# SEL RTAC to Ignition OPC-UA server **URL:** \ **Category:** Ignition\ **Created:** [March 6, 2025, 7:38pm UTC](https://forum.inductiveautomation.com/t/sel-rtac-to-ignition-opc-ua-server/103346 "2025-03-06T19:38:12Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![dturner](https://avatars.discourse-cdn.com/v4/letter/d/90ced4/32.png) [@dturner](https://forum.inductiveautomation.com/u/dturner)\ **Post date:** [March 6, 2025, 7:38pm UTC](https://forum.inductiveautomation.com/t/sel-rtac-to-ignition-opc-ua-server/103346/1 "2025-03-06T19:38:12Z")
I am trying to use the OPC-UA client from an RTAC (SEL-3350) to communicate with an Ignition OPC-UA server on a virtual machine. I am having issues getting the two to connect. Has anyone connected to Ignition using the RTAC OPC-UA Client and if so, how did you get it to work? Connection ![Network](https://us1.discourse-cdn.com/inductiveautomation/original/3X/4/0/401a77c51dc00a809abe195991d84ec22d79fe8d.png) The 0 is there in the IP Address just out of view. ![Ignition OPC-UA Settings](https://us1.discourse-cdn.com/inductiveautomation/original/3X/b/1/b1ceee156fe88873543d69a82afd0aebb3129114.png) Things I have Tried: 1. Toggling the Anonymous Access Allowed checkbox. 2. opc.tcp://10.100.100.70:62541/discovery in the RTAC 3. opc.tcp://10.100.100.70:62541 in the RTAC 4. Added the IP Address to the Endpoint addresses. 5. Looked at Windows Firewall settings. System: - Operating system: Windows Server 2022 - Ignition version: IgnitionEdge 8.1.44 ---
**Author:** ![jlandwerlen](https://avatars.discourse-cdn.com/v4/letter/j/bc8723/32.png) [@jlandwerlen](https://forum.inductiveautomation.com/u/jlandwerlen)\ **Post date:** [March 6, 2025, 7:43pm UTC](https://forum.inductiveautomation.com/t/sel-rtac-to-ignition-opc-ua-server/103346/2 "2025-03-06T19:43:54Z")
I did, but so long ago I don't remember much. The Ignition side was simple, the main issue I had was the RTAC wasn't setup correctly (which I wasn't in charge of), once it was setup correctly it connected just fine. To add, the last time I checked the RTAC can't do redundancy and OPC-UA, so might be worth poking at that before you go too far down this path. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 6, 2025, 8:05pm UTC](https://forum.inductiveautomation.com/t/sel-rtac-to-ignition-opc-ua-server/103346/3 "2025-03-06T20:05:12Z")
Set the Bind Address to `0.0.0.0` and restart. You might also want to add the "None" SecurityPolicy while you're at it, e.g. `None, Basic256Sha256`. Turn on the "Exposed Tags" setting if you want other clients to be able to see your Ignition Tags and not just your configured devices. Changes to these settings need a restart to take effect. ---
**Author:** ![dturner](https://avatars.discourse-cdn.com/v4/letter/d/90ced4/32.png) [@dturner](https://forum.inductiveautomation.com/u/dturner)\ **Post date:** [March 7, 2025, 12:27am UTC](https://forum.inductiveautomation.com/t/sel-rtac-to-ignition-opc-ua-server/103346/4 "2025-03-07T00:27:04Z")
Changing the Bind Address to 0.0.0.0 and the security policy to None allow the RTAC to start importing data but the Ignition server faulted during the process. The error message I am getting now is listed below. ```python UaException: status=Bad_ConfigurationError, message=no matching endpoints found at com.inductiveautomation.ignition.gateway.opcua.client.ManagedClientKt.initialize(ManagedClient.kt:139) at com.inductiveautomation.ignition.gateway.opcua.client.ManagedClientKt.access$initialize(ManagedClient.kt:1) at com.inductiveautomation.ignition.gateway.opcua.client.ManagedClientKt$initialize$1.invokeSuspend(ManagedClient.kt) at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33) at kotlinx.coroutines.DispatchedTask.run(DispatchedTask.kt:106) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) at java.base/java.lang.Thread.run(Unknown Source) ``` ---
