# Trouble with Certificates **URL:** \ **Category:** Ignition Early Access\ **Created:** [May 14, 2019, 1:28pm UTC](https://forum.inductiveautomation.com/t/trouble-with-certificates/24971 "2019-05-14T13:28:23Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![carolineuchoa.estuda](https://avatars.discourse-cdn.com/v4/letter/c/ba8739/32.png) [@carolineuchoa.estuda](https://forum.inductiveautomation.com/u/carolineuchoa.estuda)\ **Post date:** [May 14, 2019, 1:28pm UTC](https://forum.inductiveautomation.com/t/trouble-with-certificates/24971/1 "2019-05-14T13:28:23Z")
Hello, I’ve recently updated to Ignition 8 and I’m having an issue that I’m unable to find a solution. So I have an Ignition project that is connected to LabView, where Labview acts as a client and can modify tags. Everything worked fine with Ignition 7.9, but now I’m having this error message when I try to connect the Labview program to my OPC-UA endpoint (which is correct, since I’ve checked it multiple times): ![image](https://us1.discourse-cdn.com/inductiveautomation/original/2X/b/b34f030127430eecf6128316c57140749ec2e5b0.png) I’ve searched for the trusted certificates that was rejected or something, but everything seems fine: ![image](https://us1.discourse-cdn.com/inductiveautomation/original/2X/4/496a9d3f8f7c98cfd19182716b32c121defa51fa.png) But apparently, when trying to connect to the server from another Third Party Client, it connects perfectly to that same endpoint I’m trying to connect with Labview. Keep in mind that the LabView program was working fine before I updated, And I didn’t change anything for it to stop working. Anyone has an idea of what could be happening? Thanks in advance. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [May 14, 2019, 1:33pm UTC](https://forum.inductiveautomation.com/t/trouble-with-certificates/24971/2 "2019-05-14T13:33:36Z")
The error message you’re seeing is from your client, suggesting that it doesn’t trust the Ignition OPC UA server certificate. A new certificate was generated when you upgraded, so if you had to previously do something to import or trust the server certificate you’ll have to do it again. ---
**Author:** ![carolineuchoa.estuda](https://avatars.discourse-cdn.com/v4/letter/c/ba8739/32.png) [@carolineuchoa.estuda](https://forum.inductiveautomation.com/u/carolineuchoa.estuda)\ **Post date:** [May 14, 2019, 1:36pm UTC](https://forum.inductiveautomation.com/t/trouble-with-certificates/24971/3 "2019-05-14T13:36:02Z")
That’s weird because I didn’t import any certificate the first time ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [May 14, 2019, 1:37pm UTC](https://forum.inductiveautomation.com/t/trouble-with-certificates/24971/4 "2019-05-14T13:37:38Z")
Maybe NI support will have something to say about it. Seems pretty straightforward unless that error message is not to be believed. I’m a bit curious about why both your certificates show “Invalid date” in that table, though. ---
**Author:** ![carolineuchoa.estuda](https://avatars.discourse-cdn.com/v4/letter/c/ba8739/32.png) [@carolineuchoa.estuda](https://forum.inductiveautomation.com/u/carolineuchoa.estuda)\ **Post date:** [May 14, 2019, 1:40pm UTC](https://forum.inductiveautomation.com/t/trouble-with-certificates/24971/5 "2019-05-14T13:40:32Z")
Yes, I don’t know about that either, and I honestly can’t remeber if before the update it was showing that “invalid date” expiration. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [May 14, 2019, 1:41pm UTC](https://forum.inductiveautomation.com/t/trouble-with-certificates/24971/6 "2019-05-14T13:41:51Z")
This page didn’t exist in 7.9 and neither did these particular certificates. Is there a download button next to the certificates? Or any more info if you expand by clicking on the “+”? ---
**Author:** ![carolineuchoa.estuda](https://avatars.discourse-cdn.com/v4/letter/c/ba8739/32.png) [@carolineuchoa.estuda](https://forum.inductiveautomation.com/u/carolineuchoa.estuda)\ **Post date:** [May 14, 2019, 1:44pm UTC](https://forum.inductiveautomation.com/t/trouble-with-certificates/24971/7 "2019-05-14T13:44:14Z")
That’s why I can’t remember then, haha. That’s all that appears when I expand the info: For some reason I can’t download the certificates. Nothing happens when I click the button. ![image](https://us1.discourse-cdn.com/inductiveautomation/original/2X/6/6a096535d0bb582bfb1f35ca7f2ba7592cfffcc6.png) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [May 14, 2019, 1:49pm UTC](https://forum.inductiveautomation.com/t/trouble-with-certificates/24971/8 "2019-05-14T13:49:50Z")
Well, not sure what that’s about, probably a bug in the JS for that page. In the loggers area of the gateway you can click the gear and then find the logger for `DefaultCertificateValidator` and turn it to DEBUG. Then force LabView to try and connect again. See if there’s any messages about the certificate being invalid. Otherwise I think you’ll need NI support to give you a hint about what that error message means and if you need to do anything with the server certificate. ---
