Manage your project's certificate store

Use the Certificate Store Management program to manage your project's certificate store. Certificates are exchanged between clients and servers that are using the Encrypted Channel feature to communicate.

Note: This topic describes only the certificate store for the Encrypted Channel feature. There is a similar but separate certificate store for the OPC UA Server feature. For more information, see How to manage OPC UA Server during project run time.

With regards to the Encrypted Channel feature, your project is considered a client if any of the following is true:

• Your project includes a TCP/IP Client worksheet configured to exchange data with another project, and the Enable Encrypted Channel option is selected in that worksheet's security settings; or

• Your project's security system is set to Distributed – Client mode, and the Encrypted Channel option is selected in that mode's server settings.

• You use the Watch and/or LogWin tools to monitor a project running on a remote computer, and you select the Encrypted Channel option when you make the connection.

Your project is considered a server if the Encrypted Port option is selected in the Communication tab of the project settings.

A project can be both a client and a server, depending on how it is configured and how other projects connect to it, and it has a single certificate store for both types of certificates.

When a client attempts to connect to and communicate with a server, they will present their certificates to each other. Your project will automatically trust or reject a certificate depending on whether you selected the Automatically trust server certificate option for a given feature, and the certificate files are saved in the appropriate folders in your project's certificate store at:

<project name>\Config\certstore\rejected\

<project name>\Config\certstore\trusted\

This software includes a small utility program called Certificate Store Management (CertStoreManager.exe), which helps you to view certificates and move them between folders in the certificate store. If you have the full AVEVA Edge software installed, you can open the program by clicking Remote Servers Certificates in the Communication tab of your project settings. The program will automatically open the certificate store for the current project:

Trusted, Rejected

These lists display the respective contents of the trusted and rejected folders in your project's certificate store. To move a certificate from one list to the other, select it and then click > or < as needed.

Issued To, Client URI

Certificate information extracted from the selected certificate. This information cannot be edited.

Add New Certificate

Click to add a new certificate to the Trusted list. You will be asked to locate and open the certificate file. You should be familiar with certificate file names and extensions, as defined by the X.509 standard, so that you can locate the correct file. The file will be copied to the trusted folder in your project's certificate store.

Remove

Click to remove the selected certificate; the certificate file will be deleted from your project's certificate store, regardless of which list/folder it is in. Be aware that removing a certificate does not prevent a client or server from presenting the same certificate again in the future. If you want to reject the certificate, move it to the Rejected list.

Tip: It is often useful to add certificates to your project's certificate store while you are still developing your project, so that they can be downloaded with the rest of the project files.

If the AVEVA Edge software is licensed for Runtime only — that is, if it is installed on another computer and running only as the SCADA runtime edition for Windows — you might not be able to access the project settings in order to open the Certificate Store Management program. In this case, you can manually run the program by locating it in the program folder and then double-clicking it. The program file should be located at:

C:\Program Files (x86)\AVEVA\AVEVA Edge2026\Bin\CertStoreManager.exe

When you open the Certificate Store Management program in this way, it will first ask you to locate and open your project file (<project name>.app). Otherwise, the program behaves the same as if you opened it from the project settings.

If your project is running in Embedded HMI on a Windows Embedded device, be aware the Certificate Store Management program is not installed with that software. You can copy the program (for example, over the network or on a USB thumb drive) from your development workstation to the device and then run it there, or you can manually move the certificate files between folders in the project's certificate store.

If your project is running in IoT View on a POSIX-compliant operating system (for example, Linux), you cannot use the Certificate Store Management program. You must manually move the certificate files between folders in the project's certificate store.

Regardless of how you move the certificate files, you should restart the TCP/IP Server Runtime task and/or the TCP/IP Client Runtime task after you make any changes. This is to make sure rejected clients and servers that were previously trusted are properly disconnected. You do not need to restart the entire project, thanks to the project runtime server's task-based architecture.