# OPCUA certificate rejected with error: Bad\_SecurityChecksFailed **URL:** \ **Category:** Ignition\ **Tags:** ignition81\ **Created:** [January 11, 2024, 9:45am UTC](https://forum.inductiveautomation.com/t/opcua-certificate-rejected-with-error-bad-securitychecksfailed/84095 "2024-01-11T09:45:48Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\ **Post date:** [January 11, 2024, 9:45am UTC](https://forum.inductiveautomation.com/t/opcua-certificate-rejected-with-error-bad-securitychecksfailed/84095/1 "2024-01-11T09:45:48Z")
Hi @Kevin.Herron We try to connect to a Siemens PLC with an OPCUA certificate provided by our customer. ```auto 2024-01-10 15:08:55:218 milo-netty-event-loop-15 [remote=/10.30.33.11:4840] Exception caught: UaException: status=Bad_SecurityChecksFailed, message=sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target io.netty.handler.codec.DecoderException: UaException: status=Bad_SecurityChecksFailed, message=sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:499) at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:290) at io.netty.handler.codec.ByteToMessageCodec.channelRead(ByteToMessageCodec.java:103) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:442) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) at org.eclipse.milo.opcua.stack.client.transport.uasc.UascClientAcknowledgeHandler.decode(UascClientAcknowledgeHandler.java:171) at io.netty.handler.codec.ByteToMessageCodec$1.decode(ByteToMessageCodec.java:42) at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:529) at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:468) at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:290) at io.netty.handler.codec.ByteToMessageCodec.channelRead(ByteToMessageCodec.java:103) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:442) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919) at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166) at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:788) at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:724) at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:650) at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:562) at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:997) at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) at java.base/java.lang.Thread.run(Unknown Source) Caused by: org.eclipse.milo.opcua.stack.core.UaException: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at org.eclipse.milo.opcua.stack.core.util.validation.CertificateValidationUtil.buildCertPath(CertificateValidationUtil.java:413) at org.eclipse.milo.opcua.stack.core.util.validation.CertificateValidationUtil.buildTrustedCertPath(CertificateValidationUtil.java:120) at org.eclipse.milo.opcua.stack.client.security.DefaultClientCertificateValidator.validateCertificateChain(DefaultClientCertificateValidator.java:64) at org.eclipse.milo.opcua.stack.client.transport.uasc.UascClientMessageHandler.onOpenSecureChannel(UascClientMessageHandler.java:469) at org.eclipse.milo.opcua.stack.client.transport.uasc.UascClientMessageHandler.decodeMessage(UascClientMessageHandler.java:394) at org.eclipse.milo.opcua.stack.client.transport.uasc.UascClientMessageHandler.decode(UascClientMessageHandler.java:382) at io.netty.handler.codec.ByteToMessageCodec$1.decode(ByteToMessageCodec.java:42) at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:529) at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:468) ... 26 common frames omitted Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(Unknown Source) at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source) at java.base/java.security.cert.CertPathBuilder.build(Unknown Source) at org.eclipse.milo.opcua.stack.core.util.validation.CertificateValidationUtil.buildCertPath(CertificateValidationUtil.java:411) ... 34 common frames omitted ``` ![ErrorCertificat](https://us1.discourse-cdn.com/inductiveautomation/original/3X/9/8/98e93eadb19931e5e4db922ad4349ca0b22394d2.png) I send you by PM de rejected certificat on ignition details logs. Any idea what is wrong in ignition settings or in the certificat ? From ua expert on the gateway we have this error: ![MicrosoftTeams-image (2)](https://us1.discourse-cdn.com/inductiveautomation/original/3X/2/0/2007a596fd789ebe009958b7fcbe9a6fbc438dcc.jpeg) ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [January 11, 2024, 1:09pm UTC](https://forum.inductiveautomation.com/t/opcua-certificate-rejected-with-error-bad-securitychecksfailed/84095/2 "2024-01-11T13:09:32Z")
