Siemens SIMATIC ET 200AL, System Manual

Page: 1217 / 2255

Communications services
3.6 Secure Communication
Communication
96
Function Manual, 05/2021, A5E03735815-AJ
Store CA certificate in the TIA Portal
To make the exported certificate known to a PG with TIA Portal and thus enable automatic
certificate checking, follow these steps:
1.
Copy the CA certificate exported in the previous step to the following directory:
C:\ProgramData\Siemens\Automation\Certstore\Trusted
2. Start TIA Portal.
In the "Info" tab of the Inspector window, a message appears for each CA certificate which
provides information on whether the CA certificate could be successfully transferred to
the CA store of TIA Portal.
However, no detailed causes are output in case of failure.
Adding device certificates to the TIA Portal certificate revocation list (CRL)
You have the option to add individual device certificates to a certificate revocation list (CRL),
for example, because the associated key is no longer considered secure.
When the TIA Portal establishes a connection to a CPU whose device certificate is in the
certificate revocation list, a dialog appears in the TIA Portal asking whether you still want to
trust the certificate. If you decline, the connection will not be established.
To add a device certificate to the certificate revocation list, follow these steps:
1.
Copy the device certificate to the following directory:
C:\ProgramData\Siemens\Automation\Certstore\CRL
2. Start TIA Portal.
In the "Info" tab of the Inspector window, a message appears for each certificate which
provides information about whether the certificate could be successfully transferred to the
CRL store of TIA Portal.
However, no detailed causes are output in case of failure.
See also
Examples for the management of certificates. (Page 52)
3.6.4.4 CPU behavior from loading to operational readiness
To ensure that communication between the CPU and a programming device or HMI device is
secure, it must first have a certificate. However, the certificate for productive operation is
only issued when the project is loaded into the CPU.
To ensure that the initial loading is also secured, the CPU first creates a self-signed certificate.
The following description explains the different phases of establishing a connection.