Secure Channel script background

This is a reference for the Secure Channel Windows certificate store locations.

Secure Channel and mTLS

The TCP/IP Secure Channel communication with databases is built on Mutual Transport Layer Security (mTLS). This approach provides two important aspects of security: encryption and authentication. mTLS ensures that the two entities that participate in the communication are verified and validated against each other while using strong encryption algorithms. For that, two requirements must be met:

• A Certificate Authority (CA) is used to create server and client certificates. The certificate authority must be trusted. A certificate is always signed by a third-party entity. The trust given to the signing authority provides a significant level of confidence that the peer participating in the communication is who it is claiming to be.

• The peer's certificate must be explicitly trusted by the user. The peer's certificate must be on the user's trusted list for the communication to be authorized.

Certificate Generation and Placement

You can use the SecureChannelCertificateInstaller.ps1 script to handle all of the CA and certificate tasks. It has four different actions: Create certificates (and the CA if necessary), install certificates, and export certificates; and also create certificate signing requests (CSRs).

• Create certificates:

  • Create a self-signed CA certificate if none are present, using native Windows utilities. This is done as part of the gateway or client certificate creation process.

    Tip: Your company may already have a certificate policy and/or CA in place. If so, you can use or acquire a company CA and certificate files, rather than creating a new CA and using it to create certificates.

  • Create a gateway certificate signed by the CA certificate.

  • Create one or more client certificates signed by the CA certificate.

• Create a Certificate Signing Request (CSR) for use with your company's already existing security certificate infrastructure, so that your company can supply certificate files. You can create a gateway CSR and one or more client certificate CSRs at a time.

• Install certificate in specific Windows certificate stores in the gateway or client computers.

  • Gateway computer

    • The CA certificate without private key (CER file) is installed into the Certificates (Local Computer) > Trusted Root Certification Authorities > Certificates store.

    • The gateway certificate with private key (PFX file) is installed into the Certificates (Local Computer) > Personal > Certificates store.

    • The client certificate without private key (CER file) is installed into the Certificates (Local Computer) > Trusted People > Certificates store.

  • Client computer

    • The CA certificate without private key (CER file) is installed into the Certificates - Current User > Trusted Root Certification Authorities > Certificates store.If the Gateway and Client are on the same computer, this installation is not necessary because the CA certificate without private key only needs to be installed under Certificates (Local Computer). This does not apply when the client runs as a Windows service. A service uses its own certificate stores, so install the certificates for the service account (see ClientUserAcct and ClientServiceName).

    • The client certificate with private key (PFX file) is installed into the Certificates - Current User > Personal > Certificates store.

    • The gateway certificate without private key (CER file) is installed into the Certificates - Current User > Trusted People > Certificates store.

      Tip: If the client is running as a service, import the certificates under the service account. You can use ClientUserAcct to install the certificates under the service account if you are not logged in to that account.

  • Export certificates from the Windows certificate stores as PFX, PEM, and KEY files to a specific folder.

If your company provides the CA without private key (CER file) and gateway and client certificate files with private keys (PFX files), you can use the script or the Windows Microsoft Management Console (MMC) to install the certificates on a Windows computer. Your company may provide the gateway and client certificates without private keys (CER files), but you can create those using the MMC if necessary (the script doesn't use them).

There are separate IoT View client certificate installation processes detailed in Installing CA and Certificate Files on the IoT View Target Station and Manually Configuring IoT View for Secure Channel Communication.