Details Of The Connection Authentication Function Of The Opc Ua Server; Application Authentication - Omron NJ501-1300 User Manual

5 Security Function of OPC UA Server
5-1 Details of the Connection Authentica-
tion Function of the OPC UA Server
This section describes the following two stages of connection functions in detail with regard to the con-
nection authentication function of the OPC UA Server.
Function

Application authentication

User authentication
5-1-1

Application Authentication

The OPC UA server and the OPC UA client authenticate each other's identity by exchanging mutual
digital certificates (hereinafter, called certificates). This is called Application authentication.
In application authentication, the certificates supported by the OPC UA server and the OPC UA client
are X.509-standard certificates.
The certificates supported by the OPC UA Server are of the following three types:
Certificate
Server certificate
Client certificate
CA certificate and Certificate
Revocation List
In the OPC UA Server, the following functions are enabled for each certificate:
Certificate
Server certificate
Client certificate
CA certificate and
Certificate Revocation
List
*1. This operation can be performed only by the Administrator in the operation authority verification settings of the
Sysmac Studio.
For details on each operation method from the Sysmac Studio, refer to 3-2-5 Setting and Displaying the
Certificate on page 3-9.
5 - 2
Description
Authentication of applications between the OPC UA server and OPC UA client
Authentication of the user that operates the client applications of the OPC UA
Description
This is a certificate for certifying an OPC UA server. In the case of an OPC UA
server, it is a self-signed certificate.
This is a certificate for certifying the OPC UA client.
Both self-signed client certificates and CA-signed client certificates can be used.
In the case of a CA-signed client certificate, this certificate is used to authenti-
cate the certificate chain.
Function
• Generation (automatic generation or manual regeneration
(self-signed certificate)
• Export of the server certificate from the CPU Unit
• Advance expiration notice of the server certificate, and notification of expiry
• Authentication of the client certificate during a connection
• Addition of the client certificate (transfer to the CPU Unit)
• Trust or reject setting of the client certificate
• Notification of expiry of client certificate
Used only in the case of a CA-signed client certificate.
For details, refer to A-3 When CA-signed Client Certificates Supported on page A-10.
*1
) of the server certificate
*1
*1
*1
*1
NJ-series CPU Unit OPC UA User's Manual (W588)