Siemens SIMATIC S7-1500 Function Manual page 275

OPC UA communication
9.4 Using the S7-1500 CPU as an OPC UA client
2. Announcing the client certificate to the server
You have to make the client certificate available to the server to allow a secure connection to
be established.
To do this, follow these steps:
1. If the client was configured in another project and you created and exported the client
certificate there:
– Select the "Use global security settings for certificate manager" option in the local
– If the project is not yet protected, select "Security settings > Settings" in the STEP 7
– Double click "Global security settings".
– Double click "Certificate manager".
– Click the "Device certificates" tab.
– Right-click in the tab on a free area (not on a certificate).
– Select the "Import" shortcut menu.
– Select the client certificate that the server is to trust.
– Click "Open" to import the certificate.
2. Click the "General" tab in the properties of the CPU that is acting as server.
3. Click "OPC UA > Server > Security > Secure Channel".
4. Scroll down in the "Secure Channel" dialog to the section "Trusted clients".
5. Double-click in the table on the empty row with "<add new>". A browse button is
displayed in the row.
6. Click this button.
7. Select the prepared client certificate.
8. Click the button with the green check mark.
9. Compile the project.
10. Load the configuration onto the S7-1500 CPU (server).
Result
The server now trusts the client. If the server certificate is also considered trusted, the server
and client can establish a secure connection.
274
certificate manager of the server. This makes the global certificate manager available.
You will find this option under "Protection & Security > Certificate manager" in the
properties of the CPU that is acting as server.
project tree, click the "Protect this project" button and log on.
The "Global security settings" item is now displayed under "Security settings" in the
STEP 7 project tree.
STEP 7 opens the global certificate manager.
The dialog for importing certificates is displayed.
The certificate of the client is now contained in the global certificate manager. Note the
ID of the client certificate just imported.
Function Manual, 11/2019, A5E03735815-AH
Communication