Skip to main content
JR_108090485-Regular Member
5-Regular Member
August 14, 2026
Solved

OPCUA Server BadCertificateHostNameInvalid connection error

  • August 14, 2026
  • 4 replies
  • 118 views

I am trying to connect to KEPServerEX 6 from an EWON device.  I set up the security and got he message on the KEPServer log that the EWON was now trusted and could open a connection.

When I tried to connect to browse for tags in the KEPServer, I received the error 

opcuaiosrv-Connect fail (BadCertificateHostNameInvalid)

on the client side.

After working on this for awhile, I noticed that the KEPServer certificate in the EWON repository was listed as being from the verbose computer name endpoint and I was trying to attach from the IP endpoint.

Would this make a difference and if so, how do I generate a KEPServer certificate for the IP endpoint?  I don’t seem to be able to attach to the computer name endpoint with the EWON device.

Or does this message mean something else?  The computer times are within a minute and security levels match.  The EWON doesn’t seem to allow no security connections, so I have no luck turning security off.

Best answer by JR_10809048

Thanks for your reply.

The EWON device does not allow me by default to use an endpoint that is a computer hostname.  It is set up to only allow by IP address of the host.  It also does not allow a security level of None.  For some reason I do not seem to be able to get OPC UA Configuration to generate a certificate that has the endpoint as just the IP address:port.  Or, if it is, the EWON is acting as if it does not.  

Do you have any advice of getting KEPServerEX to have a certificate that is IP based instead of hostname based.  If they already do this, how can I prove it to myself? 

4 replies

ntripathi16-Pearl
16-Pearl
August 18, 2026

Greetings ​@JR_10809048,

Please take a look at the following article as it may help resolve your issue:

https://www.ptc.com/en/support/article/CS320774

If you are prompted to log in to view the complete article, you can use your MyKepware login credentials.

If you have any questions or need further assistance, please feel free to contact us. We will be happy to assist you.

 

JR_108090485-Regular MemberAuthorAnswer
5-Regular Member
August 18, 2026

Thanks for your reply.

The EWON device does not allow me by default to use an endpoint that is a computer hostname.  It is set up to only allow by IP address of the host.  It also does not allow a security level of None.  For some reason I do not seem to be able to get OPC UA Configuration to generate a certificate that has the endpoint as just the IP address:port.  Or, if it is, the EWON is acting as if it does not.  

Do you have any advice of getting KEPServerEX to have a certificate that is IP based instead of hostname based.  If they already do this, how can I prove it to myself? 

JR_108090485-Regular MemberAuthor
5-Regular Member
August 20, 2026

After a lot of searching, I finally tracked down the problem and I pass it along in case someone else runs into this in the future.

KEPServerEX normally will issue an endpoint based on the IP address.  It was not in my case.  I defined the endpoint but when the runtime reinitialized, it opened the other endpoints (computer name and wrap-back) but not the IP one.  The cause of this was an issue between the OS and the NIC.  In particular, I was using an Anker USB-C to Gigabit Ethernet adapter on a laptop with no native NIC (no RJ-45 port).  When you define the endpoint as an IP, you attach it to a specific NIC.  For some reason, KEPServer saw something wrong with the adapter and did not open the IP version.  When I went to another NIC, it all worked fine.

I am not sure there was specifically an issue with the Ankur, it could have been how I set it up, but getting a different NIC involved cleared the issue.

Terms & ConditionsAccessibility statement