Why the Certificate Chain Error Occurs
The message "The certificate chain is incomplete" indicates that Historian cannot validate the OPC UA server certificate because required trust material is missing or was copied into the wrong PKI folder. The issue is the certificate-store placement, not necessarily the certificate itself.
Required Certificate Store Mapping
Copy the complete certificate chain—root CA certificate, any intermediate CA certificates, and the leaf application-instance certificate—to the Historian client-side PKI store. Place the associated CRL in the client CRL folder.
| Certificate material | Required folder |
|---|---|
| Root CA certificate | CLIENT_PKI\CA\certs |
| Intermediate CA certificates, if present | CLIENT_PKI\CA\certs |
| Leaf application-instance certificate | CLIENT_PKI\CA\certs |
Certificate Revocation List (.crl) |
CLIENT_PKI\crl |
Do not place the root CA certificates in SERVER_PKI\CA\Certs for this client-side validation path; certificates stored there will not allow Historian to validate the server connection correctly.
Correction and Verification Procedure
- Copy the root CA certificate, every applicable intermediate CA certificate, and the leaf application-instance certificate into
CLIENT_PKI\CA\certs. - Move any CA certificates previously placed in
SERVER_PKI\CA\CertstoCLIENT_PKI\CA\certs. - Place the
.crlfile inCLIENT_PKI\crl. - Retry the connection from Historian to the OPC UA server and confirm that the certificate-chain error no longer appears.
FAQ
Why does OPC UA Historian say the certificate chain is incomplete?
Historian cannot validate the server certificate because the root CA, applicable intermediate CA, or leaf application-instance certificate is missing or stored in the wrong PKI folder.
Where do I copy the OPC UA certificate chain for Historian?
Copy the complete root, intermediate, and leaf application-instance chain to CLIENT_PKI\CA\certs, not SERVER_PKI\CA\Certs.
Where should the OPC UA CRL file be placed?
Place the certificate revocation list in CLIENT_PKI\crl, then retry the Historian connection.
