Skip to main content
GP_146884103-Newcomer
3-Newcomer
Oct 7, 2026 6:20 AM UTC
Question

Kepware server OPC - UA communication certificate issue

We are using Kepware server as OPC UA server as well as OPC UA client in two different machines. When I try to connect Server at Client, Server's certificate is automatically getting fetched in Client's 'Trusted servers' tab of OPC UA Configuration manager, which I am trusting manually. Similarly, when I again try to connect Server at Client, Client's certificate is getting fetched in Server's 'Trusted Clients' tab of OPC UA Configuration manager , which I am trusting manually. However, again when I am trying to connect still I am getting 'Client or server certificate invalid . Configure or verify the certificates' log in Server and not able to connect.  With Security policy set as NONE the communication is working, hence there is no TCP port connectivity issue, but when Security Policy: Basic256Sha256, the communication failing. I tried reissuing certificates using OPC UA Configuration manager and manually exporting and importing certificates from Server and Client but same issue is coming. Please let us know how to troubleshoot this further, is there any logs which I can enable to know what exactly is causing issue?

1 reply

MKhatriCommunity Manager
Support
Oct 8, 2026 12:10 PM UTC

Hello 

Since communication is working with Security Policy = None, the issue appears to be related to certificate validation rather than network connectivity.

Please verify the following:

  • Ensure both the Client and Server certificates are moved from the Rejected store to the Trusted store.
  • Restart the KEPServerEX Runtime Service after trusting the certificates.
  • Verify that the certificates are not expired.
  • Check for any Application URI or Hostname mismatch between the certificate and the configured endpoint.
  • Confirm that both sides are configured to use Basic256Sha256.

Additionally, please review the KEPServerEX Event Log for more detailed certificate validation errors. If the issue persists, kindly provide:

  • Event Log entries showing the error.
  • Screenshots of the Trusted and Rejected certificate stores on both machines.
  • KEPServerEX version information.
  • A Wireshark capture collected during the failed connection attempt.

The detailed Event Log message should help identify whether the issue is related to certificate trust, certificate validity, URI mismatch, hostname mismatch, or another certificate validation failure.

Best Regards,
Mohit Khatri

Translate
Terms & ConditionsAccessibility statement