Siemens SIMATIC ET 200AL System Manual page 857

By default, a server certificate is created that uses SHA256 signing. The following security
policies are enabled:
● None
Insecure end point
Note
Disabling security policies you do not want
If you have selected all security policies (default setting) in the secure channel settings of
the S7-1500 OPC UA server – in other words the endpoint "No security" – non-secure
data traffic (neither signed nor encrypted) between the server and client is also possible.
The identity of the client remains unknown with "No security". Each OPC UA client can
then connect to the server irrespective of any subsequent security settings.
When configuring the OPC UA server, make sure that only security policies that are
compatible with the security concept for your machine or plant are selected. All other
security policies should be disabled.
Recommendation: If possible, use the setting "Basic256Sha256".
● Basic128Rsa15 -Sign
Insecure end point, supports a series of algorithms that use the hash algorithm RSA15
and 128-bit encryption.
This endpoint protects the integrity of the data through signing.
● Basic128Rsa15 -Sign & Encrypt
Secure endpoint, supports a series of algorithms that use the hash algorithm RSA15 and
128-bit encryption.
This endpoint protects the integrity and confidentiality of the data through signing and
encrypting.
● Basic256Rsa15 -Sign
Secure endpoint, supports a series of algorithms that use the hash algorithm RSA15 and
256-bit encryption.
This endpoint protects the integrity of the data through signing.
● Basic256Rsa15 -Sign & Encrypt
Secure endpoint, supports a series of algorithms that use the hash algorithm RSA15 and
256-bit encryption.
This end point protects the integrity and confidentiality of the data through signing and
encrypting.
● Basic256Sha256 - Sign
Secure endpoint, supports a series of algorithms for 256-bit hashing and 256-bit
encryption.
This endpoint protects the integrity of the data through signing.
● Basic256Sha256 - Sign & Encrypt
Secure endpoint, supports a series of algorithms for 256-bit hashing and 256-bit
encryption.
This endpoint protects the integrity and confidentiality of the data through signing and
encryption.
Communication
Function Manual, 12/2017, A5E03735815-AF
OPC UA communication
9.3 Using the S7-1500 as an OPC UA server
171