Siemens SIMATIC S7-1500 Function Manual page 57

Communications services
3.6 Secure Communication
The steps for verifying the authenticity of the Web server:
1. Alice must know the public keys of all relevant certificate authorities, which means she
requires the complete certificate chain to verify the Web server certificate (i.e. the end-
entity certificate of the Web server):
Alice will generally have the required root certificate in her certificate memory. When a
Web browser is installed, a range of trusted root certificates is also installed. If she does
not have the root certificate, she has to download it from the certificate authority and
install it in the certificate store of the browser. The certificate authority can also be the
device on which the Web server is located.
You have the following options for obtaining the intermediate certificates:
– The server itself sends the required intermediate certificates to Alice along with its
– The certificates often contain the URLs of the certificate issuer. Alice can load the
When you work with certificates in STEP 7 it is always assumed that you have imported
the intermediate certificates and the root certificate into the project and assigned them to
the module.
2. Alice validates the signatures in the certificate chain with the public keys of the
certificates.
3. The symmetric key must be generated and transferred to the Web server.
4. If the Web server is addressed by its domain name, Alice also verifies the identity of the
Web server in accordance with the Internet PKI rules defined in RFC 2818. She is able to
do this because the URL of the Web server, in this case the "Fully Qualified Domain
Name" (FQDN), is saved in the end-entity certificate of the Web server. If the certificate
entry in the "Subject Alternative Name" field corresponds to the entry in the address bar
of the browser, everything is fine.
The process continues with the exchange of data with the symmetric key, as shown in the
figure above.
56
end-entity certificate – in the form of a signed message so that Alice can verify the
integrity of the certificate chain.
required intermediate certificates from these URLs.
Function Manual, 11/2019, A5E03735815-AH
Communication