Siemens SIMATIC ET 200AL, System Manual

Page: 1168 / 2255

Communications services
3.6 Secure Communication
Communication
Function Manual, 05/2021, A5E03735815-AJ
47
Features of self-signed certificates
The "CN" (Common Name of Subject) for the certificate subject and "Issuer" attributes of self-
signed certificates are identical: You have signed your certificate yourself. The field "CA"
(Certificate Autority) must be set to "False"; the self-signed certificate should not be used to
sign other certificates.
Self-signed certificates are not embedded in a PKI hierarchy.
Certificate content
A certificate to the X.509 V3 standard, the standard that is also used by STEP 7 and the
S7-1500 CPUs, consists primarily of the following elements:
•
Public key
• Details of the certificate subject (i.e. the holder of the key), for example, the Common
Name (CN) of Subject .
• Attributes such as serial number and validity period
• Digital signature from the certificate authority (CA) confirming that the information is
correct.
There are also extensions, for example:
•
Specification of what the public key may be used for (Key Usage), for example, signing or
key encryption.
When you create a new certificate with STEP 7, for example in the context of Secure Open
User Communication, select the correct entry from the list of possible usages, e.g. "TLS".
• Specification of a Subject Alternative Name (SAN), which is used in secure communication
with Web servers (HTTP over TLS), for example, to ensure that the certificate in the
address bar of the Web browser also belongs to the Web server specified in the URL.
How signatures are generated and verified
Asymmetric key usage ensures that certificates can be verified: The example of the "MyCert"
certificate illustrates the "Sign" and "Verify signature" processes.
Generating a signature:
1.
The issuer of the "MyCert" certificate generates a hash value from the certificate data using a
specific hash function (for example SHA-1, Secure Hash Algorithm).
The hash value is a bit string of a constant length. The advantage of the constant length of
the hash value is that it always takes the same amount of time to sign.
2. Using the hash value generated in this way and the private key, the issuer of the certificate
then generates a digital signature. The RSA signature scheme is often used.
3. The digital signature is saved in the certificate. The certificate is now signed.
Verifying a signature:
1.
The authenticator of the "MyCert" certificate obtains the certificate of the issuer and thus the
public key.
2. A new hash value is formed from the certificate data with the same hash algorithm that was
used for signing (for example SHA-1).