# Trying to use Ignition to work with Rockwell’s Studio 5000 Emulate. **URL:** \ **Category:** General Discussion\ **Created:** [August 14, 2020, 6:46pm UTC](https://forum.inductiveautomation.com/t/trying-to-use-ignition-to-work-with-rockwell-s-studio-5000-emulate/37746 "2020-08-14T18:46:12Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Mark.Foltarz](https://avatars.discourse-cdn.com/v4/letter/m/ac91a4/32.png) [@Mark.Foltarz](https://forum.inductiveautomation.com/u/Mark.Foltarz)\ **Post date:** [August 14, 2020, 6:46pm UTC](https://forum.inductiveautomation.com/t/trying-to-use-ignition-to-work-with-rockwell-s-studio-5000-emulate/37746/1 "2020-08-14T18:46:12Z")
I am trying to use Ignition to work with Rockwell’s Studio 5000 Emulate. I have been able to get Ignition to work with the emulator without signing and encrytption. However, when I try to set up a connection using Basic256Sha256 and SignAndEncrypt I always get the error below. Any help would be greatly appreciated. Thanks UaException: status=Bad\_CertificateUriInvalid, message=The URI specified in the ApplicationDescription does not match the URI in the Certificate. at org.eclipse.milo.opcua.stack.core.util.CertificateValidationUtil.validateApplicationUri(CertificateValidationUtil.java:305) at com.inductiveautomation.ignition.gateway.opcua.client.ClientManager.initializeObject(ClientManager.kt:123) at com.inductiveautomation.ignition.gateway.opcua.client.ClientManager$initializeObject$1.invokeSuspend(ClientManager.kt) at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33) at kotlinx.coroutines.DispatchedTask.run(Dispatched.kt:241) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) at java.base/java.lang.Thread.run(Unknown Source) 8.0.4 (b2019091612) Azul Systems, Inc. 11.0.4 ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 14, 2020, 6:49pm UTC](https://forum.inductiveautomation.com/t/trying-to-use-ignition-to-work-with-rockwell-s-studio-5000-emulate/37746/2 "2020-08-14T18:49:12Z")
The most likely cause for this is that their certificate contains an invalid application URI, specifically, one that contains whitespace or some other character that is supposed to be URL-encoded but hasn’t been. When Ignition parses this field in the certificate as a URI it fails and causes a security check that compares the URI in the certificate to the one in the ApplicationDescription in the server endpoints to fail as well. You should contact Rockwell to 1) let them know this is an issue, 2) figure out if you can change some setting that influences the value of the application URI. Until the certificate is generated without an invalid URI you won’t be able to connect with security enabled. If you want to upload the server certificate I can verify that this is what’s happening. ---
**Author:** ![Mark.Foltarz](https://avatars.discourse-cdn.com/v4/letter/m/ac91a4/32.png) [@Mark.Foltarz](https://forum.inductiveautomation.com/u/Mark.Foltarz)\ **Post date:** [August 14, 2020, 7:01pm UTC](https://forum.inductiveautomation.com/t/trying-to-use-ignition-to-work-with-rockwell-s-studio-5000-emulate/37746/3 "2020-08-14T19:01:28Z")
Thank you Kevin, The system is not allowing me to upload the .der file. Is there another way I can send it to you? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 14, 2020, 7:01pm UTC](https://forum.inductiveautomation.com/t/trying-to-use-ignition-to-work-with-rockwell-s-studio-5000-emulate/37746/4 "2020-08-14T19:01:59Z")
You can email it to me at [kevin@inductiveautomation.com](mailto:kevin@inductiveautomation.com) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 14, 2020, 7:16pm UTC](https://forum.inductiveautomation.com/t/trying-to-use-ignition-to-work-with-rockwell-s-studio-5000-emulate/37746/5 "2020-08-14T19:16:48Z")
Confirmed the certificate does have an application URI that contains spaces. ---
