Siemens SIMATIC S7-1500 Function Manual page 150

Signing and encryption
To allow you to check whether a certificate has been manipulated, certificates are signed.
There are various possible procedures here:
● Within the TIA Portal you have the possibility to generate and sign certificates. If you have
protected your project and are logged in as a user with the function right to make security
settings, you can use the global security settings. The global security settings allow
access to the certificate manager and therefore to the certificate authority (CA) of the
TIA Portal.
● Additional options are available for creating and signing certificates. In the TIA Portal, you
can import certificates into the global certificate manager.
– You contact a certificate authority (CA) and have your certificate signed.
– You yourself create a certificate and sign it.
Useful information: Certificate types
● Self-signed certificate:
Each device generates and signs its own certificate. Application examples: Static
configuration with limited number of communication nodes.
No new certificates can be derived from a self-signed certificate. However, you need to
load all self-signed certificates from partner devices to the CPU (STOP required).
● CA certificate:
All certificates are generated and signed by a certificate authority. Application examples:
Dynamically growing plants.
You only need to download the certificate from the certificate authority to the CPU. The
certificate authority can generate new certificates (partner devices can be added without
CPU STOP).
Communication
Function Manual, 11/2019, A5E03735815-AH
In this case, the certificate authority checks your identity and signs your certificate with
the private key of the certificate authority. For this purpose you send a CSR
(Certificate Signing Request) to the certificate authority.
To this purpose you use, for example, the "Opc.Ua.CertificateGenerator" program of
the OPC Foundation. Alternatively, you use OpenSSL.
You can find additional information in Generating PKI key pairs and certificates
yourself (Page 153).
OPC UA communication
9.2 Security at OPC UA
149