BadSecurityChecksFailed (0x80130000) — An error occurred verifying security

The security layer rejected the peer. The code is deliberately vague — it covers certificate, signature, and policy problems without telling an attacker which one failed.

Start free OPC UA → canonical

Diagnosis

When you hit this

The client certificate is not in the server's trusted list. This is the usual cause and needs a human to approve it on the server.
Application URI in the certificate does not match the ApplicationUri in the client's description. They must match exactly.
Clock skew between client and server large enough to put the certificate outside its validity window.

Resolution

How to fix it

Move the certificate into the trusted store
Connect once so the server files your certificate as rejected, then move it to trusted on the server and reconnect.
Make the URIs match
The certificate's SubjectAltName URI and the client's ApplicationUri must be identical strings. A trailing slash difference is enough to fail.
Check the clock
Both ends need roughly correct time. A PLC that lost its RTC battery will reject every certificate as not-yet-valid.

Normalization

What Forge does about it

This is a configuration or addressing mistake on the wire, upstream of anything Forge sees. Where Forge helps is the step after you fix it: once the point returns data, its vendor tag name maps to a canonical field automatically, so you do not also have to hand-maintain a name table for every point you just re-addressed.