**Author:** ![Mark.Foltarz](https://avatars.discourse-cdn.com/v4/letter/m/ac91a4/32.png) [@Mark.Foltarz](https://forum.inductiveautomation.com/u/Mark.Foltarz)\ **Post date:** [August 14, 2020, 7:23pm UTC](https://forum.inductiveautomation.com/t/trying-to-use-ignition-to-work-with-rockwell-s-studio-5000-emulate/37746/6 "2020-08-14T19:23:10Z")
Can I modify the certificate or should I change the application and regenerate the certificate ? Thanks ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 14, 2020, 7:28pm UTC](https://forum.inductiveautomation.com/t/trying-to-use-ignition-to-work-with-rockwell-s-studio-5000-emulate/37746/7 "2020-08-14T19:28:52Z")
I don’t think it’s possible to modify the certificate. Unless you can get the application name changed in Studio 5000 and generate a new certificate with a valid URI there’s not much else you can do. ---
**Author:** ![Mark.Foltarz](https://avatars.discourse-cdn.com/v4/letter/m/ac91a4/32.png) [@Mark.Foltarz](https://forum.inductiveautomation.com/u/Mark.Foltarz)\ **Post date:** [August 17, 2020, 6:19pm UTC](https://forum.inductiveautomation.com/t/trying-to-use-ignition-to-work-with-rockwell-s-studio-5000-emulate/37746/8 "2020-08-17T18:19:30Z")
Kevin I was able to change the URI generated by the Rockwell application. This Is the uri from the application: urn:ZSU-WN-T-SS-02:FactoryTalkServer This is the dump from the certUtil with the URL : URL=urn:ZSU-WN-T-SS-02:FactoryTalkServer They look exactly the same to me. I tried to create the connection in Ignition again but I am getting the error UaException: status=Bad\_CertificateUriInvalid, message=The URI specified in the ApplicationDescription does not match the URI in the Certificate. So at this point not sure what to look for. Can you offer any guidance ? Thanks ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 17, 2020, 6:22pm UTC](https://forum.inductiveautomation.com/t/trying-to-use-ignition-to-work-with-rockwell-s-studio-5000-emulate/37746/9 "2020-08-17T18:22:10Z")
Are you able to get a Wireshark capture of the connection attempts? Did you restart or reinitialize the server after you changed the URI? ---
**Author:** ![Mark.Foltarz](https://avatars.discourse-cdn.com/v4/letter/m/ac91a4/32.png) [@Mark.Foltarz](https://forum.inductiveautomation.com/u/Mark.Foltarz)\ **Post date:** [August 17, 2020, 6:39pm UTC](https://forum.inductiveautomation.com/t/trying-to-use-ignition-to-work-with-rockwell-s-studio-5000-emulate/37746/10 "2020-08-17T18:39:25Z")
Is there a way to restart Ignition without restarting the PC ? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 17, 2020, 6:40pm UTC](https://forum.inductiveautomation.com/t/trying-to-use-ignition-to-work-with-rockwell-s-studio-5000-emulate/37746/11 "2020-08-17T18:40:40Z")
Yes, but I meant have you restarted FactoryTalk yet? ---
**Author:** ![Mark.Foltarz](https://avatars.discourse-cdn.com/v4/letter/m/ac91a4/32.png) [@Mark.Foltarz](https://forum.inductiveautomation.com/u/Mark.Foltarz)\ **Post date:** [August 17, 2020, 6:53pm UTC](https://forum.inductiveautomation.com/t/trying-to-use-ignition-to-work-with-rockwell-s-studio-5000-emulate/37746/12 "2020-08-17T18:53:22Z")
I restarted the whole box. No change. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 17, 2020, 6:58pm UTC](https://forum.inductiveautomation.com/t/trying-to-use-ignition-to-work-with-rockwell-s-studio-5000-emulate/37746/13 "2020-08-17T18:58:02Z")
Can you get a Wireshark capture of Ignition attempting to connect? I suspect now what’s wrong is what this security check is actually supposed to catch in the first place - you changed the application URI in the certificate but the URI in the ApplicationDescription in the endpoints returned by the server’s GetEndpoints does not match. ---
