# URI specified in the ApplicationDescription does not match the URI in the Certificate **URL:** \ **Category:** Ignition\ **Created:** [August 1, 2020, 2:33pm UTC](https://forum.inductiveautomation.com/t/uri-specified-in-the-applicationdescription-does-not-match-the-uri-in-the-certificate/37283 "2020-08-01T14:33:17Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![zju\_yj](https://avatars.discourse-cdn.com/v4/letter/z/5f8ce5/32.png) [@zju\_yj](https://forum.inductiveautomation.com/u/zju_yj)\ **Post date:** [August 1, 2020, 2:33pm UTC](https://forum.inductiveautomation.com/t/uri-specified-in-the-applicationdescription-does-not-match-the-uri-in-the-certificate/37283/1 "2020-08-01T14:33:17Z")
Hi Guys, I’m using FactoryTalk linx gateway and OPC UA server v6.11.0 as the OPC UA server to publish SCADA tags from PLC, and try to let ignition edge (8.0.xx) as the OPC UA client on a remote PC in the same network to connect to the OPC UA server, the discovery and certificate trust of the OPC UA Server went well, however, after OPC UA server on linx gateway approved this ignitional UA client certificate, it shows the below error. I tried to remove the old cert and restart the ignition gateway, it still shows the below error. UaException: status=Bad\_CertificateUriInvalid, message=The URI specified in the ApplicationDescription does not match the URI in the Certificate. at org.eclipse.milo.opcua.stack.core.util.validation.CertificateValidationUtil.checkApplicationUri(CertificateValidationUtil.java:655) at org.eclipse.milo.opcua.stack.client.security.DefaultClientCertificateValidator.validateCertificateChain(DefaultClientCertificateValidator.java:99) at org.eclipse.milo.opcua.sdk.client.session.SessionFsmFactory.lambda$createSession$49(SessionFsmFactory.java:836) at java.base/java.util.concurrent.CompletableFuture$UniCompose.tryFire(Unknown Source) at java.base/java.util.concurrent.CompletableFuture.postComplete(Unknown Source) at java.base/java.util.concurrent.CompletableFuture.complete(Unknown Source) at org.eclipse.milo.opcua.stack.client.UaStackClient.lambda$deliverResponse$5(UaStackClient.java:256) at org.eclipse.milo.opcua.stack.core.util.ExecutionQueue$Task.run(ExecutionQueue.java:119) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) at java.base/java.lang.Thread.run(Unknown Source) 8.0.14 (b2020062220) Azul Systems, Inc. 11.0.6 ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 2, 2020, 1:03am UTC](https://forum.inductiveautomation.com/t/uri-specified-in-the-applicationdescription-does-not-match-the-uri-in-the-certificate/37283/2 "2020-08-02T01:03:48Z")
This means either one of two things: 1. The URI in the endpoints truly doesn’t match the URI in the certificate. 2. The URI in the certificate has characters in it that make it an invalid URI, usually a space that hasn’t been URL-encoded, and when the comparison happens it fails because this invalid URI got parsed into a null value by that point. In either case, you can either connect without security or fix this on the server somehow. Re-generating the certificate on the server might help, but if not you may need to call Rockwell about it. ---
**Author:** ![zju\_yj](https://avatars.discourse-cdn.com/v4/letter/z/5f8ce5/32.png) [@zju\_yj](https://forum.inductiveautomation.com/u/zju_yj)\ **Post date:** [August 2, 2020, 2:20am UTC](https://forum.inductiveautomation.com/t/uri-specified-in-the-applicationdescription-does-not-match-the-uri-in-the-certificate/37283/3 "2020-08-02T02:20:59Z")
Hi Kevin, Thanks for the prompt reply. could you please help me to have a look at the info between server and client cert? I found strange, the ignition edge version before 8 don’t have this issue, but after 8.0 has. This issue happened on ignition 8.0.14. ![ignition UA client cert](https://us1.discourse-cdn.com/inductiveautomation/original/3X/0/3/03ac2a19f3b51d07b56c5eb847c92c8f6182d17e.jpeg) ![linx_gateway](https://us1.discourse-cdn.com/inductiveautomation/original/3X/9/0/903e07dc46e0d8b3fa75232347f654c4df8c310f.jpeg) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 2, 2020, 2:26am UTC](https://forum.inductiveautomation.com/t/uri-specified-in-the-applicationdescription-does-not-match-the-uri-in-the-certificate/37283/4 "2020-08-02T02:26:19Z")
