Configure an OPC UA connection to use CA-signed certificates

You can configure an OPC UA connection to communicate securely using certificates signed by a certificate authority (CA).

This task is a supplement to another task, Create a new OPC UA connection. It assumes you have already created a new connection and are now configuring the security settings for that connection.

A certificate is used to identify a program that is trying to communicate securely. If another program is configured to trust the certificate, it accepts that the first program is what it claims to be and agrees to communicate with it. Therefore, when two programs trust each other's certificates, they can establish secure, two-way communication with each other.

There are two ways to configure a program to trust a given certificate. First, you can manually add the certificate to the program's trust list, so that when the certificate is presented during communication, the program can check it against the list. Second, you can instruct the program to trust the certificate authority (CA) that signed the certificate, so that when the certificate is presented during communication, the program automatically trusts it.

You can buy CA-signed certificates from commercial certificate authorities such as VeriSign, DigiCert, and GeoTrust. We do not recommend that, however, because such certificates are intended for public-facing applications in which you control one program but not the other.

In this application, as long as you control both programs — that is, both the OPC UA client in your project and the OPC UA server itself — you can create your own certificate authority to sign both programs' certificates and then instruct both programs to trust the same certificate authority. It is more complicated than using self-signed certificates, but it helps you to avoid other potential issues with using self-signed certificates. For more information, see Configure an OPC UA connection to use self-signed certificates.

OPC UA uses a file-based certificate store, which means that the certificates are saved as files in folders rather than as entries in a database or system registry. This is important to know because this task involves copying certificate files from one folder to another. For more information, see "Certificate Management" in OPC Unified Architecture Specification, Part 2: Security Model. You can download that document from the OPC Foundation website at: https://opcfoundation.org/developer-tools/specifications-unified-architecture/part-2-security-model/

In this task, "OPC UA server" is a generic reference to any of the available hardware or software products that can run as an OPC UA server. For more information about how to complete certain steps, consult the manufacturer's documentation for your specific server. We have provided examples based on the free UA Sample Server and UA Configuration Tool that are offered by the OPC Foundation (opcfoundation.org), but these examples should be used only as a guide. The UA Configuration Tool is sometimes redistributed by other manufacturers with their own products, so these examples might appear to apply to your specific server, but you should still review each example before you proceed.

To configure an OPC UA connection to use CA-signed certificates:

1. In the Server Configuration dialog box, click Security.

   The Security Settings dialog box is displayed.

   

2. If the OPC UA server is configured to broadcast the security modes and policies that it supports, a list of those will be displayed in the Endpoints box and you can select the server configuration that you want to use. Otherwise, you need to manually select the security mode and policy in the Message Security Mode and Security Policy boxes, respectively. These settings must match the server configuration.

   In a typical server configuration, the security mode might be Sign and Encrypt and the security policy might be Basic128Rsa15.

3. After you select the security mode, AVEVA Edge checks whether an appropriate client certificate exists in the project folder. If it does not, you are asked if you want to create it and its associated key. Click Yes.

   The Certificate Creation dialog box is displayed.

4. In the Certificate Creation dialog box, complete the certificate information (for example, Application Name, Organization, etc.) as needed, and then click Generate.

   Note: Although you are creating a self-signed certificate here, you will reissue it as a CA-signed certificate later in this procedure.

   A new client certificate is created for your project, and the certificate and key files are saved in your project folder at: <project name>\Config\

5. Click OK to close the Security Settings dialog box and return to the Server Configuration dialog box.

6. In your OPC UA server, create your certificate authority.

   Example using UA Sample Server and UA Configuration Tool:

   1. In the UA Configuration Tool, click the Manage Certificates tab.

   2. Click Create Certificate Authority.

      The Create Certificate Authority dialog box is displayed.

   3. In the Store Type list, make sure Directory is selected.

   4. In the Store Path box, make sure UA Certificate Authorities is selected.

   5. Complete the certificate authority information (for example, Authority Name, Organization, etc.) as needed, but leave the CA Key File and CA Password boxes empty.

      That is what will make the certificate authority self-created. You can use one certificate authority to sign another certificate authority and thus give it the same credentials, but that is not necessary in this situation.

