Siemens SIMATIC ET 200AL, System Manual

Page: 1315 / 2255

OPC UA communication
9.2 Security at OPC UA
Communication
194
Function Manual, 05/2021, A5E03735815-AJ
Create certificate with internally created key pair
The procedure is similar to the method explained in the previous section; the only difference
is that a key pair is generated in addition to the CSR. You specify in the parameter of the
"CreateSigningRequest" method that it is to generate a key pair.
The private key does not leave the CPU in this procedure either.
The generation of a new key pair creates a very heavy load on the CPU. The CPU processes
this request over a longer period of time with lower priority in the reserved area for the
communication load. The duration of this time period depends on the performance of the
CPU.
Because the share of the set communication load is fully utilized during key generation over a
longer period of time, set the "Scan cycle load due to communication" share so that the
maximum cycle time is not exceeded and sufficient reserves are available. For this, use the
web server page "Diagnostics > Runtime information" of the CPU. This page shows
information about the current program/communication load and cycle time of your user
program. Via a controller, you can get help on the effects of a changed communication load
on the cycle time.
Create certificate with externally created key pair
The certificate is generated with the help of tools, for example, that can generate additional
keys.
Certificate and keys are transferred to the CPU using the "UpdateCertificate" method.
Due to low security, this procedure is not recommended.
NOTICE
Different keys for different target systems
Always use newly generated keys for a production system. If you simulate and test your
project, e.g. with PLCSIM Advanced on your PC, do not under any circumstances use the
keys used for the simulation also for a productive system.
Restrict the access to PC-based controllers by setting up appropriate permissions.
9.2.7.5 Address model for the push certificate management
The OPC UA specification Part 12 (OPC 10000-12: Discovery, Global Services) defines
methods and attributes for OPC UA servers, for example, that enable GDS or OPC UA clients
to update certificates and trust lists on the server ("Push certificate management"). These
methods and attributes are also included in the address model of the OPC UA server.
The relevant section in the address model of the OPC UA server of the S7-1500 CPU is
explained below.