Configuring with the WBM
6.3 The menu items of the WBM
SIMATIC RF360R
Configuration Manual, 03/2022, C79000-G8976-C629-02
55
Security settings
In the "Security settings" area, you can make security settings for the OPC UA interface.
Table 6- 16 Description of the security parameters
Parameter
Description
Security profiles
Specification of the security profile and the access options for the UA server of
the communications module.
•
No security
•
Basic 256 / SHA256 - Sign
•
Basic 256 / SHA256 - Sign & Encrypt
•
AES128 / Sha256 RSA OAEP - Sign
•
AES128 / SHA256 RSA OAEP - Sign & Encrypt
•
AES128 / SHA256 RSA PSS - Sign
•
AES128 / SHA256 RSA PSS - Sign & Encrypt
"No security" corresponds to the security profile "None". This profile does not
offer any security mechanisms (encryptions).
If a "Sign" profile is selected, the communications module only allows
communication with signed frames using the respective hash algorithm. If a
"Sign & Encrypt" profile is selected, the communications module only allows
communication with signed and encrypted frames using the respective hash
algorithm.
The profiles are arranged in order of the security levels. It is recommended that
you use the highest security level (AES128 / SHA256 RSA PSS).
Certificate verification
Validate certificates If the check box is selected, the reader generally checks the certificate of the
communications partner. If the partner certificate is invalid or not trustworthy,
communication is aborted.
Accept
expired
certificates
The reader generally checks the period of validity of the communication
partner certificate. When the check box is selected, certificates are accepted
and communication is set up even if the current internal reader time is outside
the period of validity of the partner certificate.
No strict
validation
If the check box is selected, the reader also allows communication in the
following situations:
•
If the IP address of the communication partner is not identical to the IP
address in its certificate.
Note: The OPC UA server does not check the IP address of its
communications partner (client).
•
If no blacklist is stored on the reader module for the CA of the partner
certificate.
Regardless of these exceptions, to establish a connection at least the following
requirements must be met:
•
If the partner certificate is not trustworthy, the reader must at least have
stored a self-signed certificate of the partner.
•
If the partner certificate was issued by several CAs (Certification
Authorities), all CA root certificates must be stored in the certificate store of
the reader.
