Generate client certificates

To use TLS with client certificate authentication in the AVEVA Adapter for Modbus TCP, you must generate and supply the following files:

• A client certificate in PEM-encoded X.509 format

• The matching private key in PEM format

These files are required by the adapter to present the client’s identity. The Modbus server operator is responsible for supplying or trusting the necessary CA or root certificate.

Client certificate requirements

• Use PEM format for both certificate and private key. For example, -----BEGIN CERTIFICATE-----, -----BEGIN PRIVATE KEY-----.

• Must support client authentication usage (EKU: clientAuth).

• Custom role extension:

  OID: 1.3.6.1.4.1.50316.802.1

  Value: UTF8String containing the role name (for example, operator, admin).

• Validity period and key size should comply with your organization's policies.

Self-Signed certificate example

The following is an example of generating a self-signed client certificate and private key using OpenSSL on Linux.

openssl req -x509 -newkey rsa:4096 \

-keyout client_key.pem \

-out client_cert.pem \

-subj "/C=US/ST=State/L=City/O=Company/CN=client.example.com" \

-addext "1.3.6.1.4.1.50316.802.1=ASN1:UTF8String:operator" \

-nodes -days 365 -sha256

CA-Signed certificate example

In most cases, a CA-signed certificate is created in accordance with organizational certificate request processes. This example assumes you have an existing CA certificate and key.

1. Create a client_ext.cnf file to hold the certificate extensions:

   basicConstraints = CA:FALSE

   keyUsage = digitalSignature, keyEncipherment

   extendedKeyUsage = clientAuth

   1.3.6.1.4.1.50316.802.1 = ASN1:UTF8String:operator

2. Generate client key and certificate signing request (CSR):

   openssl req -newkey rsa:4096 -keyout client_key.pem -out client_csr.pem \
   -subj "/C=US/ST=State/L=City/O=Company/CN=client.example.com" -nodes

3. Sign the CSR with CA, including the extensions from client_ext.cnf:

   openssl x509 -req -in client_csr.pem -CA ca_cert.pem -CAkey ca_key.pem \
   -CAcreateserial -out client_cert.pem -days 365 -sha256 -extfile client_ext.cnf

   The OpenSSL creates client_cert.pem and client_key.pem in the current directory. You can now reference these files in the adapter's data source configuration.