112 (148)
Certificate generation
The above mentions application instance certificates can be generated with OpenSSL. The
following description assumes you have basic knowledge of certificate generation. First add a
new section to your OpenSSL configuration file (
openssl.cfg
). The name of this section can be
chosen freely. Here we name this section
opcua_app_inst_ext
. It should have the following
content:
[opcua_app_inst_ext]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyCertSign
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = IP:<IP ADDRESS>, URI:<APPLICATION URI>
#subjectAltName = DNS:<DNS NAME>, URI:<APPLICATION URI>
subjectKeyIdentifier = hash
authorityKeyIdentifier = issuer
The
subjectAltName
entry must be adapted. In the example it exists twice. The second one is
commented out. The first entry is needed if your device is only accessible through its IP address.
Replace
<IP ADDRESS>
with the IP address and
<APPLICATION URI>
with the application URI. If
your device is accessible through a DNS name, you should use the second entry. Comment the
first entry out and the second entry in. Replace
<DNS NAME>
with the DNS name
and
<APPLICATION URI>
with the application URI. Please refer to the OpenSSL documentation if
your device is accessible through more than one IP address or DNS name.
The following command generates a self-signed certificate for the
SecurityPolicy -
Basic256Sha256
with a validity of 365 days and an RSA key length of 4096 bits. The validity
(
-days
) can be arbitrarily adapted. The key length (
rsa:4096
) can optionally be reduced to 2048
bits minimum.
openssl req -x509 -newkey rsa:4096 -sha256 -nodes -days 365 -outform DER \
-out cert.der -keyout key.pem -extensions opcua_app_inst_ext
To generate a certificate signing request (CSR) instead of a sef-signed certificate, replace the
-
x509
parameter with
-new
.
openssl req -new -newkey rsa:4096 -sha256 -nodes -days 365 -outform DER \
-out cert.der -keyout key.pem -extensions opcua_app_inst_ext
For the
SecurityPolicy - Basic128Rsa15
the RSA key length is reduced to 1024 to 2048 bits and
the hashing algorithm SHA-1 is used. Please note that this algorithm is not considered secure
anymore.
openssl req -x509 -newkey rsa:2048 -sha1 -nodes -days 365 -outform DER \
-out cert.der -keyout key.pem -extensions opcua_app_inst_ext
openssl req -new -newkey rsa:2048 -sha1 -nodes -days 365 -outform DER \
-out cert.der -keyout key.pem -extensions opcua_app_inst_ext
Event Log Messages
The following section describes the messages that the OPC UA Server driver may log to the Event
Log. All messages are prefixed with the text
OPC UA server driver:
.
•
The interval is being maintained again.
This message appears after this message, when the interval is being maintained again.
•
The interval has been violated.
The driver was still busy reading/writing values when a new cycle should be started. You
should probably increase the interval time.
Anybus Edge Gateway Reference Guide
SCM-1202-154 1.0 en-US
