Siemens SIMATIC ET 200AL, System Manual

Page: 1177 / 2255

Communications services
3.6 Secure Communication
Communication
56
Function Manual, 05/2021, A5E03735815-AJ
3. Right-click the selected certificate to open the shortcut menu.
4. Click "Export".
5. Select the export format of the certificate.
In the next step you have to create the user programs for the data exchange and load the
configurations together with the program.
Secure Open User Communication between an S7-1500 CPU as TLS server and an external device
as TLS client
If the S7-1500 CPU acts as TLS server and the external device, for example an ERP system
(Enterprise Resource Planning System) establishes the TLS connection / session, you require
the following certificates:
•
For the S7-1500 CPU, you generate a device certificate (server certificate) with a private
key and download it with the hardware configuration into the S7-1500 CPU. You use the
"Signed by certificate authority" option when generating the server certificate.
The private key is required for the key exchange as explained in the figure for the example
"HTTP over TLS".
• You have to export the CA certificate of the STEP 7 project for the ERP system and import /
load it into the ERP system. With the CA certificate the ERP system verifies the server
certificate of the S7-1500 that was transferred from the CPU to the ERP system during the
establishment of the TLS connection / session.
① TLS server
② TLS client
Figure 3-12 Secure OUC between an S7-1500 CPU and ERP system
The required steps are described in the preceding sections.