TopView engine unable to connect to OPC UA server: SHA 1 Certificates are not trusted

TopView engine unable to connect to OPC UA server: SHA 1 Certificates are not trusted

Issue

The TopView engine was unable to connect to the OPC UA server due to certificate issues. When inspecting the logs, we could see similar error messages to those that would occasionally appear when testing connections.

This issue may show as the following error messages when testing connections in TopView Configurator:
Certificate status: BadCertificatePolicyCheckFailed (code: 2165571584)
SHA1 signed certificates are not trusted.

You may see the following when running an engine:
Failed to connect to session using alias "[aliasname]"
...and the following in the Application Log file (accessible in the TopView Admin Tools application):
Certificate from "CN=[...]" has the following issue: BadCertificatePolicyCheckFailed 'SHA1 signed certificates are not trusted.'
Rejecting certificate from "CN=[...]"

Solutions

  1. In TopView's UA settings, you can switch to automatically accept server certificates for both the Configurator and Engine processes:
    1. To get to TopView's UA settings, go to the "Tags & Limits" page, click the "Gear" button next to the "Server" textbox (above and to the left of the "Add tags (tags search)..." button.
    2. Auto-accepting certificates is not a best practice security-wise, but if you only plan to connect to known servers and can trust that you will only be connecting to approved servers, this may be OK.
  2. Switch to an XML UA configuration file in which you include a line to not reject SHA1 Signed Certificates
    1. XML configuration information below

XML Configuration instructions

Add the SHA1 rejection tag within the security configuration element similar to the following:
  1.     <SecurityConfiguration>
  2.       <RejectSHA1SignedCertificates>false</RejectSHA1SignedCertificates>
  3.     </SecurityConfiguration>