Secure the Connection from a Remote CtAPI Application

You can encrypt the connection between a remote computer running a CtAPI application and Plant SCADA's servers.

To enable encryption for a remote CtAPI client application:

1. Copy the set of required binaries into the same directory as the CTAPI client application (see Running CtAPI Applications in the topic CtAPI).

2. If Plant SCADA is not installed on the computer where the CtAPI application is hosted, install a runtime-only client (see Install a Runtime-only Client).

3. Use Configurator to connect the computer to the System Management Server you use to manage the required certificates for encryption (see Connect a Computer to a System Management Server).

4. On Configurator's Encryption page, select Enable Encryption. Do not select Accept encrypted and non-encrypted connections (mixed mode).

   

   Note: Runtime Manager does not need to be configured to run as a service as it is not required to run a CtAPI application.

5. Confirm that the Windows user account under which the CtAPI application will run is part of the SCADA.RuntimeUsers Windows group on the CtAPI server machine, or a member of a Windows Group that is associated with the SCADA.RuntimeUsers group. For more information, see Security Roles.

6. Within the ctOpen command, set the sComputer argument to the computer name of the remote CTAPI server. Do not use an IP Address for sComputer. If you do, encryption will not be possible as the certificate is bound to the computer name.

   Note: Using a hostname to connect to a CTAPI server running Citect SCADA 8.20 or earlier will not work if Windows is configured to return an IPv6 address for that hostname, as 8.20 and earlier do not support IPv6 network addresses. To avoid this, configure Windows to return an IPv4 address in preference to an IPv6 address.

See Also

CtAPI Functions Reference

Error Codes