad_SecurityChecksFailed, description=An error occurred verifying security.}
INFO | jvm 1 | 2025/10/19 09:38:35 | io.netty.handler.codec.DecoderException: UaException: status=Bad_SecurityChecksFailed, message=An error occurred verifying security.
INFO | jvm 1 | 2025/10/19 09:38:35 | at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:500)
INFO | jvm 1 | 2025/10/19 09:38:35 | at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:290)
INFO | jvm 1 | 2025/10/19 09:38:35 | at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444)
INFO | jvm 1 | 2025/10/19 09:38:35 | at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
INFO | jvm 1 | 2025/10/19 09:38:35 | at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
INFO | jvm 1 | 2025/10/19 09:38:35 | at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1357)
INFO | jvm 1 | 2025/10/19 09:38:35 | at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440)
INFO | jvm 1 | 2025/10/19 09:38:35 | at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
INFO | jvm 1 | 2025/10/19 09:38:35 | at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:868)
INFO | jvm 1 | 2025/10/19 09:38:35 | at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166)
INFO | jvm 1 | 2025/10/19 09:38:35 | at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:796)
INFO | jvm 1 | 2025/10/19 09:38:35 | at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:732)
INFO | jvm 1 | 2025/10/19 09:38:35 | at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:658)
INFO | jvm 1 | 2025/10/19 09:38:35 | at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:562)
INFO | jvm 1 | 2025/10/19 09:38:35 | at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:998)
INFO | jvm 1 | 2025/10/19 09:38:35 | at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)
INFO | jvm 1 | 2025/10/19 09:38:35 | at java.base/java.lang.Thread.run(Unknown Source)
INFO | jvm 1 | 2025/10/19 09:38:35 | Caused by: org.eclipse.milo.opcua.stack.core.UaException: status=Bad_SecurityChecksFailed, description=An error occurred verifying security.
INFO | jvm 1 | 2025/10/19 09:38:35 | at org.eclipse.milo.opcua.stack.core.security.DefaultServerCertificateValidator.validateCertificateChain(DefaultServerCertificateValidator.java:126)
INFO | jvm 1 | 2025/10/19 09:38:35 | at org.eclipse.milo.opcua.stack.transport.server.uasc.UascServerAsymmetricHandler.onOpenSecureChannel(UascServerAsymmetricHandler.java:273)
INFO | jvm 1 | 2025/10/19 09:38:35 | at org.eclipse.milo.opcua.stack.transport.server.uasc.UascServerAsymmetricHandler.decode(UascServerAsymmetricHandler.java:177)
INFO | jvm 1 | 2025/10/19 09:38:35 | at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:530)
INFO | jvm 1 | 2025/10/19 09:38:35 | at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:469)

```

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [October 19, 2025, 3:35pm UTC](https://forum.inductiveautomation.com/t/opc-ua-secure-connections-fail-with-badsecuritychecksfailed-despite-trusted-certificate-plain-connections-work/111581/8 "2025-10-19T15:35:00Z")

</div>

Can you share the certificate(s) you’re using to connect? Just the certs, no private key.

---

<div class="post-metadata">

**Author:** ![alcalaf](https://avatars.discourse-cdn.com/v4/letter/a/7feea3/32.png) [@alcalaf](https://forum.inductiveautomation.com/u/alcalaf)\
**Post date:** [October 19, 2025, 5:10pm UTC](https://forum.inductiveautomation.com/t/opc-ua-secure-connections-fail-with-badsecuritychecksfailed-despite-trusted-certificate-plain-connections-work/111581/9 "2025-10-19T17:10:06Z")

</div>

Thanks for the assistance.

