Handling Certificates - Siemens SIMATIC S7-400 Operating Instructions Manual

4.7.10

Handling certificates

Certificate for authentication
If you have configured secure OPC UA communication with authentication for the CP in the
"Security" tab, own certificates and certificates of the communications partner will be
required for communication to take place.
All nodes of a STEP 7 project with enabled security functions are supplied with certificates.
The Security Configuration Tool (SCT) is the certification authority of the STEP 7 project.
For the server and client application of the CP a common certificate is created. It is displayed
in the SCT as "OPC UA client / server certificate of the module <CP name>". You see the
use of the certificate when you display the certificate in the SCT and select "Enhanced key
usage" in the "Details" tab of the certificate dialog.
If the CP communicates with non-Siemens partners when the security functions are enabled,
the relevant certificates must be exchanged. You do this with the SCT.
Opening SCT
Open the SCT in one of the following alternative ways:
● From the Windows Start menu: Siemens Automation > SIMATIC > Security > Security
Configuration Tool
● From STEP 7 / HW Config "Edit > Security Configuration Tool".
Open the certificate manager in the SCT with the menu "Options > Certificate manager".
Importing certificates of communications partners into STEP 7 / SCT
Import the certificates of the communications partners from third-party vendors using the
certificate manager of the SCT. Follow the steps outlined below:
1. Save the certificate in the file system of the connected PG/PC.
2. Open the SCT as described above.
3. Open the certificate manager of the SCT with "options" >"Certificate mananger".
4. Import the certificate from the file system of the PC with "Import".
Exporting certificates for communications partners from SCT
You export the certificate of an S7 module for communications partners from third-party
vendors using the certificate manager of the SCT. Follow the steps outlined below:
1. Open the certificate manager of the SCT with "options" >"Certificate mananger".
2. Export the certificate into the file system of the PC with "Export".
3. Transfer the certificate to the system of the third-part vendor.
If you use a logging server in your system, export the SSL certificate for the authentication of
the CP from the SCT.
CP 443-1 OPC UA
Operating Instructions, 01/2017, C79000-G8976-C427-02
Configuration and operation
4.7 Configuration of the CP in STEP 7 V5
59