OPC UA Worked Yesterday but Fails Today? Check Certificates and the Clock
An OPC UA connection can stop after a certificate renewal, hostname change, restore, or clock error even when the network is reachable. Read the exact security status before recreating the connection. Turning off validation can hide the cause and undermine the intended trust relationship.
OPC UA application-certificate troubleshooting; product interfaces and policy controls vary.
What is happening?
OPC UA application authentication uses certificates and associated validation checks. Validity periods, trust, application identity, and endpoint details can affect acceptance. A machine with an incorrect clock may evaluate an otherwise appropriate certificate as not yet valid or expired.
Check these five things
-
Capture the exact client and server error codes and the time of the first failure. Check both sides because they may reject different certificates.
-
Compare system time, time zone presentation, and time synchronization health on the participating hosts.
-
Inspect the presented certificate's validity period, identity, and chain against the approved endpoint configuration.
-
Review trust-list changes and certificate renewals with the system owner. Trust only a verified certificate through the authorized process.
-
Retest the intended security policy and user authentication after the underlying certificate or clock issue is corrected.
Worked example
A restored virtual machine has an old system date. Its client rejects a recently issued server certificate as not yet valid. The useful correction is restoring approved time synchronization and verifying trust, not allowing every certificate.
Quick diagnostic reference
| Recent change | Check first |
|---|---|
| Certificate renewal | New certificate and trust chain |
| Hostname change | Endpoint identity match |
| VM restore or battery fault | System time and synchronization |
The mistake to avoid
A generic connection-failed dialog is not enough evidence to replace certificates. Collect the detailed status so you do not erase a working trust configuration unnecessarily.
How to verify the fix
Confirm secure reconnection after a controlled restart and record the certificate renewal owner and expiry-monitoring process.
Field-work boundary: These are educational diagnostic guides. Use the exact equipment manuals and approved site procedures. Electrical testing and machinery changes belong to qualified, authorized personnel; control hazardous energy and validate affected functions before release.
Technical reference
OPC Foundation: OPC UA security and certificate validation. The examples and diagnostic tables above are original teaching material; they do not replace the product manual.