Edit your project's self-signed certificate

Use the Self-Signed Certificate Information tool to edit the certificate your project presents to other clients and servers that are using the Encrypted Channel feature to communicate.

Note: This topic describes only the certificate for the Encrypted Channel feature. There is a similar but separate certificate for the OPC UA Server feature. For more information, see Configure the communication settings for OPC UA Server.

With regards to the Encrypted Channel feature, your project is considered a client if any of the following is true:

• Your project includes a TCP/IP Client worksheet configured to exchange data with another project, and the Enable Encrypted Channel option is selected in that worksheet's security settings;

• Your project's security system is set to Distributed – Client mode, and the Encrypted Channel option is selected in that mode's server settings; or

• You use the Watch and/or LogWin tools to monitor a project running on a remote computer, and you select the Encrypted Channel option when you make the connection.

Your project is considered a server if the Encrypted Port option is selected in the Communication tab of the project settings.

A project can be both a client and a server, depending on how it is configured and how other projects connect to it, and it presents the same certificate for both types of connections. A self-signed certificate is signed by the software itself, as opposed to being signed by a Certificate Authority (CA).

To edit your project's self-signed certificate:

1. On the Project tab of the ribbon, in the Settings group, click Communication.

   The Communication tab of the Project Settings dialog box is displayed.

2. Under Data Server, click Self-Signed Certificate Information.

   The Server Self-Signed Certificate Information dialog box is displayed.

   

3. In the Common Name box, enter the common name of the data server itself.

   The default is [ServerName]. This is a special string that includes [NodeName] (see Machine below), and it evaluates as the following:

   StudioDataServer@[NodeName]

4. In the Organization, Organization Unit, Location Name, State/Province, and Country boxes, enter the appropriate information for your project.

5. In the Machine box, enter the name of the machine that hosts the data server.

   The default is [NodeName]. This is a special string that automatically gets the name of the computer or device that hosts the project runtime.

6. In the Years Valid For box, enter the number of years for which the certificate will be valid, starting from the date it is issued.

   The default number of years is 5. When a certificate expires, you must delete it and then issue a new one.

7. Click Delete server certificate.

   This is to make sure the existing certificate (if any) is deleted from the project files, so that a new certificate can be issued with the updated information.

8. Click OK to close the Server Self-Signed Certificate Information dialog box.

The project runtime automatically issues the data server certificate when the project is run and the TCP/IP Server Runtime task is started. At that time, the project runtime gets the name and address of the computer or device that hosts it, and then it uses that information to issue the certificate. As such, if you test your project on your local computer, a certificate will be issued using the name and address of that computer. You should delete the certificate — by clicking Delete server certificate — before you copy your project to another computer or download it to a project runtime.

When the certificate is issued, the certificate files are saved in your project's certificate store at:

<project name>\Config\certstore\own\studio_dataserver.der

<project name>\Config\certstore\own\studio_dataserver.pem

The .der file is the certificate itself, and the .pem file is the associated key. Both files must be present for the certificate to be valid.

You can double-click the .der file in Windows in order to examine the certificate information. You will see the Subject field of the certificate contains the value that you entered for Common Name above.

You will also see the Subject Alternative Name field of the certificate contains all of the valid names and addresses of the computer or device that hosts the project runtime. When a client tries to connect to the server, it compares the actual name or address of the server's host against the Subject Alternative Name field of the server's certificate. If the name or address cannot be validated, the connection fails. This is done to confirm that the server's certificate was issued on the server's host, rather than copied from another computer or device.

You can replace a self-signed certificate with a CA-signed certificate, as long as the certificate files have the correct file names and locations. If they do not, the project runtime will not be able to find and use them. Acquiring a CA-signed certificate and then using it to sign other certificates is beyond the scope of this documentation, however.