Public Key Infrastructure
226/258
16.3.3
Use case 3: Client certificates for specific servers
The Edge Gateway (client) is able to authenticate itself to a specific server.
For this, you can store client certificates in the Edge Gateway. This use
case extends use case 1 (The Edge Gateway uses server certificates, to
identify a server and to encrypt messages). In case, you want to ensure
that the server identifies the Edge Gateway, the Edge Gateway has to send
his client certificate to the server.
From the point of view of the Edge Server, the client certificates relate to
outbound HTTPS and OPC UA connections.
For
each
server the Edge Gateway should send an certificyte for
authentication, you have to upload a pair of files (private key
xyz_key.pem
and certificate
xyz_cert.pem
). The prefix (here
xyz_
) has
to be identical for each file pair (you can freely choose the prefix).
You can upload and use client certificates in the Edge Gateway for Node-
RED only.
Note:
The certificate (containing the public key) and the private key are
stored in two separated files and uploaded individually into the Edge
Gateway. You as the user are solely responsible that the file with
the certificate and the file with the private key fit together, which you
have uploaded into the Edge gateway.. for logical connection
between certificate and private key, i.e. that the public key
contained in thespecified certificate fits to the specified private key.
Node-RED
You can upload several pairs of files (one pair for one server) in order to
use the client certificate functionality. Use the same prefix for one pair of
files. For each server, a separate pair of files is necessary.
For a Node-RED node, you need to use a path to the certification file as
well as to the private key file:
·
Mark the entry
xyz_cert.pem
and then click
Copy path
. Use the
copied path in the Node-RED node for the path to the certificate.
·
Mark the entry
xyz_key.pem
and then click
Copy path
. Use the
copied path in the Node-RED node for the path to the private key.
OPC UA Client in Node-RED
The Edge Gateway is able to communicate with exactly one OPC UA
Server using the authentication based-on client certificates. The file names
are
·
Certificate file
node-opcuaclient_cert.pem
and
·
File with the private key
node-opcuaclient_key.pem
Edge Gateway | NIOT-E-TPI51-EN-RE (Connect)
DOC170502UM04EN | Revision 4 | English | 2018-08 | Released | Public
© Hilscher 2017 – 2018
