Siemens SIMATIC S7-1500 Function Manual page 52

Optionally the MES system can also request a device certificate of the CPU to authenticate
the CPU (i.e., the TLS client). In this case, the CA certificates of the CPU must be made
available to the MES system. The prerequisite for importing the certificates into the MES
system is a preceding export of the CA certificates from the STEP 7 project of the CPU.
Follow these steps:
1. Open the certificate manager in the global security settings in the project tree.
2. Select the matching table (CA certificate) for the certificate to be exported.
3. Right-click the selected certificate to open the shortcut menu.
4. Click "Export".
5. Select the export format of the certificate.
In the next step you have to create the user programs for the data exchange and load the
configurations together with the program.
Secure Open User Communication between an S7-1500 CPU as TLS server and an external device
as TLS client
If the S7-1500 CPU acts as TLS server and the external device, for example an ERP system
(Enterprise Resource Planning System) establishes the TLS connection / session, you
require the following certificates:
● For the S7-1500 CPU, you generate a device certificate (server certificate) with a private
key and download it with the hardware configuration into the S7-1500 CPU. You use the
"Signed by certificate authority" option when generating the server certificate.
The private key is required for the key exchange as explained in the figure for the
example "HTTP over TLS".
● You have to export the CA certificate of the STEP 7 project for the ERP system and
import / load it into the ERP system. With the CA certificate the ERP system verifies the
server certificate of the S7-1500 that was transferred from the CPU to the ERP system
during the establishment of the TLS connection / session.
①
②
Figure 3-12
The required steps are described in the preceding sections.
Communication
Function Manual, 11/2019, A5E03735815-AH
TLS server
TLS client
Secure OUC between an S7-1500 CPU and ERP system
Communications services
3.6 Secure Communication
51