> [@mazeyrat](#): > > certificate provided by our customer Their certificate is signed by a CA that is unknown, or by an intermediate certificate of a CA where the intermediate is unknown. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [January 11, 2024, 1:09pm UTC](https://forum.inductiveautomation.com/t/opcua-certificate-rejected-with-error-bad-securitychecksfailed/84095/3 "2024-01-11T13:09:43Z")
Looks like you don’t have the whole certificate chain. I’m on mobile until next week, won’t be able to help much. ---
**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\ **Post date:** [January 11, 2024, 4:02pm UTC](https://forum.inductiveautomation.com/t/opcua-certificate-rejected-with-error-bad-securitychecksfailed/84095/4 "2024-01-11T16:02:21Z")
@Kevin.Herron, @pturmel For opcu client certificate, may I need to add something in: ```auto %gateway installation directory%data/certificates/supplemental ``` [https://docs.inductiveautomation.com/display/DOC81/Security+Certificates](https://docs.inductiveautomation.com/display/DOC81/Security+Certificates) ---
**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\ **Post date:** [January 12, 2024, 11:08am UTC](https://forum.inductiveautomation.com/t/opcua-certificate-rejected-with-error-bad-securitychecksfailed/84095/5 "2024-01-12T11:08:17Z")
@Kevin.Herron, @pturmel we try to troubleshot with UaExpert and Ignition, and now we have some error around crl. ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/8/0/80c449a9d5eefd8dd2d5d786b2bf0f600b9a3e49.jpeg) Our certificat has some Certificat Revocation List mentioned in the server certificat with: URL=[http://xxxxx/CRL/CA\_Subordinate01.crl](http://xxxxx/CRL/CA_Subordinate01.crl) **Can you confirm Ignition is responsible to request this url, or may I need manually do it and place the file returned in a gateway folder ?** Sorry, can't provide the exact error right now because we have very limited acces to the system. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [January 12, 2024, 1:24pm UTC](https://forum.inductiveautomation.com/t/opcua-certificate-rejected-with-error-bad-securitychecksfailed/84095/6 "2024-01-12T13:24:41Z")
I would expect Ignition to request those URLs itself. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [January 12, 2024, 1:56pm UTC](https://forum.inductiveautomation.com/t/opcua-certificate-rejected-with-error-bad-securitychecksfailed/84095/7 "2024-01-12T13:56:21Z")
The intermediate and root certs would need to be placed in the data/opcua/client/pki/issuers/certs dir. the CRLs would go in the crl dir but I’m not sure if Ignition is strict about them existing or not. I don’t think it downloads them. ---
**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\ **Post date:** [January 12, 2024, 3:40pm UTC](https://forum.inductiveautomation.com/t/opcua-certificate-rejected-with-error-bad-securitychecksfailed/84095/8 "2024-01-12T15:40:14Z")
thanks, I will try to run some test next week to see if they are mandatory, and I will try to manually download them and put them in: ```auto data\opcua\client\security\pki\issuers\crl ``` ---
**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\ **Post date:** [January 12, 2024, 4:37pm UTC](https://forum.inductiveautomation.com/t/opcua-certificate-rejected-with-error-bad-securitychecksfailed/84095/9 "2024-01-12T16:37:52Z")
Do you think, we need to install for the Ignition opcua client a certificate provided by the same CA of than the OPUA PLC server ? How can change Ignition opcua client certificate ? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [January 12, 2024, 4:46pm UTC](https://forum.inductiveautomation.com/t/opcua-certificate-rejected-with-error-bad-securitychecksfailed/84095/10 "2024-01-12T16:46:33Z")
No that shouldn’t be necessary. You just need to mark the ignition client certificate as trusted in the plc, or import it as trusted ahead of time. ---
