Manually configure IoT View for Secure Channel communication

This is a procedure for manually configuring IoT View for Secure Channel communication.

If you have created, or already have already in place, a certificate authority (CA), private keys, and certificates used for Mutual Transport Layer Security (mTLS) Secure Channel communication, you can now configure a client running on an IoT View target station. These instructions are designed for Debian-based distributions of Linux, such as Ubuntu and Raspbian.

The AVEVA Historian server certificate is not configured on the IoT View target station. Trust it on the computer that runs Studio Database Gateway. See Trust the AVEVA Historian server certificate.

Configuring the target station for Secure Channel communication.

1. Updating the local CA certificate store:

   Tip: This step requires root permissions.

   Certificate Authority (CA) certificates must be installed on the system. The CA certificate installed will be used to decrypt an encrypted certificate's digest, validating whether or not it is signed by the CA. For this procedure, the certificate file name is RootCA.pem.

   1. If not already installed, install the certificates package:

      apt-get install ca-certificates --yes

   2. Copy the root certificate to the directory /usr/local/share/ca-certificates on the Linux machine and set the file extension to CRT.

      cp RootCA.pem /usr/local/share/ca-certificates/RootCA.crt

   3. Update the certificate store:

      update-ca-certificates

2. Setting the private key:

   The private key must be copied to the folder ~/.iotview/private_key. The project will read the file stored there. There can be only one one file in that directory. Using the example names Client1.crt for the certificate file and Client1.key for the key, follow this procedure:

   1. Create the folder.

      mkdir -p ~/.iotview/ && mkdir -p ~/.iotview/private_key

   2. Copy the certificate file to ~/.iotview/private_key.

      cat Client1.crt > ~/.iotview/private_key/Client1.key

   3. Append the private key to ~/.iotview/private_key/Client1.key.

      cat iotview/Client1.key >> ~/.iotview/private_key/Client1.key

   Notes:

   • The private key file can have any legitimate file name.

   • If there is more than one file in the private_key folder, Secure Channel communications will not start.

   • Secure Channel communications will not start if the private key folder or the private key file are symbolic links.

   • Secure Channel communications will not start unless the private key directory permissions are set to read and execute only (permission 500, exclusive to the owner).

     To set the correct permissions, use the following command:

     chmod 500 ~/.iotview/private_key/

   • Secure Channel communications will not start unless the private key file permissions are set to read only (permission 400, exclusive to the owner).

     To set the correct permissions, use the following command:

     chmod 400 ~/.iotview/private_key/Client1.key

3. Setting Trusted and Rejected Certificates

   Trusted certificates belong in ~/.iotview/authorized_certs/. Rejected certificates belong in ~/.iotview/rejected_certs. As an example, to trust the gateway certificate file Studio Database Gateway_.crt, follow this procedure:

   1. Create these two folders:

      mkdir -p ~/.iotview/ && mkdir -p ~/.iotview/authorized_certs

      mkdir -p ~/.iotview/ && mkdir -p ~/.iotview/rejected_certs

   2. Copy Studio Database Gateway_.crt to ~/.iotview/authorized_certs/:

      cp Studio Database Gateway_.crt ~/.iotview/authorized_certs/

   3. If instead of trusting, the user wants to reject the gateway certificate, copy it to ~/.iotview/rejected_certs/:

      cp Studio Database Gateway_.crt ~/.iotview/rejected_certs/

   Notes:

   • The certificates can have any legitimate file name.

   • Certificates can be either in ASN1 format (DER or CER file extensions) or PEM format (CRT or PEM file extensions). They should not contain private keys.

   • Secure Channel communications will not start if the certificate folder or the certificate files are symbolic links.

   • Secure Channel communications will not start unless the authorized_certs and rejected_certs directories permissions are set to read-write-execute only (permission 700, exclusive to the owner).

     To set the correct permissions, use the following command:

     chmod 700 ~/.iotview/authorized_certs/ && chmod 700 ~/.iotview/rejected_certs

   • Secure Channel communications will not start unless the certificate files in the authorized_certs and rejected_certs directories permissions are set to read only (permission 400, exclusive to the owner).

     To set the correct permissions, use the following command:

     o chmod 400 ~/.iotview/authorized_certs/* && chmod 400 ~/.iotview/rejected_certs/*