**Author:** ![Mark.Foltarz](https://avatars.discourse-cdn.com/v4/letter/m/ac91a4/32.png) [@Mark.Foltarz](https://forum.inductiveautomation.com/u/Mark.Foltarz)\ **Post date:** [August 17, 2020, 7:17pm UTC](https://forum.inductiveautomation.com/t/trying-to-use-ignition-to-work-with-rockwell-s-studio-5000-emulate/37746/14 "2020-08-17T19:17:29Z")
OK I’ll take a crash course in WireShark momentarily, but I notice there is no certificate from Ignition in FactoryTalk Gateway. Where can I find the Ignition server certificate ? I’m going to try and import that into FT Gateway. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 17, 2020, 7:20pm UTC](https://forum.inductiveautomation.com/t/trying-to-use-ignition-to-work-with-rockwell-s-studio-5000-emulate/37746/15 "2020-08-17T19:20:43Z")
You can find it on the gateway config section, under OPC UA \> Security, on the _Server_ tab (because you’re viewing certificates the Ignition server trusts). It will have a Common Name of “Ignition OPC UA Client” and you can download it with the icon on the far right. I would think that FactoryTalk would have a quarantine area to trust client certificates that it populates as clients connect and that you just aren’t getting far enough into the connection process to see it yet. ---
**Author:** ![Mark.Foltarz](https://avatars.discourse-cdn.com/v4/letter/m/ac91a4/32.png) [@Mark.Foltarz](https://forum.inductiveautomation.com/u/Mark.Foltarz)\ **Post date:** [August 17, 2020, 7:23pm UTC](https://forum.inductiveautomation.com/t/trying-to-use-ignition-to-work-with-rockwell-s-studio-5000-emulate/37746/16 "2020-08-17T19:23:16Z")
Also I’m not all sure about using wireshark to monitor a secure connections ---
**Author:** ![Mark.Foltarz](https://avatars.discourse-cdn.com/v4/letter/m/ac91a4/32.png) [@Mark.Foltarz](https://forum.inductiveautomation.com/u/Mark.Foltarz)\ **Post date:** [August 17, 2020, 7:23pm UTC](https://forum.inductiveautomation.com/t/trying-to-use-ignition-to-work-with-rockwell-s-studio-5000-emulate/37746/17 "2020-08-17T19:23:51Z")
Yes there is a quarantine area, It never gets the cert ---
**Author:** ![Mark.Foltarz](https://avatars.discourse-cdn.com/v4/letter/m/ac91a4/32.png) [@Mark.Foltarz](https://forum.inductiveautomation.com/u/Mark.Foltarz)\ **Post date:** [August 17, 2020, 7:31pm UTC](https://forum.inductiveautomation.com/t/trying-to-use-ignition-to-work-with-rockwell-s-studio-5000-emulate/37746/18 "2020-08-17T19:31:27Z")
By the way, I was able to get Ignition to see FT Gateway if I had created the endpoint with no security poilcy. I verified that data coming through by using OPC Quick Client. But if f I add security, ie Basic 256 Sign & Encrypt, I’ll get that message ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 17, 2020, 7:33pm UTC](https://forum.inductiveautomation.com/t/trying-to-use-ignition-to-work-with-rockwell-s-studio-5000-emulate/37746/19 "2020-08-17T19:33:11Z")
> [@Mark.Foltarz](#): > > Also I’m not all sure about using wireshark to monitor a secure connections Generally it's not very useful, but the exchange I need to see happens before a secure connection is set up, calling the server's GetEndpoints service. > [@Mark.Foltarz](#): > > But if f I add security, ie Basic 256 Sign & Encrypt, I’ll get that message Yes, because no security policy means no certificate validation (unless you're using a username/password, in which case it can still come into play). As soon as you try to secure the connection all your certificate issues need to be fixed before it will work. ---
**Author:** ![Mark.Foltarz](https://avatars.discourse-cdn.com/v4/letter/m/ac91a4/32.png) [@Mark.Foltarz](https://forum.inductiveautomation.com/u/Mark.Foltarz)\ **Post date:** [August 17, 2020, 7:40pm UTC](https://forum.inductiveautomation.com/t/trying-to-use-ignition-to-work-with-rockwell-s-studio-5000-emulate/37746/20 "2020-08-17T19:40:13Z")
OK I’ve started wire shark. To reduce the trafiic I need to set a filter. Should that be the IP of Ignition ? [Next page](https://forum.inductiveautomation.com/t/trying-to-use-ignition-to-work-with-rockwell-s-studio-5000-emulate/37746.md?page=2)