Communications services
3.6 Secure Communication
Communication
Function Manual, 11/2019, A5E03735815-AH
41
Features of self-signed certificates
The "CN" (Common Name of Subject) for the certificate subject and "Issuer" attributes of
self-signed certificates are identical: You have signed your certificate yourself. The field "CA"
(Certificate Autority) must be set to "False"; the self-signed certificate should not be used to
sign other certificates.
Self-signed certificates are not embedded in a PKI hierarchy.
Certificate content
A certificate to the X.509 V3 standard, the standard that is also used by STEP 7 and the
S7-1500 CPUs, consists primarily of the following elements:
●
Public key
●
Details of the certificate subject (i.e. the holder of the key), for example, the Common
Name (CN) of Subject .
●
Attributes such as serial number and validity period
●
Digital signature from the certificate authority (CA) confirming that the information is
correct.
There are also extensions, for example:
●
Specification of what the public key may be used for (Key Usage), for example, signing or
key encryption.
When you create a new certificate with STEP 7, for example in the context of Secure
Open User Communication, select the correct entry from the list of possible usages, e.g.
"TLS".
●
Specification of a Subject Alternative Name (SAN), which is used in secure
communication with Web servers (HTTP over TLS), for example, to ensure that the
certificate in the address bar of the Web browser also belongs to the Web server
specified in the URL.
How signatures are generated and verified
Asymmetric key usage ensures that certificates can be verified: The example of the "MyCert"
certificate illustrates the "Sign" and "Verify signature" processes.
Generating a signature:
1.
The issuer of the "MyCert" certificate generates a hash value from the certificate data
using a specific hash function (for example SHA-1, Secure Hash Algorithm).
The hash value is a bit string of a constant length. The advantage of the constant length
of the hash value is that it always takes the same amount of time to sign.
2.
Using the hash value generated in this way and the private key, the issuer of the
certificate then generates a digital signature. The RSA signature scheme is often used.
3.
The digital signature is saved in the certificate. The certificate is now signed.
Summary of Contents for SIMATIC ET 200SP
Page 1: ...Communication ...