   6. In the Password and Verify Password boxes, type a password that you will remember.

      

   7. Click OK.

      The certificate authority is created, and the certificate authority's certificate and key files are saved in the UA Certificate Authorities store.

7. In your OPC UA server, add the certificate authority to your server's trust list.

   Even though you just used the server to create the certificate authority, the server will not trust it unless you specifically instruct it to.

   Example using UA Sample Server and UA Configuration Tool:

   1. In the UA Configuration Tool, click the Manage Security tab.

   2. In the Application To Manage list, make sure Opc.Ua.SampleServer is selected, and then click Select Certificate to Trust.

      The Manage Certificates in Certificate Store dialog box is displayed.

   3. In the Store Type list, make sure Directory is selected.

   4. In the Store Path box, make sure UA Certificate Authorities is selected.

   5. In the list of certificates, select the certificate authority that you created in the previous step, and then click OK.

      The selected certificate is added to the server's trust list. Or more accurately, the certificate authority's certificate file is copied to the UA Applications store.

8. In your OPC UA server, create a new, CA-signed certificate for the server.

   Example using UA Sample Server and UA Configuration Tool:

   1. In the UA Configuration Tool, click the Manage Application tab.

   2. In the Application To Manage list, make sure Opc.Ua.SampleServer is selected, and then click Create Application Certificate.

      The Create Certificate dialog box is displayed.

   3. In the Store Type list, make sure Directory is selected.

   4. In the Store Path box, make sure UA Applications is selected.

   5. In the CA Key File box, make sure the certificate authority's key file is selected.

      If it is not selected, you can browse for it. It should be located at:

      C:\ProgramData\OPC Foundation\CertificateStores\UA Certificate Authorities\Private\<authority name> [<ID string>].pfx

   6. In the CA Password box, type the password for the certificate authority.

   7. Complete the remaining certificate information (for example, Application Name, Organization, etc.) as needed.

      

   8. Click OK.

      The server certificate is created, and the certificate file is saved in the UA Applications store. If there is an old certificate file in the store, you might be prompted to overwrite or delete it. It should be safe to do so as long as there are no clients connected to the server.

   9. Restart the UA Sample Server to make sure it uses the new certificate.

9. In your OPC UA server, import the client's self-signed certificate into the server's certificate store.

   Example using UA Sample Server and UA Configuration Tool:

   1. In the UA Configuration Tool, click the Manage Certificates tab.

   2. In the Store Type list, make sure Directory is selected.

   3. In the Store Path box, make sure UA Applications is selected.

   4. Click Import Certificate to Store.

      A standard Open File dialog box is displayed.

   5. Use the dialog box to locate and select the client's certificate file.

      For projects running on Windows and Windows Embedded, the file is located in your project folder at: <project name>\Config\UAClientCertificate.der

      For projects running on IoT View, the file is located in your project folder at: <project name>\Config\opcua_certstore\certs\IoT View [<ID string>].der

   6. Click Open.

      You will be asked to confirm the import.

   7. Click Yes.

      The selected file is imported into the UA Applications store.

10. In your OPC UA server, reissue the client's self-signed certificate as a CA-signed certificate.

    Example using UA Sample Server and UA Configuration Tool:

    1. In the UA Configuration Tool, click the Manage Certificates tab.

    2. Click Select and Issue Certificate.

       The Manage Certificates in Certificate Store dialog box is displayed.

    3. In the Store Type list, make sure Directory is selected.

    4. In the Store Path box, make sure UA Applications is selected.

    5. In the list of certificates, select the client certificate, and then click OK.

       The Create Certificate dialog box is displayed with the client certificate's existing settings.

    6. In the Store Type list, make sure Directory is selected.

    7. In the Store Path box, make sure UA Applications is selected.

    8. In the CA Key File box, make sure the certificate authority's key file is selected.

       If it is not selected, you can browse for it. It should be located at:

       C:\ProgramData\OPC Foundation\CertificateStores\UA Certificate Authorities\Private\<authority name> [<ID string>].pfx

    9. In the CA Password box, type the password for the certificate authority.

    10. In the Key Format list, select the format for the client's key file.

        For projects running on Windows and Windows Embedded, select PEM.

        For projects running on IoT View, select PFX.

    11. Click OK.

        You are asked if it is okay to delete the original certificate.