I cannot download the file here but this is the content if this help

-----BEGIN CERTIFICATE-----  
MIIFJTCCAw2gAwIBAgIUR694zY9XaOYwfsFJAa0def1URuYwDQYJKoZIhvcNAQEL  
BQAwgYMxCzAJBgNVBAYTAlVTMQ4wDAYDVQQIDAVTdGF0ZTENMAsGA1UEBwwEQ2l0  
eTEXMBUGA1UECgwOT1BDIFVBIFRlc3QgQ0ExHjAcBgNVBAsMFUNlcnRpZmljYXRl  
IEF1dGhvcml0eTEcMBoGA1UEAwwTT1BDIFVBIFRlc3QgUm9vdCBDQTAeFw0yNTEw  
MTgxOTMzMzJaFw0yNjEwMTgxOTMzMzJaMIGBMQswCQYDVQQGEwJVUzEOMAwGA1UE  
CAwFU3RhdGUxDTALBgNVBAcMBENpdHkxFjAUBgNVBAoMDU9QQyBVQSBDbGllbnQx  
HjAcBgNVBAsMFUluZHVzdHJpYWwgQXV0b21hdGlvbjEbMBkGA1UEAwwST1BDIFVB  
IFRlc3QgQ2xpZW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmiRY  
c+Wmxcm+sulZiHdYiAyUDTUWoO59xDh5ipjvR/3/FYI/Zkt3sANak73cy7rT0GWj  
RRlzJeeMzrWRaxd91Qu9r0ykp6sqAwSh9EGCC92VyU3nCQxSegU1OhXHBwtVoth2  
dXVjvhbPaCs2VUN+m8AEWOqo/yBDS3cSpAChwkJHmDNIChJuE7WPDNhuqUMkplU+  
Ql52nZpSAtRIUNdvar2M4Iratm9YVWr1MdSBgT5eBJKz6QZK0At+9wR218cOoZs3  
A9zX220le57cFTnL+VcU9e0frenkYBKKixbOyNVqs9puUoHC6OuZ0Mf6P+PfKlrl  
27gHk+CCAUZBGbSdGwIDAQABo4GQMIGNMGMGA1UdEQRcMFqCCWxvY2FsaG9zdIIL  
Ki5sb2NhbGhvc3SHBH8AAAGHEAAAAAAAAAAAAAAAAAAAAAGBFm9wY3VhLWNsaWVu  
dEBsb2NhbGhvc3SGEHVybjpvcGN1YTpjbGllbnQwDgYDVR0PAQH/BAQDAgWgMBYG  
A1UdJQEB/wQMMAoGCCsGAQUFBwMCMA0GCSqGSIb3DQEBCwUAA4ICAQBhoeqKjeUw  
MRuM/v2rfD8VSa+Ektw+/D1J324/j4CSBPaCQDc7/xRV5JTarnmL0aYIdHY9CTuK  
qhpa2BG76bTQsmGRKS9r91RarAYV7hdLAToCiSCMFt7XFcxgauaUInv2gNi1xtHC  
kSZt7GLenMUs67059aeWakaH5LYGz/gz6107fbaHe34HfLg/otOaMyqT86fvj65L  
m9X8n/5ZtGZfo4TYoSwHZTRykpBI34dzCoBSJ+FVQqy14C6lnCDVOFr86AAfkb61  
4kEAHda44/Xo/qQ+c7i4fBidgVX2soXUJF2QXvwu8iJyzQztrUc0J2+NnMpxTw5s  
+wVuC4G9lz2vR55GA5miPnvqyi9uciIq1ICZ+ZolG5njAZ6PpnsG/PG4uh8By8en  
BKu7YfQhCtghCH6/oJK22vma3DSFiUxB23657J4xMB4khK/GZdV/kxVSuGXm0JL7  
+MlEHlclSSoVoqrU9uw+9TBH2doDa5eEXEO5nn2GY5xlB8egqUb+xHEYElsZ4CDZ  
TmfzrUj43HGVaUvitFZ140QVvsRi8TidsCHLidY0rBfjr9lkbour2uMgrfibU3YY  
M0ltM3eiZobpEYGh5AK5uB8vnqsOvXQXsli29xYU0zonEfzlYE+Th+TQ/qGjgX0S  
A2K+Avpr6rerJmdSC8y4K/NypKOBoz2Aug==  
-----END CERTIFICATE-----

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [October 19, 2025, 5:20pm UTC](https://forum.inductiveautomation.com/t/opc-ua-secure-connections-fail-with-badsecuritychecksfailed-despite-trusted-certificate-plain-connections-work/111581/10 "2025-10-19T17:20:30Z")

</div>

Your certificate is signed by another certificate ("OPC UA Test Root CA").

You need to make sure this root certificate is also trusted by the Ignition OPC UA server.

Also, since you are on Ignition 8.3.0, the advice about the discovery endpoint does not apply; either endpoint should work.

