Skip to main content
QQ_147241093-Newcomer
3-Newcomer
Oct 21, 2026 8:42 AM UTC
Solved

KEPServerEX CA certificates

Hello,

 

We are using KEPServerEX 6.17.269.0 and are evaluating CA-based trust for OPC UA client application certificates.

We successfully tested importing a CA certificate into Trusted Clients and connecting an OPC UA client whose certificate was signed by that CA, without individually approving the client certificate.

We also found a similar discussion describing the same behavior:

https://community.ptc.com/kepware-396/requirement-trust-certificate-from-few-clients-automatically-157567

However, we could not find any official documentation confirming this functionality.

Could someone from PTC confirm:

  1. Is CA-based trust for OPC UA client application certificates officially supported in KEPServerEX 6.17.269.0?

  2. Does trusting a CA certificate automatically establish trust for all valid client certificates issued by that CA?

  3. Is this behavior officially supported and expected to remain available in future versions?

  4. Are there any specific requirements or limitations regarding certificate chains, intermediate CAs, or CRL validation?

We would appreciate a reference to the official documentation, if available.

 

Best regards

    MKhatriAnswer
    Support
    Oct 22, 2026 6:28 PM UTC

    Greeting!
     

    • Yes, CA-based trust for OPC UA client certificates is supported in KEPServerEX 6.17.269.0.
    • Yes, trusting a CA certificate automatically trusts valid client certificates issued by that CA, provided certificate validation is successful.
    • Yes, this behavior is expected and aligns with standard OPC UA certificate trust mechanisms. Future functionality is subject to product release changes.
    • Requirements include a valid certificate chain, proper handling of any intermediate CA certificates, valid certificate dates, and successful certificate validation. CRL/revocation handling depends on the certificate configuration and environment.
       

    Official Documentation:-https://www.ptc.com/en/support/article/CS355587

    Regards,
    Mohit

     

    View in thread

    1 reply

    MKhatriCommunity ManagerAnswer
    Support
    Oct 22, 2026 6:28 PM UTC

    Greeting!
     

    • Yes, CA-based trust for OPC UA client certificates is supported in KEPServerEX 6.17.269.0.
    • Yes, trusting a CA certificate automatically trusts valid client certificates issued by that CA, provided certificate validation is successful.
    • Yes, this behavior is expected and aligns with standard OPC UA certificate trust mechanisms. Future functionality is subject to product release changes.
    • Requirements include a valid certificate chain, proper handling of any intermediate CA certificates, valid certificate dates, and successful certificate validation. CRL/revocation handling depends on the certificate configuration and environment.
       

    Official Documentation:-https://www.ptc.com/en/support/article/CS355587

    Regards,
    Mohit

     

    Translate
      Terms & ConditionsAccessibility statement