# OPC UA Server certificate from CA **URL:** \ **Category:** Ignition\ **Tags:** ignition81\ **Created:** [July 10, 2023, 10:55pm UTC](https://forum.inductiveautomation.com/t/opc-ua-server-certificate-from-ca/76167 "2023-07-10T22:55:09Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Derek\_Rowland](https://avatars.discourse-cdn.com/v4/letter/d/74df32/32.png) [@Derek\_Rowland](https://forum.inductiveautomation.com/u/Derek_Rowland)\ **Post date:** [July 10, 2023, 10:55pm UTC](https://forum.inductiveautomation.com/t/opc-ua-server-certificate-from-ca/76167/1 "2023-07-10T22:55:09Z")
Is the OPC UA module's server able to use CA generated certificates or only server self-signed certificate via the Config -\> Opcua -\> Security -\> Certificates tab -\> Server Certificate -\> Regenerate button? I am curious whether I can ask our IT team to generate a certificate for the OPC UA service for internal authenticated use ---
**Author:** ![kcollins](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kcollins/32/19646_2.png) [@kcollins](https://forum.inductiveautomation.com/u/kcollins)\ **Post date:** [July 10, 2023, 11:15pm UTC](https://forum.inductiveautomation.com/t/opc-ua-server-certificate-from-ca/76167/2 "2023-07-10T23:15:04Z")
The keystore used by the OPC-UA Server is located at: ```auto data/opcua/server/security/certificates.pfx ``` You should be able to package up your own certificate/private key in a PKCS12 keystore at this same location. Keystore password is `password`. I'm not sure of the specifics (@Kevin.Herron might have more insights) of the cert, but you might need to make sure to include a valid URI for Ignition in the certificate SAN, something similar to this from the generated cert: ![2023-07-10 at 6.11 PM](https://us1.discourse-cdn.com/inductiveautomation/original/3X/8/4/84a3f72791230907f76aa3a7fbee4361121188fb.png) I think that without this, you might experience a `Bad_CertificateUriInvalid` UA exception when trying to connect since the certificate won't match the underlying server. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [July 10, 2023, 11:28pm UTC](https://forum.inductiveautomation.com/t/opc-ua-server-certificate-from-ca/76167/3 "2023-07-10T23:28:20Z")
If you open the keystore in something like KeyStore Explorer you can generate a CSR based on the existing self-signed certificate that might make it easier... OPC UA certificates require a number of extensions, including the application URI with a UUID matching the one in the `data/opcua/.uuid` file, and if your CA doesn't understand that it's generating an OPC UA certificate it may not get it right. ---
**Author:** ![Derek\_Rowland](https://avatars.discourse-cdn.com/v4/letter/d/74df32/32.png) [@Derek\_Rowland](https://forum.inductiveautomation.com/u/Derek_Rowland)\ **Post date:** [July 11, 2023, 3:20pm UTC](https://forum.inductiveautomation.com/t/opc-ua-server-certificate-from-ca/76167/4 "2023-07-11T15:20:59Z")
This information is incredibly helpful. I get the impression the OPC UA certificate requirements are requirements of the OPC UA protocol, not specific requirements of Ignition. OPC UA usage is fairly new to our business and we don't have anyone with experience with the protocol, do you have any resources you could direct me to that could help our IT cert team know how to generate compliant certificates? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [July 11, 2023, 3:24pm UTC](https://forum.inductiveautomation.com/t/opc-ua-server-certificate-from-ca/76167/5 "2023-07-11T15:24:47Z")
Some good info here: - [UA Part 4: Services - 6.1.2 Obtaining and installing an Application Instance Certificate](https://reference.opcfoundation.org/Core/Part4/v105/docs/6.1.2) - [UA Part 6: Mappings - 6.2.2 Application Instance Certificate](https://reference.opcfoundation.org/Core/Part6/v105/docs/6.2.2) By Q1 next year we should have support for what in the OPC UA world is called a "Global Discovery Server". (as in, you can manage the Ignition OPC UA certs using a GDS, not that we will act as one). The intention with a GDS in the OPC UA world is that it also plays the role of managing certificates for your OPC UA client and server applications across an enterprise, as it has both push and pull based services for distributing and renewing OPC UA application certificates. GDS products are just recently starting to come to market, though. ---
**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\ **Post date:** [July 11, 2023, 7:01pm UTC](https://forum.inductiveautomation.com/t/opc-ua-server-certificate-from-ca/76167/6 "2023-07-11T19:01:13Z")
By Q1 next year we should have support for what in the OPC UA world is called a "Global Discovery Server". Do you ever known if it will be available for Ignition 8.3 or for 8.1 branch too ? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [July 11, 2023, 7:14pm UTC](https://forum.inductiveautomation.com/t/opc-ua-server-certificate-from-ca/76167/7 "2023-07-11T19:14:37Z")
Should be 8.1, along with the OPC UA 1.05 support. Support for subscribing to Events (and Alarms/Conditions, which are just a subtype of Event) will be Ignition 8.3 because it's going to use some infrastructure we're building there. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 16, 2023, 5:26pm UTC](https://forum.inductiveautomation.com/t/opc-ua-server-certificate-from-ca/76167/8 "2023-08-16T17:26:31Z")
> [@Kevin.Herron](#): > > Should be 8.1, along with the OPC UA 1.05 support. This is no longer certain... OPC UA 1.05 and everything that depends on it may end up in 8.3 instead.