# HIVEMQ EDGE OPC-UA: Connection issue

**URL:** <https://community.hivemq.com/t/hivemq-edge-opc-ua-connection-issue/3312>\
**Category:** Uncategorized\
**Created:** [November 7, 2024, 11:25am UTC](https://community.hivemq.com/t/hivemq-edge-opc-ua-connection-issue/3312 "2024-11-07T11:25:42Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![PP\_GFMS](https://avatars.discourse-cdn.com/v4/letter/p/35a633/32.png) [@PP\_GFMS](https://community.hivemq.com/u/PP_GFMS)\
**Post date:** [November 7, 2024, 11:25am UTC](https://community.hivemq.com/t/hivemq-edge-opc-ua-connection-issue/3312/1 "2024-11-07T11:25:42Z")

</div>

HI All  
I’ve installed the hivemq-edge container and trying to us OPC-UA adapter. I’m getting error when I start up the adapter as following:

> 2024-11-07 09:53:23,842 INFO - Starting protocol-adapter ‘Sim172291685’.  
> 2024-11-07 09:53:23,888 WARN - Failed to initialize a channel. Closing: [id: 0xe5ca31a7]  
> org.eclipse.milo.opcua.stack.core.UaException: no KeyPair configured  
> …  
> …  
> 2024-11-07 09:53:23,892 ERROR - Not able to connect and subscribe to OPC-UA server opc.tcp://10.0.0.9:4840/XXXXX  
> java.util.concurrent.CompletionException: io.netty.channel.StacklessClosedChannelException  
> …  
> …  
> 2024-11-07 09:53:23,895 WARN - Protocol-adapter ‘Sim172291685’ could not be started, reason: io.netty.channel.StacklessClosedChannelException  
> java.util.concurrent.CompletionException: io.netty.channel.StacklessClosedChannelException  
> …

My conf file looks as following:

> 

```
    <opc-ua-client>
        <overrideUri>true</overrideUri>
        <subscriptions>
            <subscription>
                <publishing-interval>1000</publishing-interval>
                <qos>0</qos>
                <server-queue-size>1</server-queue-size>
                <node>ns=4;i=6131:UnitTime</node>
                <mqtt-topic>UnitTimeMQTT</mqtt-topic>
            </subscription>
        </subscriptions>
        <uri>opc.tcp://10.0.0.9:4840/XXXX</uri>
        <auth>
            <basic>
                <username>XXXX</username>
                <password>XXXX</password>
            </basic>
        </auth>
        <tls>
            <enabled>true</enabled>
            <keystore>
                <path>/home/digital/certstore/client-keystore.pem</path>
                <password></password>
                <private-key-password>XXXX</private-key-password>
            </keystore>
            <truststore>
                <path></path>
                <password></password>
            </truststore>
        </tls>
        <security>
            <policy>BASIC256SHA256</policy>
        </security>
        <id>Sim172291685</id>
    </opc-ua-client>
</protocol-adapters>

```

I’ve created self singed certificate, which are located in mentioned path. I also tried using not keystore info but that also doesn’t work.

I know that the OPCUA server is available and can be access with the credentials provided.

> I have no name!@a8968f9015e3:/opt/hivemq$ openssl s\_client -connect 10.0.0.9:4840  
> CONNECTED(00000003)

Any idea?

---

<div class="post-metadata">

**Author:** ![PP\_GFMS](https://avatars.discourse-cdn.com/v4/letter/p/35a633/32.png) [@PP\_GFMS](https://community.hivemq.com/u/PP_GFMS)\
**Post date:** [November 7, 2024, 5:22pm UTC](https://community.hivemq.com/t/hivemq-edge-opc-ua-connection-issue/3312/2 "2024-11-07T17:22:58Z")

</div>

Update-  
I’ve now created the .jsk for keystore. Now I’m getting a different error.

> 2024-11-07 17:04:44,821 ERROR - Not able to start OPC-UA client for server opc.tcp://10.0.0.9:4840/GFUnitServer  
> com.hivemq.edge.adapters.opcua.util.SslException: Not able to recover key from KeyStore, please check your private-key-password and your keyStorePassword

Following is my keytool verifcation output, which seems to be fine

> docker run --rm -v $(pwd):/mnt openjdk:11 keytool -list -keystore /mnt/client-keystore.jks -storepass “yourKeystorePassword” -keypass “yourKeyPassword”  
> Keystore type: JKS  
> Keystore provider: SUN  
> Your keystore contains 1 entry  
> clientkey, Nov 7, 2024, PrivateKeyEntry,  
> Certificate fingerprint (SHA-256): 11:DA:21:CD:59:84:D8:09:BB:58:58:E5:A8:1D:09:AC:B7:CC:4C:46:B3:BF:1A:32:81:78:FC:45:7E:AA:7F:B0  
> Warning:  
> The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using “keytool -importkeystore -srckeystore /mnt/client-keystore.jks -destkeystore /mnt/client-keystore.jks -deststoretype pkcs12”.