The URI in the server certificate has spaces in it: “FactoryTalk Linx Gateway OPC UA Server” This check was upgraded from suppressed with a warning in 7.x to a connection failure in 8 in accordance with the OPC UA spec, which states this check cannot be suppressed. ---
**Author:** ![zju\_yj](https://avatars.discourse-cdn.com/v4/letter/z/5f8ce5/32.png) [@zju\_yj](https://forum.inductiveautomation.com/u/zju_yj)\ **Post date:** [August 2, 2020, 4:00am UTC](https://forum.inductiveautomation.com/t/uri-specified-in-the-applicationdescription-does-not-match-the-uri-in-the-certificate/37283/5 "2020-08-02T04:00:26Z")
I found all over the FactoryTalk linx gateway configuration window, there is no way to change the application name to remove the space between words, is there other way to modify at ignition OPC UA module to suite the space in OPC UA server application name? ![outgoing cert](https://us1.discourse-cdn.com/inductiveautomation/original/3X/0/2/022c7a9c74dd9311ed2dea9f1483915b80c27c01.jpeg) ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [August 2, 2020, 2:57pm UTC](https://forum.inductiveautomation.com/t/uri-specified-in-the-applicationdescription-does-not-match-the-uri-in-the-certificate/37283/6 "2020-08-02T14:57:42Z")
Consider attempting to construct the certificate for FactoryTalk manually, with `%20` in place of the spaces. ---
**Author:** ![zju\_yj](https://avatars.discourse-cdn.com/v4/letter/z/5f8ce5/32.png) [@zju\_yj](https://forum.inductiveautomation.com/u/zju_yj)\ **Post date:** [August 2, 2020, 3:43pm UTC](https://forum.inductiveautomation.com/t/uri-specified-in-the-applicationdescription-does-not-match-the-uri-in-the-certificate/37283/7 "2020-08-02T15:43:30Z")
Thank you Sir. Can you please advise how to edit security cert? It shows X509/\*.der file, the “edit propertities” buttons are greyed even with administrator account. This is the FT linx gateway (OPC Server) outgoing cert to Ignition OPC UA client, should I replace the space with “%20” in the CN (factorytalk linx gateway)? ![edit cert](https://us1.discourse-cdn.com/inductiveautomation/original/3X/f/2/f2799f5f4f3bb05c117ba01d49d912701268db05.jpeg) ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [August 2, 2020, 3:56pm UTC](https://forum.inductiveautomation.com/t/uri-specified-in-the-applicationdescription-does-not-match-the-uri-in-the-certificate/37283/8 "2020-08-02T15:56:51Z")
You would use OpenSSL or some other signature tool to construct a complete new self-signed certificate with everything the same except for proper urlencoding. I would re-use that private key, but OpenSSL can make a new one, too, if necessary. [https://www.openssl.org/docs/man1.1.1/man1/openssl-req.html](https://www.openssl.org/docs/man1.1.1/man1/openssl-req.html) ---
**Author:** ![zju\_yj](https://avatars.discourse-cdn.com/v4/letter/z/5f8ce5/32.png) [@zju\_yj](https://forum.inductiveautomation.com/u/zju_yj)\ **Post date:** [August 3, 2020, 10:09am UTC](https://forum.inductiveautomation.com/t/uri-specified-in-the-applicationdescription-does-not-match-the-uri-in-the-certificate/37283/9 "2020-08-03T10:09:00Z")
Sorry, Pturmel. This really goes beyond my capability. Is there other way that I can change at ignition side to suite the space between the words in the OPC UA uri? I uploaded the certificate file, if you can help me to trim the space as required by ignition software, it will be really helpful. this is the ftlinx gateway OPC UA server cert, [cert\_ftgw\_opcua\_server.der](https://forum.inductiveautomation.com/uploads/short-url/pKJhBxPrVCl9V2FaFG0yCzFrI1u.der) (1.2 KB) this is the ignition gateway as OPC UA Client cert which had been trusted by FT linx gateway server. [8bd35d641209b3edd75f1c2e1672b35c886b089e.der](https://forum.inductiveautomation.com/uploads/short-url/jWXdm19RiKdF6IIc9G3xxxXl0gm.der) (1.1 KB) ---
