ABB EDS500 Series Function Manual page 113

Functions
Self-signed
cerficate
Figure 34: Key and certificate combination
EC key
The first decision is if the preinstalled key on the device or an external key shall be used. This
decision usually depends on the guidelines of the companies. The key pre-installed in the
device complies with ABB's minimum cyber security requirements. According to this, the key
is unique and the private part is not read out. However, some companies need to use their
own keys and this is supported by the EDS500 managed switches. How to upload keys to the
device is described in the next chapter.
At this point it should be mentioned that the key, especially the private part, must never be
transmitted over an insecure connection. This should also be avoided over supposedly secure
connections.
Private keys must be protected against access by third parties under all circumstances.
The device EC key is not deleted when using an external EC key. It remains in the device, but is
inactive.
Certificate
Certificates can be generated in the device based on the current EC Key. As soon as the device
has a valid EC key (external or device), it automatically generates a valid certificate (self-
signed). This certificate can be downloaded and added to the used browser.
1KGT151021 V000 1
EC Key?
external
Cerficate?
CSR generated, External generated,
CA-signed CA-signed
cerficate cerficate
Valid combinaon of EC key and cerficate
device
Cerficate?
CSR generated,
CA-signed
cerficate
A D V I C E
Certificate Management
Self-signed
cerficate
113