1) The notification on the first image means that QuickOPC received a (self-signed) certificate from the server, and that this certificate is not trusted - because it is not in the "trusted peers" certificate store. If you want to permanently trust this certificate, you need to place that certificate into the "trusted peers" store. OPC applications usually have a UI or tool to do that, but QuickOPC does not, mainly beause it is not an application by itself, it is just a library.

Have look here: opclabs.doc-that.com/files/onlinedocs/QuickOpc/Latest/User%2...ecurity%20(Client-Server).html
and especially here: opclabs.doc-that.com/files/onlinedocs/QuickOpc/Latest/User%2...%20Instance%20Certificate.html
and here: opclabs.doc-that.com/files/onlinedocs/QuickOpc/Latest/User%2...html#Certificate%20Stores.html .

If the certificate has been rejected once (it was, that's what the notification says), it will be already in the "rejected certificate store" - for convenience. You can make it trusted by moving it to "trusted peers" certificate store either by simply moving the file, or by using UA Configuration tool (kb.opclabs.com/Tool_Downloads ).

2) To the second screenshot: For self-signed signed certificate, this is how they look like, it is perfectly normal and correct (they have no certification path - that's what it means that they are self-signed), and there is no way to make it go away.

Best regards

Hello,
can you connect (with security policy other than None) to the server with other OPC UA clients?

Can you send the same screenshot of the certificate you provided to Kepware to us? Either post it here, or (if it is confidential) email to support09 (at) opclabs.com.

The certificate validation is complex and we are just taking over the code from OPC Foundation (and the code is changing over the time), so I do not pretend to understand the details of it either.

But before we get to the details, I want to clarify what you are doing: Why do you want to use a certificate from a commercial CA? In my understanding, there is no reason to do that. It might even be wrong and insecure thing to do. Because, if you want to use that CA as your trust root, you would basically be saying that any certificate that that CA has issued to anybody is something you want to trust too ! That's insecure. You would have to persuade the CA to create a sub-CA just for you, and have that sub-CA issue the certificate, and then trust that sub-CA but not the actual commercial CA. But I do not think you have done that.

Or, you can use a certificate from a commercial CA without having that CA as your trust root, but instead configuring the UA applications to trust only individual, specific certificates. Doing so is possible, but turns the whole thing back into the scheme used with self-signed certificates, creating a need to manage the trusts on one by one basis, plus you would completely unnecessary go through the hassle and expenses related to a certificate from commercial CA.

So, why do that?

The "normal" OPC UA way of doing things is either with self-signed certificates, or with a CA that you control yourself.

Best regards