**Author:** ![carolineuchoa.estuda](https://avatars.discourse-cdn.com/v4/letter/c/ba8739/32.png) [@carolineuchoa.estuda](https://forum.inductiveautomation.com/u/carolineuchoa.estuda)\ **Post date:** [May 14, 2019, 2:02pm UTC](https://forum.inductiveautomation.com/t/trouble-with-certificates/24971/9 "2019-05-14T14:02:41Z")
No messages appeared when I did this and tried to connect to Labview again. However, I found this error message from 2 hours ago, when I was already trying to connect. This message is the only one that refers to certificates at my logs. Probably I’ll need to talk to NI support like you suggested. ![image](https://us1.discourse-cdn.com/inductiveautomation/original/2X/a/a1f73c2393f43aea42ac1f5185728ba6c88d80f9.png) **Expanded:** io.netty.handler.codec.DecoderException: UaException: status=Bad\_SecurityChecksFailed, message=certificate path validation failed at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:472) at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:278) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:359) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:345) at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:337) at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1408) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:359) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:345) at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:930) at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:163) at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:677) at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:612) at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:529) at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:491) at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:905) at java.base/java.lang.Thread.run(Unknown Source) Caused by: org.eclipse.milo.opcua.stack.core.UaException: certificate path validation failed at org.eclipse.milo.opcua.stack.core.util.CertificateValidationUtil.verifyTrustChain(CertificateValidationUtil.java:205) at org.eclipse.milo.opcua.stack.core.security.DefaultCertificateValidator.verifyTrustChain(DefaultCertificateValidator.java:45) at org.eclipse.milo.opcua.stack.server.transport.uasc.UascServerAsymmetricHandler.onOpenSecureChannel(UascServerAsymmetricHandler.java:201) at org.eclipse.milo.opcua.stack.server.transport.uasc.UascServerAsymmetricHandler.decode(UascServerAsymmetricHandler.java:124) at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:502) at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:441) … 15 common frames omitted ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [May 14, 2019, 2:22pm UTC](https://forum.inductiveautomation.com/t/trouble-with-certificates/24971/10 "2019-05-14T14:22:10Z")
That would be the message that occurs until you’ve marked the NI certificate as trusted, which you have since done. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [May 14, 2019, 4:05pm UTC](https://forum.inductiveautomation.com/t/trouble-with-certificates/24971/11 "2019-05-14T16:05:16Z")
@carolineuchoa.estuda re: “Invalid date”, what locale is your system in? and what browser? ---
**Author:** ![Jonathan\_ASEcuador](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@Jonathan\_ASEcuador](https://forum.inductiveautomation.com/u/Jonathan_ASEcuador)\ **Post date:** [May 15, 2019, 12:34am UTC](https://forum.inductiveautomation.com/t/trouble-with-certificates/24971/12 "2019-05-15T00:34:58Z")
I have the same problem, but im trying to communicate with Tia Portal V15. Using Ignition 7.9 as an OPC UA Server, it works perfect!, but now i need to use Ignition 8 as an OPC UA Server and it doesn’t works. I have downloaded the authentication certs from Ignition to put them into the Tia Portal trust certs folder and viceversa, but it doesn’t works. ---
**Author:** ![carolineuchoa.estuda](https://avatars.discourse-cdn.com/v4/letter/c/ba8739/32.png) [@carolineuchoa.estuda](https://forum.inductiveautomation.com/u/carolineuchoa.estuda)\ **Post date:** [May 16, 2019, 11:30am UTC](https://forum.inductiveautomation.com/t/trouble-with-certificates/24971/13 "2019-05-16T11:30:39Z")
Sorry about the delay. By locale you mean the geographic localization of the system? If yes, it is in Brazil. The browser my company uses is Firefox. ---
**Author:** ![carolineuchoa.estuda](https://avatars.discourse-cdn.com/v4/letter/c/ba8739/32.png) [@carolineuchoa.estuda](https://forum.inductiveautomation.com/u/carolineuchoa.estuda)\ **Post date:** [May 16, 2019, 11:31am UTC](https://forum.inductiveautomation.com/t/trouble-with-certificates/24971/14 "2019-05-16T11:31:26Z")
Could you post the solution here if you someday find it? I’ll do the same, thanks! ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [July 18, 2019, 12:44pm UTC](https://forum.inductiveautomation.com/t/trouble-with-certificates/24971/15 "2019-07-18T12:44:26Z")
A post was split to a new topic: [Kepware Bad\_CertificateUriInvalid](https://forum.inductiveautomation.com/t/kepware-bad-certificateuriinvalid/26662)