Siemens SIMATIC ET 200AL, System Manual

Page: 1295 / 2255

OPC UA communication
9.2 Security at OPC UA
Communication
174
Function Manual, 05/2021, A5E03735815-AJ
X.509 certificates
An X.509 certificate includes the following information:
•
Version number of the certificate
• Serial number of the certificate
• Information on the algorithm used by the certificate authority to sign the certificate.
• Name of the certificate authority
• Start and end of the validity period of the certificate
• Name of the program, person or organization for which/whom the certificate has been
signed by the certificate authority.
• The public key of the program, person or organization.
An X509 certificate thus links an identity (name of a program, person or an organization) to
the public key of the program, person or organization.
Check during connection establishment
When a connection is being established between the client and server, the devices check all
information from the certificate that is required to determine its integrity, such as signature,
period of validity, application name (URN) and, in case of firmware version V2.5 only, also the
IP address of the client in the client certificate.
Note
The validity period stored in the certificate is also checked. The CPU clock must therefore be
set and date/time must be within the validity period, otherwise no communication takes
place.
Signing and encryption
To allow you to check whether a certificate has been manipulated, certificates are signed.
There are various possible procedures here
:
• Within the TIA Portal you have the possibility to generate and sign certificates. If you have
protected your project and are logged in as a user with the function right to make security
settings, you can use the global security settings. The global security settings allow access
to the certificate manager and therefore to the certificate authority (CA) of the TIA Portal.
• Additional options are available for creating and signing certificates. In the TIA Portal, you
can import certificates into the global certificate manager.
– You contact a certificate authority (CA) and have your certificate signed.
In this case, the certificate authority checks your identity and signs your certificate with
the private key of the certificate authority. For this purpose you send a CSR (Certificate
Signing Request) to the certificate authority.
– You yourself create a certificate and sign it.
To this purpose you use, for example, the "Opc.Ua.CertificateGenerator" program of
the OPC Foundation. Alternatively, you use OpenSSL.
You can find additional information in Generating PKI key pairs and certificates yourself
(Page 179).