OPC UA communication
9.2 Security at OPC UA
Communication
Function Manual, 12/2017, A5E03735815-AF
147
An X.509 certificate includes the following information:
● Version number of the certificate
● Serial number of the certificate
● Information on the algorithm used by the certificate authority to sign the certificate.
● Name of the certificate authority
● Start and end of the validity period of the certificate
● Name of the program, person or organization for which/whom the certificate has been
signed by the certificate authority.
● The public key of the program, person or organization.
An X509 certificate thus links an identity (name of a program, person or an organization) to
the public key of the program, person or organization.
Check during connection establishment
When a connection is established between the client and server, the devices check all
information from the certificate that is required to establish integrity, for example signature,
validity, application name (URN).
To allow you to check whether a certificate has been manipulated, certificates are signed.
There are various possible procedures here
● You contact a certificate authority (CA) and have your certificate signed.
In this case, the certificate authority checks your identity and signs your certificate with
the private key of the certificate authority. To this purpose you send a CSR (Certificate
Signing Request) to the certificate authority. The process of creating a CSSR with the
OpenSSL tool yourself is described here. (Page 150)
● You yourself create a certificate and sign it.
To this purpose you use, for example, the "Opc.Ua.CertificateGenerator" program of the
OPC Foundation. The procedure is described here (Page 36). Or use OpenSSL:
Instructions are available under Generating PKI key pairs and certificates yourself
(Page 151).
● The easiest option: Both options are available in the TIA Portal. The TIA Portal can
generate and sign certificates. If you have protected your project and are logged in as a
user with the function right to make security settings, you can use the global security
settings. The global security settings allow access to the certificate manager and
therefore to the certificate authority (CA) of the TIA Portal.
To Next Page
Loading...
