Siemens SIMATIC ET 200AL, System Manual

Page: 1203 / 2255

Communications services
3.6 Secure Communication
Communication
82
Function Manual, 05/2021, A5E03735815-AJ
Handling certificates for CPs
The following applies in general: You have to be logged on at the certificate manager in the
global security settings. The generation of self-signed certificates also requires logon for the
global security settings. You have to have sufficient rights as a user (administrator or user
with the "Standard" role with the right to "Configure security").
The starting point for the generation or assignment of certificates at the CP is the section
"Security > Security properties". In this section, you log on for the global security settings.
Procedure:
1. In the network view of STEP 7, mark the CP and select the section "Security > Security
properties" in the Inspector window.
2. Click on the "User logon" button.
3. Log on using your user name and password.
4. Enable the "Activate security functions" option.
The security properties are initialized.
5. Click in the first line of the "Device certificates" table to generate a new certificate or select
an existing device certificate.
6. If the communication partner is also an S7-1500 station, you also have to assign a device
certificate to the communication partner with STEP 7 as described here or for the S7-1500
CPU.
Example: Setting up a secure TCP connection between two S7-1500 CPUs via CP interfaces
For secure TCP communication between two S7-1500 CPs you need to create a data block
with the TCON_IP_V4_SEC system data type yourself in every CPU, assign parameters and call
it directly at one of the instructions TSEND_C, TRCV_C or TCON.
Requirements:
•
Both S7 1500 CPUs have at least firmware version V2.0. If you use the CP 1543SP-1:
Firmware version as of V1.0.
• Both CPs (for example CP 1543-1) must have at least firmware version V2.0
• TLS client and TLS server have all the required certificates.
– A device certificate (end-entity certificate) for the CP must be generated and be located
in the certificate memory of the CP. If a communication partner is an external device
(for example an MES or ERP system), a device certificate also has to exist for this
device.
– The root certificate (CA certificate) with which the device certificate of the
communication partner is signed must also be located in the certificate memory of the
CP or in the certificate memory of the external device. If you use intermediate
certificates, you have to ensure that the complete certificate path exists in the
validating device. A device uses these certificates to validate the device certificate of
the communication partner.
• The communication partner must always be addressed via its IPv4 address, not via its
domain name.