**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\ **Post date:** [January 12, 2024, 4:54pm UTC](https://forum.inductiveautomation.com/t/opcua-certificate-rejected-with-error-bad-securitychecksfailed/84095/11 "2024-01-12T16:54:47Z")
ok I see, but if my customer request to change the **opcua client** certificat of Ignition, I don't see in documentation how to use another one instead of the one generated by Ignition. How to do this ? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [January 12, 2024, 5:13pm UTC](https://forum.inductiveautomation.com/t/opcua-certificate-rejected-with-error-bad-securitychecksfailed/84095/12 "2024-01-12T17:13:57Z")
In the PKI dir there is a keystore. You can add new keys/ certs or replace the default. An advanced setting on the connections allows you to specify the alias of the cert to use for that connection. This is not documented or supported further. ---
**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\ **Post date:** [January 12, 2024, 6:14pm UTC](https://forum.inductiveautomation.com/t/opcua-certificate-rejected-with-error-bad-securitychecksfailed/84095/13 "2024-01-12T18:14:49Z")
Sorry, I'm not sure to well understand. ## OPC UA Client Connection Settings ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/3/5/35eba19e34ab77631d00fe3eaa0701b0e87e1438.png) The keystore file can be put in this directory: ```python Ignition\data\opcua\client\security ``` the file must have a pfx format. ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/5/d/5d94a88ab62908be780c86049f17b2695b52f6ab.png) The name of the file is the **KeyStore Alias** connections advanced parameter ? The keyStore password is the **Password Fields** connections advanced parameter ? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [January 12, 2024, 9:47pm UTC](https://forum.inductiveautomation.com/t/opcua-certificate-rejected-with-error-bad-securitychecksfailed/84095/14 "2024-01-12T21:47:40Z")
The keystore file can hold multiple keys and certificates. The alias identifies which one to use on that connection. ---
**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\ **Post date:** [January 13, 2024, 8:40am UTC](https://forum.inductiveautomation.com/t/opcua-certificate-rejected-with-error-bad-securitychecksfailed/84095/15 "2024-01-13T08:40:37Z")
Ok I see what you mean: ```auto C:\Program Files\Inductive Automation\Ignition\data\opc\opcua-module\keystore ``` ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/d/e/de1766ff5ebadd785fdef96491ae8759958072cf.png) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [January 13, 2024, 3:57pm UTC](https://forum.inductiveautomation.com/t/opcua-certificate-rejected-with-error-bad-securitychecksfailed/84095/16 "2024-01-13T15:57:47Z")
Yes, but that looks like the keystore from a 7.9 gateway? ---
**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\ **Post date:** [January 14, 2024, 5:56pm UTC](https://forum.inductiveautomation.com/t/opcua-certificate-rejected-with-error-bad-securitychecksfailed/84095/17 "2024-01-14T17:56:33Z")
It's a 8.1 gateway, probably upgraded from 8.0 or 7.9. I have another 8.1.36 fresh install, but I don't find any keystore file, no ignition/data/opc folder, and no keystore in Ignition/data/opcua/client/security. Where is the keystore file directory for 8.1 ? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [January 14, 2024, 6:00pm UTC](https://forum.inductiveautomation.com/t/opcua-certificate-rejected-with-error-bad-securitychecksfailed/84095/18 "2024-01-14T18:00:32Z")
Since 8.0 there are two KeyStores, one for client, one for server: - `$IGNITION/data/opcua/client/security/certificates.pfx` - `$IGNITION/data/opcua/server/security/certificates.pfx` ---
**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\ **Post date:** [January 15, 2024, 8:04am UTC](https://forum.inductiveautomation.com/t/opcua-certificate-rejected-with-error-bad-securitychecksfailed/84095/19 "2024-01-15T08:04:24Z")
Ok, but there is a password to edit **certificates.pfx** if we need to add some key in the keystore for a custom client opcua certificate ? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [January 15, 2024, 11:22am UTC](https://forum.inductiveautomation.com/t/opcua-certificate-rejected-with-error-bad-securitychecksfailed/84095/20 "2024-01-15T11:22:27Z")
The password is "password". [Next page](https://forum.inductiveautomation.com/t/opcua-certificate-rejected-with-error-bad-securitychecksfailed/84095.md?page=2)