Configure an OPC UA connection to use self-signed certificates

You can configure an OPC UA connection to communicate securely using self-signed certificates.

This task is a supplement to another task, Create a new OPC UA connection. It assumes you have already created a new connection and are now configuring the security settings for that connection.

A certificate is used to identify a program that is trying to communicate securely. If another program is configured to trust the certificate, it accepts that the first program is what it claims to be and agrees to communicate with it. Therefore, when two programs trust each other's certificates, they can establish secure, two-way communication with each other.

There are two ways to configure a program to trust a given certificate. First, you can manually add the certificate to the program's trust list, so that when the certificate is presented during communication, the program can check it against the list. Second, you can instruct the program to trust the certificate authority (CA) that signed the certificate, so that when the certificate is presented during communication, the program automatically trusts it.

A self-signed certificate is a certificate signed by the program that created it, rather than by a certificate authority, so it must be manually added to the other program's trust list. Self-signed certificates are safe and convenient to use as long as you control both programs — for example, both the OPC UA client in your project and the OPC UA server itself.

There are some potential issues with using self-signed certificates, however:

• If you do not control both programs, you do not control their respective trust lists;

• If you have many programs that all communicate with each other, you must add each program's certificate to every other program's trust list; and

• If any program's certificate changes or expires, you must renew it and then add it again to every other's program's trust list.

In other words, self-signed certificates are only suitable for limited use among a handful of programs that you control. If you think you will encounter any of the issues listed above, consider using CA-signed certificates instead. For more information, see Configure an OPC UA connection to use CA-signed certificates.

OPC UA uses a file-based certificate store, which means that the certificates are saved as files in folders rather than as entries in a database or system registry. This is important to know because this task involves copying certificate files from one folder to another. For more information, see "Certificate Management" in OPC Unified Architecture Specification, Part 2: Security Model. You can download that document from the OPC Foundation website at: opcfoundation.org/developer-tools/specifications-unified-architecture/part-2-security-model/

In this task, "OPC UA server" is a generic reference to any of the available hardware or software products that can run as an OPC UA server. For more information about how to complete certain steps, consult the manufacturer's documentation for your specific server. We have provided examples based on the free UA Sample Server and UA Configuration Tool that are offered by the OPC Foundation (opcfoundation.org), but these examples should be used only as a guide. The UA Configuration Tool is sometimes redistributed by other manufacturers with their own products, so these examples might appear to apply to your specific server, but you should still review each example before you proceed.

To configure an OPC UA connection to use self-signed certificates:

1. In your OPC UA server, create a new, self-signed certificate for the server.

   Example using UA Sample Server and UA Configuration Tool:

   1. In the UA Configuration Tool, click the Manage Application tab.

   2. In the Application To Manage list, make sure Opc.Ua.SampleServer is selected, and then click Create Application Certificate.

      The Create Certificate dialog box is displayed.

   3. In the Store Type list, make sure Directory is selected.

   4. In the Store Path box, make sure UA Applications is selected.

   5. Complete the certificate information (for example, Application Name, Organization, etc.) as needed, but leave the CA Key File and CA Password boxes empty.

      That is what will make the certificate self-signed.

      

   6. Click OK.

      The server certificate is created. If there is an old certificate in the certificate store, you might be prompted to overwrite or delete it. It should be safe to do so as long as there are no clients connected to the server.

   7. Restart the UA Sample Server to make sure it uses the new certificate.

2. In the Server Configuration dialog box, click Security.

   The Security Settings dialog box is displayed.

   

3. If the OPC UA server is configured to broadcast the security modes and policies that it supports, a list of those will be displayed in the Endpoints box and you can select the server configuration that you want to use. Otherwise, you need to manually select the security mode and policy in the Message Security Mode and Security Policy boxes, respectively. These settings must match the server configuration.

   In a typical server configuration, the security mode might be Sign and Encrypt and the security policy might be Basic128Rsa15.

4. After you select the security mode, AVEVA Edge checks whether an appropriate client certificate exists in the project folder. If it does not, you are asked if you want to create it and its associated key. Click Yes.

   The Certificate Creation dialog box is displayed.

5. In the Certificate Creation dialog box, complete the certificate information (for example, Application Name, Organization, etc.) as needed, and then click Generate.

   A new client certificate is created for your project, and the certificate and key files are saved in your project folder at: <project name>\Config\

6. If your project will run on Windows or Windows Embedded, do the following:

   1. Click Trust server certificate.

      AVEVA Edge attempts to connect to the specified OPC UA server, and if it is successful, it imports the certificate into the client's trust list. A warning message is displayed, asking you to confirm that you trust the certificate.

   2. Click OK to confirm.

      The certificate file is copied to your project folder at: <project name>\Config\TrustList\Certs\<connection name>.der

   Note: In most cases, you do not need to change the Trust List or Issuer Certificate List settings. These are the default locations in your project folder where certificate files are stored. You may change the locations if, for example, you have a single folder where you store certificates for several different projects, but we do not recommend it.

   The server certificate file is now part of your project files, so it will be copied with the rest of the project files whenever you download your project to a target device.

7. As an alternative to clicking Trust server certificate, you may select the Automatically add server certificate to certificate store on next connection option in order to have the project to automatically get the certificate when it runs and then connects to the OPC UA server.

   The advantage of doing this is that your project will always have the latest server certificate, if that certificate is ever changed or renewed. The limitation of doing this is that it is less secure than manually adding the certificate, especially when you do not control the server and/or the network. In most cases, we do not recommend selecting this option.

8. If your project will run on IoT View, you do not need to do anything in order to get the server certificate. The project will automatically get the certificate when it runs and then connects to the OPC UA server, as if the Automatically add server certificate to certificate store on next connection option has been selected.

   OPC UA security is implemented somewhat differently for projects running on IoT View than it is for projects running on Windows and Windows Embedded, and this has two practical effects. First, IoT View has its own certificate store in your project folder, separate from the certificate store that is used when the project runs on Windows or Windows Embedded Standard. Second, it is not less secure to have the project automatically get the server certificate during project run time.

9. Click OK to close the Security Settings dialog box and return to the Server Configuration dialog box.

10. In your OPC UA server, import the client certificate into the server's trust list.

    Example using UA Sample Server and UA Configuration Tool:

    1. In the UA Configuration Tool, click the Manage Security tab.

    2. Click Import Certificate to Trust.

       A standard Open File dialog box is displayed.

    3. Use the dialog box to locate and select the client certificate file.

       For projects running on Windows and Windows Embedded, the file is located in your project folder at: <project name>\Config\UAClientCertificate.der

       For projects running on IoT View, the file is located in your project folder at: <project name>\Config\opcua_certstore\certs\IoT View [<ID string>].der

    4. Click Open.

       You will be asked to confirm the import.

    5. Click Yes.

       The selected file is imported into the server's UA Applications certificate store.

When the certificates have been exchanged — that is, when the server certificate is in the client's (that is, your project's) trust list and the client certificate is in the server's trust list — the OPC UA connection should be properly configured for secure, two-way communication.

Note: Any certificates used for secure communication will remain in the appropriate certificate store of the machine on which they were created, unless removed through other means. Removing the connection from the project or moving the project to another machine does not change the contents of the certificate store.