Examples For The Management Of Certificates - Siemens SIMATIC ET 200AL System Manual

Communications services
3.6 Secure Communication
Private keys
STEP 7 generates private keys while generating device certificates and server certificates
(end-entity certificates). The location where the private key is stored encrypted depends on
the use of the global security settings for the certificate manager:
• If you use global security settings, the private key is stored encrypted in the global
(project-wide) certificate memory.
• If you do not use global security settings, the private key is stored encrypted in the local
(CPU-specific) certificate memory.
The existence of the private key, which is required to decrypt data, for example, is displayed
in the "Private key" column of the "Device certificates" tab of the certificate manager in the
global security settings.
When the hardware configuration is loaded, the device certificate, the public key as well as
the private key are loaded into the CPU.
NOTICE
Enabling the "Use global security settings for certificate manager" option -
Consequences
The "Use global security settings for certificate manager" option influences the previously
used private key: If you have already created certificates without using the certificate
manager in the global security settings and then change the option for using the certificate
manager, the private keys are lost and the certificate ID can change. A warning draws your
attention to this fact. Therefore specify at the beginning of the project configuration which
option is required for the certificate manager.
3.6.1.5

Examples for the management of certificates.

As explained in the preceding sections, certificates are required for every type of secure
communication. The following section shows as an example how you handle the certificates
with STEP 7 so that the requirements for Secure Open User Communication are fulfilled.
The devices which are involved at the respective communication partners are differentiated
below. The respective steps for supplying the required certificates to the communications
participants are described. An S7-1500 CPU or an S7-1500 software controller as of firmware
version 2.0 is always required.
The general rule is:
While a secure connection is being established (handshake"), the communication partners as
a rule only communicate their end-entity certificates (device certificates).
52
Function Manual, 05/2021, A5E03735815-AJ
Communication