**Author:** ![zju\_yj](https://avatars.discourse-cdn.com/v4/letter/z/5f8ce5/32.png) [@zju\_yj](https://forum.inductiveautomation.com/u/zju_yj)\ **Post date:** [August 8, 2020, 3:18pm UTC](https://forum.inductiveautomation.com/t/uri-specified-in-the-applicationdescription-does-not-match-the-uri-in-the-certificate/37283/10 "2020-08-08T15:18:55Z")
Hi Pturmel. Can you please give me more details, how can I construct a new certificate with only space replaced with “%20” in the uri? thank you ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [August 9, 2020, 1:33am UTC](https://forum.inductiveautomation.com/t/uri-specified-in-the-applicationdescription-does-not-match-the-uri-in-the-certificate/37283/11 "2020-08-09T01:33:02Z")
I haven’t had to make any certs with subject Alternate Names before, but there are examples in that man page I linked. ---
**Author:** ![Mark.Foltarz](https://avatars.discourse-cdn.com/v4/letter/m/ac91a4/32.png) [@Mark.Foltarz](https://forum.inductiveautomation.com/u/Mark.Foltarz)\ **Post date:** [August 17, 2020, 6:36pm UTC](https://forum.inductiveautomation.com/t/uri-specified-in-the-applicationdescription-does-not-match-the-uri-in-the-certificate/37283/12 "2020-08-17T18:36:06Z")
I was able to change ( ans supposedly match) the URI but I am still getting error. Look in the C:\Program Files (x86)\Rockwell Software\RSOPC Gateway directory. for a file called “create\_server\_certificate.bat” You can edit line # 96 : SET SERVER\_ALTERNATIVE\_SUBJECT=URI:urn:%HOST\_NAME%:\*\*FactoryTalk Linx Gateway OPC UA Server,\*\*DNS:%FQDN%,IP:%IP\_ADDRESS% Change “FactoryTalk Linx Gateway OPC UA Server” to “FactoryTalkLinxGatewayOPCUAServer” or whatever you want and save the .bat file. You then regenerate the certificate. In FactoryTalk Gateway you will see the URI has changed. Verify contenets of cert by running certutil -dump cert\_ftgw\_opcua\_server.der from a command window. I then created the connection in Ignition but I am still getting error : UaException: status=Bad\_CertificateUriInvalid, message=The URI specified in the ApplicationDescription does not match the URI in the Certificate. ---
**Author:** ![zju\_yj](https://avatars.discourse-cdn.com/v4/letter/z/5f8ce5/32.png) [@zju\_yj](https://forum.inductiveautomation.com/u/zju_yj)\ **Post date:** [August 18, 2020, 4:34pm UTC](https://forum.inductiveautomation.com/t/uri-specified-in-the-applicationdescription-does-not-match-the-uri-in-the-certificate/37283/13 "2020-08-18T16:34:00Z")
status=Bad\_CertificateUriInvalid, description=The URI specified in the ApplicationDescription does not match the URI in the Certificate. @Kevin.Herron@pturmel, can you please explain with more details what is “URI specified in the application description”??, what is URI in the certificate (i assume its OPC UA server certificate) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 18, 2020, 4:35pm UTC](https://forum.inductiveautomation.com/t/uri-specified-in-the-applicationdescription-does-not-match-the-uri-in-the-certificate/37283/14 "2020-08-18T16:35:44Z")
It’s the same thing as is going on here: [Trying to use Ignition to work with Rockwell’s Studio 5000 Emulate.](http://forum.inductiveautomation.com/t/trying-to-use-ignition-to-work-with-rockwell-s-studio-5000-emulate/37746/31) The ApplicationDescription is a structure in the endpoints that has an application URI in it, and that application URI must be the same as the one embedded in the server’s certificate. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [August 18, 2020, 5:10pm UTC](https://forum.inductiveautomation.com/t/uri-specified-in-the-applicationdescription-does-not-match-the-uri-in-the-certificate/37283/15 "2020-08-18T17:10:07Z")
{ This is from that other thread. Should have been here. } Try modifying the batch file to encode spaces in the subject alternate name as %20 instead of removing them. Since it is a batch file, you’ll probably have to double the percent signs to avoid environment substitution. ---
**Author:** ![joel1](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/joel1/32/22504_2.png) [@joel1](https://forum.inductiveautomation.com/u/joel1)\ **Post date:** [July 11, 2023, 6:56am UTC](https://forum.inductiveautomation.com/t/uri-specified-in-the-applicationdescription-does-not-match-the-uri-in-the-certificate/37283/16 "2023-07-11T06:56:40Z")
> [@Kevin.Herron](#): > > connect without security How would one do this? I'm not seeing an option to connect without security in the UI. EDIT: Using Ignition Version: 8.0.11