**Author:** ![dturner](https://avatars.discourse-cdn.com/v4/letter/d/90ced4/32.png) [@dturner](https://forum.inductiveautomation.com/u/dturner)\ **Post date:** [March 7, 2025, 12:29am UTC](https://forum.inductiveautomation.com/t/sel-rtac-to-ignition-opc-ua-server/103346/5 "2025-03-07T00:29:32Z")
The comment about redundancy is good to know because I have another project coming up that is similar to this with redundancy! I will definitely look into that. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 7, 2025, 12:53am UTC](https://forum.inductiveautomation.com/t/sel-rtac-to-ignition-opc-ua-server/103346/6 "2025-03-07T00:53:09Z")
You might need to run through discovery again for the Ignition loopback connection. It looks like maybe you didn’t include the Basic256Sha256 security policy or an IP addresss used in the configured connection isn’t there any more. ---
**Author:** ![dturner](https://avatars.discourse-cdn.com/v4/letter/d/90ced4/32.png) [@dturner](https://forum.inductiveautomation.com/u/dturner)\ **Post date:** [March 7, 2025, 1:03am UTC](https://forum.inductiveautomation.com/t/sel-rtac-to-ignition-opc-ua-server/103346/7 "2025-03-07T01:03:45Z")
Okay, I will check as soon as I can get connectivity back to the server. ---
**Author:** ![dturner](https://avatars.discourse-cdn.com/v4/letter/d/90ced4/32.png) [@dturner](https://forum.inductiveautomation.com/u/dturner)\ **Post date:** [March 7, 2025, 8:51pm UTC](https://forum.inductiveautomation.com/t/sel-rtac-to-ignition-opc-ua-server/103346/8 "2025-03-07T20:51:19Z")
The IP Address for the server and client changed to 172.16.70.33 and 172.16.70.20 respectively. When I go through discovery, I get an internal error after I select the server. Attached is my wrapper log [wrapper.log](https://forum.inductiveautomation.com/uploads/short-url/sUoMzEg0X585h7VSHhPo2MIfpvD.log) (2.4 MB) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 7, 2025, 9:08pm UTC](https://forum.inductiveautomation.com/t/sel-rtac-to-ignition-opc-ua-server/103346/9 "2025-03-07T21:08:40Z")
Ugh, that markup error requires you to stop Ignition, delete the `data/jar-cache` folder wherever Ignition is installed, and start it again. Can you post a screenshot of your server settings as it currently stands? ---
**Author:** ![dturner](https://avatars.discourse-cdn.com/v4/letter/d/90ced4/32.png) [@dturner](https://forum.inductiveautomation.com/u/dturner)\ **Post date:** [March 7, 2025, 9:14pm UTC](https://forum.inductiveautomation.com/t/sel-rtac-to-ignition-opc-ua-server/103346/10 "2025-03-07T21:14:46Z")
Current server settings. ![Server 01](https://us1.discourse-cdn.com/inductiveautomation/original/3X/c/5/c55a985119b6e4793afdd801074e260a72f8f3e8.png) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 7, 2025, 9:19pm UTC](https://forum.inductiveautomation.com/t/sel-rtac-to-ignition-opc-ua-server/103346/11 "2025-03-07T21:19:12Z")
Ok those look fine, you'll just have to walk through the endpoint discovery again for the connection again, or if you can't get that working use "skip to advanced" and we'll have to manually update the discovery and endpoint URLs. On a fresh install the loopback connection's URLs use "localhost" so that your server getting a new IP address doesn't cause the connection to break -- not sure what's going on for you. ---
