# PLCnext Bad\_CertificateUseNotAllowed **URL:** \ **Category:** Ignition\ **Created:** [July 1, 2025, 10:33pm UTC](https://forum.inductiveautomation.com/t/plcnext-bad-certificateusenotallowed/108018 "2025-07-01T22:33:39Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![zimlichg](https://avatars.discourse-cdn.com/v4/letter/z/74df32/32.png) [@zimlichg](https://forum.inductiveautomation.com/u/zimlichg)\ **Post date:** [July 1, 2025, 10:33pm UTC](https://forum.inductiveautomation.com/t/plcnext-bad-certificateusenotallowed/108018/1 "2025-07-01T22:33:39Z")
Hi i am working on a project using codesys on a phoenix plcnext plc i have trusted the ignition certificate and I still cannot connect. I also cannot connect even with the security certificate box unchecked. I have tried testing on uaexpert as a client and it was giving me a bad time error i changed the PLC clock now it gives me a badtimeout error and on ignition i get a UaException: status=Bad\_CertificateUseNotAllowed ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [July 1, 2025, 10:51pm UTC](https://forum.inductiveautomation.com/t/plcnext-bad-certificateusenotallowed/108018/2 "2025-07-01T22:51:46Z")
What version of Ignition are you using? Are you able to get a Wireshark capture? I _think_ Bad\_CertificateUseNotAllowed is returned by the Server in this case, indicating it may not like something about Ignition's client certificate. Is there any more to error message / stack trace available? ---
**Author:** ![zimlichg](https://avatars.discourse-cdn.com/v4/letter/z/74df32/32.png) [@zimlichg](https://forum.inductiveautomation.com/u/zimlichg)\ **Post date:** [July 1, 2025, 10:58pm UTC](https://forum.inductiveautomation.com/t/plcnext-bad-certificateusenotallowed/108018/3 "2025-07-01T22:58:25Z")
8.1.48 The system is at somewhere I am working on being able to wireshark it but would it help to have the certificates? at first uaexpert was giving me a timeerror about my plc's clock not being set right so i changed that and now i get the bad timeout on there ignition has been steady with the bad certificate not allowed the wole time ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [July 1, 2025, 11:04pm UTC](https://forum.inductiveautomation.com/t/plcnext-bad-certificateusenotallowed/108018/4 "2025-07-01T23:04:52Z")
Sure I can take a look at the certificates and see if anything stands out. If you can, attach the Ignition OPC UA client certificate and the OPC UA server certificate from PLCnext. ---
**Author:** ![zimlichg](https://avatars.discourse-cdn.com/v4/letter/z/74df32/32.png) [@zimlichg](https://forum.inductiveautomation.com/u/zimlichg)\ **Post date:** [July 1, 2025, 11:08pm UTC](https://forum.inductiveautomation.com/t/plcnext-bad-certificateusenotallowed/108018/5 "2025-07-01T23:08:43Z")
![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/5/4/54cdd20d45552a4ac514374a7a2d3224e33e40d7.png) [OPCUAServer@axcf2152.cer](https://forum.inductiveautomation.com/uploads/short-url/vuh4qmbRqt6lLwi8Qep1tWzeAYU.cer) (1.1 KB) [Ignition OPC UA Client.cer](https://forum.inductiveautomation.com/uploads/short-url/kkgU1J9ocq6w8NTttlYtFwAG1ca.cer) (1.1 KB) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [July 1, 2025, 11:14pm UTC](https://forum.inductiveautomation.com/t/plcnext-bad-certificateusenotallowed/108018/6 "2025-07-01T23:14:01Z")
Is your Ignition an upgrade from a previous version? I think you may need to regenerate the Ignition OPC UA client certificate. Newly generated self-signed certificates should indicate they are _not_ a CA, but yours is indicating that it is. This was a change that happened some time in OPC UA 1.05, and I'm guessing the PLCnext server has a configuration switch hidden away somewhere to allow the legacy behavior (self-signed certs with the CA flag). But it's easier to just generate a new client certificate for Ignition. After you regenerate it you may need to edit/save the connection to force it to be picked up, not sure. ---
**Author:** ![zimlichg](https://avatars.discourse-cdn.com/v4/letter/z/74df32/32.png) [@zimlichg](https://forum.inductiveautomation.com/u/zimlichg)\ **Post date:** [July 1, 2025, 11:25pm UTC](https://forum.inductiveautomation.com/t/plcnext-bad-certificateusenotallowed/108018/7 "2025-07-01T23:25:21Z")
Got it thanks so much!