    12. Click Yes.

        The reissued, CA-signed certificate and key files are saved in the UA Applications store.

11. Copy the client's CA-signed certificate and key files from the server's certificate store to the client's certificate store in your project folder.

    These files should replace the existing, self-signed certificate and key files that you created earlier.

    1. Locate the client's CA-signed certificate file in the server's certificate store.

       For UA Sample Server and UA Configuration Tool, the file should be located at:

       C:\ProgramData\OPC Foundation\CertificateStores\UA Applications\Certs\<application name> [<ID string>].der

       Please note the certificate file has a new ID string that was generated by the OPC UA server when it signed and reissued the certificate. A certificate store uses these ID strings to manage its own certificate files, and the same file may have a different ID string in each store (for example, server store versus client store).

    2. Copy (not move!) the CA-signed certificate file to the client's certificate store in your project folder, and then rename it so that it replaces the existing, self-signed certificate file there.

       For projects running on Windows and Windows Embedded, copy the file to: <project name>\Config\UAClientCertificate.der

       For projects running on IoT View, copy the file to: <project name>\Config\opcua_certstore\certs\IoT View [<ID string>].der

       The name of the CA-signed certificate file must match the name of the self-signed certificate file that it is replacing. If it does not, the client will not be able to see the file. You might need to copy the file name and then delete the existing file before you can rename the new file.

    3. Locate the client's CA-signed key file in the server's certificate store.

       For UA Sample Server and UA Configuration Tool, the file should be located at either…

       C:\ProgramData\OPC Foundation\CertificateStores\UA Applications\Private\<application name> [<ID string>].pem

       …or…

       C:\ProgramData\OPC Foundation\CertificateStores\UA Applications\Private\<application name> [<ID string>].pfx

       …depending on the key format you selected in the previous step.

       Again, please note the key file has a new ID string that was generated by the OPC UA server when it signed and reissued the key.

    4. Copy (not move!) the CA-signed key file to the client's certificate store in your project folder, and then rename it so that it replaces the existing, self-signed key file there.

       For projects running on Windows and Windows Embedded, copy the file to: <project name>\Config\UAClientCertificatePrivateKey.pem

       For projects running on IoT View, copy the file to: <project name>\Config\opcua_certstore\private\IoT View [<ID string>].pfx

       The name of the CA-signed key file must match the name of the self-signed key file that it is replacing. If it does not, the client will not be able to see the file. You might need to copy the file name and then delete the existing file before you can rename the new file.

12. If your project will run on Windows or Windows Embedded, add the certificate authority to your project's issuer and trust lists:

    1. Locate the certificate authority's certificate file.

       For UA Sample Server and UA Configuration Tool, the file should be located at:

       C:\ProgramData\OPC Foundation\CertificateStores\UA Certificate Authorities\Certs\<authority name> [<ID string>].der

    2. Copy (not rename or move) the certificate file to: <project name>\Config\IssuerList\Certs\

    3. Copy (not rename or move) the certificate file to: <project name>\Config\TrustList\Certs\

       Note: These are the default locations in your project folder where certificate files are stored. You can change these locations by changing the Trust List or Issuer Certificate List settings in the Security Settings dialog box, as shown above, and you may do this if, for example, you have a single folder where you store certificates for several different projects. In most cases, however, we do not recommend it.

13. If your project will run on IoT View, you do not need to do anything in order to have your project trust the certificate authority or get the server certificate. The project will automatically get the certificate when it runs and then connects to the OPC UA server, as if the Automatically add server certificate to certificate store on next connection option has been selected.

    OPC UA security is implemented somewhat differently for projects running on IoT View than it is for projects running on Windows and Windows Embedded, and this has two practical effects. First, IoT View has its own certificate store in your project folder, separate from the certificate store that is used when the project runs on Windows or Windows Embedded Standard. Second, it is not less secure to have the project automatically get the server certificate during project run time.

When the client and server both have CA-signed certificates, and when the certificate authority that signed the certificates has been added to both programs' trust lists, the OPC UA connection should be properly configured for secure, two-way communication.

Note: Any certificates used for secure communication will remain in the appropriate certificate store of the machine on which they were created, unless removed through other means. Removing the connection from the project or moving the project to another machine does not change the contents of the certificate store.