**Author:** ![dturner](https://avatars.discourse-cdn.com/v4/letter/d/90ced4/32.png) [@dturner](https://forum.inductiveautomation.com/u/dturner)\ **Post date:** [March 7, 2025, 9:39pm UTC](https://forum.inductiveautomation.com/t/sel-rtac-to-ignition-opc-ua-server/103346/12 "2025-03-07T21:39:26Z")
Deleting the jar-cache file allowed to go through the discovery process again. However, I am getting security messages when trying to get the RTAC to connect. [wrapper.log](https://forum.inductiveautomation.com/uploads/short-url/m7zR2k9ilMLmQ3KC4tGk3rOhNsW.log) (2.5 MB) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 7, 2025, 9:40pm UTC](https://forum.inductiveautomation.com/t/sel-rtac-to-ignition-opc-ua-server/103346/13 "2025-03-07T21:40:26Z")
Have you trusted the RTAC client certificate yet? If so, download it and attach it here and I'll take a look and see if there's anything wrong with it. ---
**Author:** ![dturner](https://avatars.discourse-cdn.com/v4/letter/d/90ced4/32.png) [@dturner](https://forum.inductiveautomation.com/u/dturner)\ **Post date:** [March 7, 2025, 10:10pm UTC](https://forum.inductiveautomation.com/t/sel-rtac-to-ignition-opc-ua-server/103346/14 "2025-03-07T22:10:53Z")
I trusted what I believe is the client. ![Trusted Server](https://us1.discourse-cdn.com/inductiveautomation/original/3X/d/7/d7b07afb402c6e668fd00277b085e3f5b186c443.png) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 7, 2025, 10:12pm UTC](https://forum.inductiveautomation.com/t/sel-rtac-to-ignition-opc-ua-server/103346/15 "2025-03-07T22:12:22Z")
Yeah that's probably it, click the Cloud Icon to download it and then upload it to the forum. ---
**Author:** ![dturner](https://avatars.discourse-cdn.com/v4/letter/d/90ced4/32.png) [@dturner](https://forum.inductiveautomation.com/u/dturner)\ **Post date:** [March 7, 2025, 10:24pm UTC](https://forum.inductiveautomation.com/t/sel-rtac-to-ignition-opc-ua-server/103346/16 "2025-03-07T22:24:23Z")
[195ce7c711cb41b2b797adc6ef23a8ca3ab98f29 [CN%3DAcRTAC+Datasource+OpcUa+Browser].der](https://forum.inductiveautomation.com/uploads/short-url/xfDR6JgTPGQTF0h1t4FqAGSOqMS.der) (788 Bytes) ---
**Author:** ![dturner](https://avatars.discourse-cdn.com/v4/letter/d/90ced4/32.png) [@dturner](https://forum.inductiveautomation.com/u/dturner)\ **Post date:** [March 7, 2025, 10:47pm UTC](https://forum.inductiveautomation.com/t/sel-rtac-to-ignition-opc-ua-server/103346/17 "2025-03-07T22:47:40Z")
This is what appears in the wrapper log when I try to get the RTAC to connect. ```python INFO | jvm 1 | 2025/03/07 14:29:56 | E [o.e.m.o.s.s.t.u.UascServerAsymmetricHandler] [14:29:56.928]: [remote=/172.16.70.1:21837] Exception caught; sent ErrorMessage{error=StatusCode{name=Bad_CertificateUseNotAllowed, value=0x80180000, quality=bad}, reason=status=Bad_CertificateUseNotAllowed, description=The Certificate may not be used for the requested operation.} INFO | jvm 1 | 2025/03/07 14:29:56 | io.netty.handler.codec.DecoderException: UaException: status=Bad_CertificateUseNotAllowed, message=The Certificate may not be used for the requested operation. INFO | jvm 1 | 2025/03/07 14:29:56 | at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:500) INFO | jvm 1 | 2025/03/07 14:29:56 | at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:290) INFO | jvm 1 | 2025/03/07 14:29:56 | at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444) INFO | jvm 1 | 2025/03/07 14:29:56 | at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) INFO | jvm 1 | 2025/03/07 14:29:56 | at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) INFO | jvm 1 | 2025/03/07 14:29:56 | at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1407) INFO | jvm 1 | 2025/03/07 14:29:56 | at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440) INFO | jvm 1 | 2025/03/07 14:29:56 | at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) INFO | jvm 1 | 2025/03/07 14:29:56 | at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:918) INFO | jvm 1 | 2025/03/07 14:29:56 | at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166) INFO | jvm 1 | 2025/03/07 14:29:56 | at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:788) INFO | jvm 1 | 2025/03/07 14:29:56 | at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:724) INFO | jvm 1 | 2025/03/07 14:29:56 | at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:650) INFO | jvm 1 | 2025/03/07 14:29:56 | at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:562) INFO | jvm 1 | 2025/03/07 14:29:56 | at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:994) INFO | jvm 1 | 2025/03/07 14:29:56 | at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) INFO | jvm 1 | 2025/03/07 14:29:56 | at java.base/java.lang.Thread.run(Unknown Source) INFO | jvm 1 | 2025/03/07 14:29:56 | Caused by: org.eclipse.milo.opcua.stack.core.UaException: status=Bad_CertificateUseNotAllowed, description=The Certificate may not be used for the requested operation. INFO | jvm 1 | 2025/03/07 14:29:56 | at org.eclipse.milo.opcua.stack.server.security.DefaultServerCertificateValidator.validateCertificateChain(DefaultServerCertificateValidator.java:117) INFO | jvm 1 | 2025/03/07 14:29:56 | at org.eclipse.milo.opcua.stack.server.transport.uasc.UascServerAsymmetricHandler.onOpenSecureChannel(UascServerAsymmetricHandler.java:198) INFO | jvm 1 | 2025/03/07 14:29:56 | at org.eclipse.milo.opcua.stack.server.transport.uasc.UascServerAsymmetricHandler.decode(UascServerAsymmetricHandler.java:120) INFO | jvm 1 | 2025/03/07 14:29:56 | at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:530) INFO | jvm 1 | 2025/03/07 14:29:56 | at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:469) INFO | jvm 1 | 2025/03/07 14:29:56 | ... 16 common frames omitted ``` ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 7, 2025, 10:53pm UTC](https://forum.inductiveautomation.com/t/sel-rtac-to-ignition-opc-ua-server/103346/18 "2025-03-07T22:53:36Z")
This certificate is missing some things that would make it a valid OPC UA application instance certificate. See [UA Part 6: Mappings - 6.2.2 Application Instance Certificate](https://reference.opcfoundation.org/Core/Part6/v105/docs/6.2.2); - KeyUsage is missing `keyCertSign` - BasicConstraints is missing entirely ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/c/6/c6f57c353acbc33f30f3a81e22ab5d5592084e26.jpeg) Do you have any control over the generation of this certificate? You may need support from SEL. You might also be able to enable the "None" security policy and allow anonymous identities on the Ignition server and connect without security for now. ---
**Author:** ![dturner](https://avatars.discourse-cdn.com/v4/letter/d/90ced4/32.png) [@dturner](https://forum.inductiveautomation.com/u/dturner)\ **Post date:** [March 7, 2025, 11:13pm UTC](https://forum.inductiveautomation.com/t/sel-rtac-to-ignition-opc-ua-server/103346/19 "2025-03-07T23:13:35Z")
When I set it to None, do I need to restart the OPC-UA driver? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 7, 2025, 11:14pm UTC](https://forum.inductiveautomation.com/t/sel-rtac-to-ignition-opc-ua-server/103346/20 "2025-03-07T23:14:09Z")
Any change to the server settings page requires a restart of either the entire OPC UA module, or preferably the Ignition Gateway. In Ignition 8.3 the Ignition OPC UA server itself will restart as necessary (temporarily disconnecting any connected clients), but restarting the Ignition Gateway won't be necessary any more. [Next page](https://forum.inductiveautomation.com/t/sel-rtac-to-ignition-opc-ua-server/103346.md?page=2)