---

<div class="post-metadata">

**Author:** ![alcalaf](https://avatars.discourse-cdn.com/v4/letter/a/7feea3/32.png) [@alcalaf](https://forum.inductiveautomation.com/u/alcalaf)\
**Post date:** [October 19, 2025, 8:23pm UTC](https://forum.inductiveautomation.com/t/opc-ua-secure-connections-fail-with-badsecuritychecksfailed-despite-trusted-certificate-plain-connections-work/111581/11 "2025-10-19T20:23:10Z")

</div>

Thanks,  
I have both certificate in ignition. Still the same issue

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/8/8/881afe97c08b29b6a210e1d00287d9b02869d2f8.png)

-----BEGIN CERTIFICATE-----  
MIIFyDCCA7CgAwIBAgIBATANBgkqhkiG9w0BAQsFADCBgzELMAkGA1UEBhMCVVMx  
DjAMBgNVBAgMBVN0YXRlMQ0wCwYDVQQHDARDaXR5MRcwFQYDVQQKDA5PUEMgVUEg  
VGVzdCBDQTEeMBwGA1UECwwVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MRwwGgYDVQQD  
DBNPUEMgVUEgVGVzdCBSb290IENBMB4XDTI1MTAxODE5MzMzMloXDTM1MTAxNjE5  
MzMzMlowgYMxCzAJBgNVBAYTAlVTMQ4wDAYDVQQIDAVTdGF0ZTENMAsGA1UEBwwE  
Q2l0eTEXMBUGA1UECgwOT1BDIFVBIFRlc3QgQ0ExHjAcBgNVBAsMFUNlcnRpZmlj  
YXRlIEF1dGhvcml0eTEcMBoGA1UEAwwTT1BDIFVBIFRlc3QgUm9vdCBDQTCCAiIw  
DQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMfNU7vOPiL/p7oR+EoY8YImo5Bk  
zkmo3+pXbSSvF7w8OX4MrCYB1Yj+CpUPElAKD7hEFVK5BhXkuyYXpCI4lOwN8AXP  
4iQ7QxdX2wyiKVte1xA+mIB30go92r6NDGqkQpmpmzfgyX3miQgEKuaPul8OYEN6  
shtuDcdITk4V6sYDwKAw12OJ7au4mxGxzbicEh+z6qcqyNfKNkh+OwoyLAd2dvDM  
JRzYH3L+9CAtbuPTDXjYDjVdhHukyS4DaljnRq2tgaXtlNLxLFeQQpOjdqkPmDpe  
ioVmBqMR40b9KiNpktsiTnXPm67ft6sW5DvdbAcP8Fvm2qycKj+Ome6S2zwcfseg  
brhhXpwbxpErXK8aHO2Xcx2+ib0g669uYFmes3DDv1DAnRjMmUPX1KoTATyFlBgM  
EYPIqsrbws45aJLq+rCiBtQz7ouGVYG8WtIwhCLmKOCpfzlFW2Jz4zyKhkmQ15Gm  
WUqFG65x6B1KR6RZGpSqBBYRTUu/UH3iqEMmoZjPwuk5+J7g1kiP0fWYPlHtlJVJ  
OFjMaitBAR48FIVM7/acz0t21e9XZ6Q/Oxr5Aq67xCsRSxSxlcmfp6eamY1PqRpl  
MLXgn0nO3ZPzPypEug671OOyfHq+44tbnbpz3dyW3lFsHrr6uByVPqCK2k5QaDqF  
bG5fTIEhm+stFOa7AgMBAAGjRTBDMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0P  
AQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATANBgkqhkiG  
9w0BAQsFAAOCAgEAX7AfqldLYeVrm++OBdqVsJC2plWBhjW1m2xTw/R3nBV0+izl  
a3VldH9D19ayTx1oXScLj5BtoFQHSAOzlD5D570zQNBsavbsU/VBgaurOYPT7g2S  
Verq2grenIszofpvc8QgfsbMG/oCqyjd8BI7ppO/4NkRO5bb2qtd+PkFtFbnVUPn  
gozi5E1+SeGunWXr02ZyUKnMrvIdFAar4GL6T0cyP7GASrMaqAeqhqLzNnEaEP/b  
AKxpJyJ8BK9zU33BEjgznTcI9F4P9uxm2aWXsA3UPjIYuYZxvaIk7pEp1s+RNeDt  
UtN4xxvVmxbl4cDCMW1TNtEj+P3Pb+XavHtmq1eYvnVi+WMDxeanLGmqKeyzJjNO  
gHPlCx1sq0tNJ12p5KNtdCfb7Sxx9sELHb9ehDzCEuwBBWG6AzBoOSuja/hb8fuv  
ClR2q3vMFlYZniMF+sH0Gp3nRDXC5XsXny9ru+FipDetVoK1c+dxbK3RiqVuz/LO  
l2g0Jcwg3y1EcPmJI2Aye27t8qBsxFa4Z4ypxy81nxezVaaoCsdOpJ2IeAe/V5Af  
ZnjhYKsYFV6ZrbRTwDrL/rXJiUB80y+Q/YfPI6Ojj9EUOWwuju8DKGEAeU8MlxJi  
sHftX9SE1qJobN1DHT0m6t2encigBXv2dHQ7iYCG3ya+DkHu7iL8JumW5gY=  
-----END CERTIFICATE-----

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [October 19, 2025, 8:35pm UTC](https://forum.inductiveautomation.com/t/opc-ua-secure-connections-fail-with-badsecuritychecksfailed-despite-trusted-certificate-plain-connections-work/111581/12 "2025-10-19T20:35:24Z")

</div>

Your application instance certificate is missing required KeyUsage extensions.

It has Digital Signature and Key Encipherment, but is missing Non Repudiation and Data Encipherment.

See [UA Part 6: Mappings - 6.2.2 Application Instance Certificate](https://reference.opcfoundation.org/Core/Part6/v105/docs/6.2.2#:~:text=used.-,For%20RSA%20keys%2C%20the%20keyUsage%20shall%20include%20digitalSignature%2C%20nonRepudiation%2C%20keyEncipherment%20and%20dataEncipherment.,-For)