And here is my config.xml

> I have no name!@a8968f9015e3:/opt/hivemq$ ls  
> bin client-keystore.jks conf data extensions license log modules README.txt text.txt third-party-licenses

My conf file looks as following:

> 

```
    <uri>opc.tcp://10.0.0.9:4840/GFUnitServer</uri>
        <auth>
            <basic>
                <username>user</username>
                <password>password</password>
            </basic>
        </auth>
        <tls>
            <enabled>true</enabled>
            <keystore>
                <path>client-keystore.jks</path>
                <password>yourKeystorePassword</password>
                <private-key-password>yourKeyPassword</private-key-password>
            </keystore>
        </tls>

```

---

<div class="post-metadata">

**Author:** ![Diego](https://avatars.discourse-cdn.com/v4/letter/d/f04885/32.png) [@Diego](https://community.hivemq.com/u/Diego)\
**Post date:** [November 8, 2024, 10:27am UTC](https://community.hivemq.com/t/hivemq-edge-opc-ua-connection-issue/3312/3 "2024-11-08T10:27:58Z")

</div>

Hello @PP_GFMS

Welcome to the HiveMQ Community! To get started, could you let us know what type of OPC-UA server implementation you’re using?

Additionally, could you provide a screenshot of the OPC-UA server’s endpoint configuration and share the commands you’re using to create the client keystore? This information will help us better assist you.

Kind regards,  
Diego from HiveMQ Team

---

<div class="post-metadata">

**Author:** ![PP\_GFMS](https://avatars.discourse-cdn.com/v4/letter/p/35a633/32.png) [@PP\_GFMS](https://community.hivemq.com/u/PP_GFMS)\
**Post date:** [November 13, 2024, 12:58pm UTC](https://community.hivemq.com/t/hivemq-edge-opc-ua-connection-issue/3312/4 "2024-11-13T12:58:10Z")

</div>

You can see the server properties below:

 ![OPCUAServer](https://canada1.discourse-cdn.com/flex035/uploads/hivemq1/original/2X/a/a93a25a6ff5bc324448873d9adfdc70134cfdccc.png)

Please note when I connect using the UA expert I’ve to ignore certificate errror

 ![OPCUAServerLogs](https://canada1.discourse-cdn.com/flex035/uploads/hivemq1/original/2X/2/2753e714fdfe07873f1526b078d6fda543e6002f.png)

following is how I create the certificate, I suspect this is the faulty part.

> docker run --rm -v $(pwd):/mnt openjdk:11 keytool -genkey   
> -keyalg RSA   
> -alias hivemq   
> -keystore hivemq.jks   
> -storepass yourKeyPassword   
> -validity 360   
> -keysize 2048   
> -dname “[CN=example.com](http://CN=example.com), OU=IT, O=ExampleCorp, L=City, ST=State, C=US”   
> -v

The current error I’m getting is

> 2024-11-13 12:56:17,584 ERROR - Not able to start OPC-UA client for server opc.tcp://10.0.0.9:4840/GFUnitServer  
> com.hivemq.edge.adapters.opcua.util.SslException: Not able to recover key from KeyStore, please check your private-key-password and your keyStorePassword

---

<div class="post-metadata">

**Author:** ![Daria\_H](https://avatars.discourse-cdn.com/v4/letter/d/dfb087/32.png) [@Daria\_H](https://community.hivemq.com/u/Daria_H)\
**Post date:** [February 19, 2025, 11:08am UTC](https://community.hivemq.com/t/hivemq-edge-opc-ua-connection-issue/3312/5 "2025-02-19T11:08:37Z")

</div>

Hi @PP_GFMS

The error **“Not able to recover key from KeyStore”** suggests that the provided `private-key-password` or `keystore password` is incorrect or not set correctly.

Try listing the keystore contents again using:

```bash
docker run --rm -v $(pwd):/mnt openjdk:21 keytool -list -keystore /mnt/hivemq.jks -storepass yourKeystorePassword

```

Make sure the keystore contains a **PrivateKeyEntry** , not just a trusted certificate.

If the private key is missing, you might need to re-generate the keystore correctly.

Your key generation command lacks the `-keypass` argument, which might be causing issues. Try creating the keystore properly:

```bash
docker run --rm -v $(pwd):/mnt openjdk:21 keytool -genkeypair \
-alias hivemq \
-keyalg RSA \
-keysize 2048 \
-validity 360 \
-keystore /mnt/hivemq.jks \
-storepass yourKeystorePassword \
-keypass yourKeyPassword \
-dname "CN=example.com, OU=IT, O=ExampleCorp, L=City, ST=State, C=US"

```

After generating the keystore, extract the certificate:

```sh
docker run --rm -v $(pwd):/mnt openjdk:21 keytool -export -alias hivemq -keystore /mnt/hivemq.jks -storepass yourKeystorePassword -file /mnt/hivemq.crt

```

And import it into the truststore:

```sh
docker run --rm -v $(pwd):/mnt openjdk:21 keytool -import -trustcacerts -alias hivemq -file /mnt/hivemq.crt -keystore /mnt/truststore.jks -storepass yourKeystorePassword -noprompt

```

Make sure your `config.xml` reflects the correct settings:

```XML
<tls>
    <enabled>true</enabled>
    <keystore>
        <path>/opt/hivemq/hivemq.jks</path>
        <password>yourKeystorePassword</password>
        <private-key-password>yourKeyPassword</private-key-password>
    </keystore>
    <truststore>
        <path>/opt/hivemq/truststore.jks</path>
        <password>yourKeystorePassword</password>
    </truststore>
</tls>

```

Try running:

```sh
docker run --rm -v $(pwd):/mnt openjdk:21 keytool -list -keystore /mnt/hivemq.jks -storepass yourKeystorePassword -v

```

This should confirm if your keystore contains the correct key and certificate.

If errors persist, check your OPC-UA server logs to see if there are any TLS-related issues.

I hope this helps.  
Best,  
Dasha from The HiveMQ Team