Configure the Connection to a Remote CtAPI Application

The connection between a remote computer running a CtAPI application and Plant SCADA's servers is encrypted by default.

Note: You can disable encryption for the connection to a CtAPI application, but it is not recommended. To configure an unencrypted connection, see the procedure described below in Configure an unencrypted connection for a remote CtAPI client application.

Configure encrypted communications for a remote CtAPI client application

1. Copy the set of required binaries into the same directory as the CTAPI client application (see Run a CtAPI Application).

2. If Plant SCADA is not installed on the computer where the CtAPI application is hosted, install a runtime-only client (see Install a Runtime-only Client).

3. Use Configurator to connect the computer to the System Management Server you use to manage the required certificates for encryption (see Connect a Computer to a System Management Server).

4. On Configurator's Encryption page, confirm that Enable Encryption is selected. Do not select Accept encrypted and non-encrypted connections (mixed mode).

   

   Note: Runtime Manager does not need to be configured to run as a service as it is not required to run a CtAPI application.

5. Confirm that the Windows user account under which the CtAPI application will run is part of the SCADA.RuntimeUsers Windows group on the CtAPI server machine, or a member of a Windows Group that is associated with the SCADA.RuntimeUsers group. For more information, see Security Roles.

6. Within the ctOpen command, set the sComputer argument to the computer name of the remote CTAPI server. Do not use an IP Address for sComputer. If you do, encryption will not be possible as the certificate is bound to the computer name.

Configure unencrypted communications for a remote CtAPI client application

7. Copy the set of required binaries into the same directory as the CTAPI client application (see Run a CtAPI Application).

8. If Plant SCADA is not installed on the computer where the CtAPI application is hosted, install a runtime-only client (see Install a Runtime-only Client).

9. On Configurator's Encryption page, confirm that Enable Encryption is not selected.

   Note: Runtime Manager does not need to be configured to run as a service as it is not required to run a CtAPI application.

10. If you are going to run the CtAPI application under a Windows user account, confirm that account is part of the SCADA.RuntimeUsers Windows group on the CtAPI server machine, or a member of a Windows Group that is associated with the SCADA.RuntimeUsers group. For more information, see Security Roles.

    This step is not required if you are going to run the CtAPI application under a Plant SCADA user account. However, Windows User security is recommended.

11. Within the ctOpen command, set the sComputer argument to the computer name of the remote CTAPI server.

Note: Using a hostname to connect to a CTAPI server running Citect SCADA 8.20 or earlier will not work if Windows is configured to return an IPv6 address for that hostname, as 8.20 and earlier do not support IPv6 network addresses. To avoid this, configure Windows to return an IPv4 address in preference to an IPv6 address.

See Also

Enable Automatic Updates of TLS Versions for CtAPI Applications

CtAPI Functions Reference

Error Codes