Trust the AVEVA Historian server certificate

Studio Database Gateway connects to AVEVA Historian over HTTPS and validates the certificate that the Historian server presents. The certificate chain must be trusted on the computer that runs the gateway. This certificate is provided by the Historian server. AVEVA Edge does not create it, and the Secure Channel script cannot create or replace it. It is unrelated to the certificates of TCP/IP Secure Channel, which are used only between the project runtime and the gateway. For background, see About AVEVA Historian security.

Install the issuing root certificate in Local Computer > Trusted Root Certification Authorities.

If an intermediate certification authority issued the server certificate, install that certificate in Local Computer > Intermediate Certification Authorities.

Certificates installed only for the current user are not sufficient.

In the Historian dialog, enter a server name that is in the certificate Subject Alternative Name list. For an IP address, the name returned by the DNS lookup of that address must be in the list.

To trust the certificate:

1. 1. On the Historian computer, open certlm.msc. Find the server certificate under Personal > Certificates. On the Certification Path tab, note the root and intermediate certification authorities.

2. Export the public certificate (never the private key) of the root and of every intermediate certification authority as DER encoded binary X.509 (.CER).

3. Copy the files to the gateway computer.

4. On the gateway computer, in an elevated PowerShell, run:

   Import-Certificate -FilePath '<root>.cer' -CertStoreLocation Cert:\LocalMachine\Root

   Import-Certificate -FilePath '<intermediate>.cer' -CertStoreLocation Cert:\LocalMachine\CA

5. 5. Restart Studio Database Gateway.

Special cases:

The gateway computer is joined to the same AVEVA System Management Server as the Historian, or the domain already trusts the issuing authority through Group Policy: nothing to import. See Connect a machine to an SMS.

Self-signed certificate with no certification authority: export the server certificate itself and import it into Trusted Root Certification Authorities.

Workgroup computers: use the same procedure and use specific credentials.

Certificates expire. Import the new certificates after a renewal.

To verify from the gateway computer, run both commands. Both must succeed:

Test-NetConnection <historian> -Port 32565

Test-Connection <historian> -Count 2

For tests on an isolated network only, WWAllowUntrustedConnection=1 in the [Historian] section of StADOSvr.ini turns off certificate validation. This is insecure. Do not use it in production. See Advanced settings in Studio Database Gateway.