Skip to main content

View: Security Screen – Devices

Tip

For more information about security, certificates, and encryption, see the following: CODESYS: Security in CODESYS

Function: The tab allows for the configuration and the transfer of controller certificates for encrypted communication with the controller. CSR files for certificate signing requests can be created for your own certificates.

. Call:

  • View menu →Security Screen

  • Button: _cds_icon_cyber_screen_grey.png

Requirement: The CODESYS Security Agent add-on product is installed.

For more information, see the following:

The Devices tab shows all PLC devices configured in the project and their certificate store. If the communication path to the controller is configured, then you see the certificates that are stored in memory. Here you can issue and configure new certificates on the controller. If a certificate currently in use is about to expire, then you get a warning when you log in to the device, and from there you can also switch directly to the Security Screen to renew the certificate.

Left side: Information

Devices and certificate store

Shows the individual devices cds_icon_device_editor.png as expandable nodes, each with the controller-specific _csa_icon_cert_store_open.png certificate store below it.

For example, there are the following categories for CODESYS Control Win SL:

  • Use Cases: Use cases for which a certificate can be issued or also a CSR can be generated

  • Own: Certificates with the assigned private key to which you have access

  • Trusted: Certificates issued by a trusted certificate source

  • Untrusted: Certificates which you have specifically defined as untrusted

  • Quarantined: Certificates in quarantine which do not fulfill the criteria of the categories above

  • CSRs: Certificates for which signing requests have already been generated

  • CRLs: Management of CRLs for the device

Toolbar (left side)

_csa_icon_refresh.png: Refresh the display

_csa_icon_download_cert.png: Select certificate and transfer from the PC to the PLC (download). The default dialog for selecting a file from the local file system will open. File type: *.cer, *.crt, *.der. The certificate is stored on the PLC in the respective selected memory.

Ab CODESYS Control Version 3.5.18.0 also possible for the Own Certificates category: Import of a PKCS#12 container file (certificate + key), file type: *.p12, *.pfx. After you select the container file from the file system, the Import Certificate Container dialog opens where you need to specify the password which was assigned when the file was created. By default, this container cannot be exported from the PLC again afterwards. If you want to allow this, enable the The container may be re-exported from the device option.

Right side:

Information

If the active path to the controller is set and a device node is selected, then every use case for controller certificates is displayed on the right side.

  • Redundancy: Encrypted synchronization of visualization states between redundant controllers

    For more information, see the following: Tab: Redundancy Settings: Visualization

  • OPC UA Server: Encrypted communication over an OPC UA Server

  • Encrypted Communication: Encrypted communication between the development system and the controller

  • Encrypted Application: Encryption of the boot application

  • Web Server: Encrypted communication with the web server

As long as a certificate is not available for one of these use cases, it is displayed with the _cds_IconCertNotAvailable.png icon as (not available).

When a certificate store is selected on the left side, all certificates in it are displayed on the right side with the following information:

Information: Use case; currently the controller component in question is displayed (example: CmpSecureChannel)

Issued for: Name of the computer for which the certificate was issued (example: MyLocalPC)

Issued by: Name of the computer on which the certificate was issued (example: MyLocalPC)

Valid as of: Date (example: 07/20/2017 15:09:29)

Valid until: Date (example: 07/20/2022 00:00:00. Depending on the remaining time of the certificate, the highlight color of the field changes: green -> yellow (two-thirds expired) -> orange (nine-tenths expired) -> red (expired). Note: When logging in to the controller, you get a warning when two-thirds or more of the validity period have expired. Then you can renew the certificate here in the Security Screen.

Thumbprint: Hash value from specific properties of the certificate for purposes of identification (example: 279e1a46b86bd636c8e6f19fd51c222469ec49a8)

Double-clicking a certificate entry opens the default Windows Certificate dialog. As a result, you can import a controller certificate into the Windows Certificate Store in the Controller Certificates folder, so that it is available for the encryption of boot applications, downloads, and online changes.

If multiple certificates are available for one use case, then the system follows the steps below to determine the certificate that is used:

  • Filtering of existing certificates by:

    1. Subject

    2. Key usage

    3. Extended key usage

    4. SAN (Subject alternative name)

    5. Valid timestamp

  • Dividing of detected, valid certificates as "signed" and "self-signed"

  • Filtering of signed certificates, and then filtering of the self-signed certificates by the following criteria:

    1. Longest validity period

    2. Strongest key

Drag&Drop: Moving of the certificate to another certificate store of the same device

Double-clicking a certificate entry opens the default Windows dialog for displaying all certificate information.

Toolbar (right side)

_csa_icon_create_cert.png: Issues a new certificate for a specific use case:

The Certificate Settings dialog opens for configuring the Validity period of the certificate and the Key length for the private key. Clicking OK saves the specified values in the CODESYS options. The values are reset at the next operation.

As long as the certificate is being issued, "(computing)" is displayed after the use case. You cannot cancel the issuing operation, but you can close the Security Screen and continue working.

_cds_icon_breakpoint_delete.png: Deletes the selected certificate

If it is your own certificate, then the button opens a dialog which prompts you whether or not to keep the private key associated with the certificate. The answer Yes is set by default. Note that deleting the private key cannot be undone.

_csa_icon_upload_cert.png: Upload selected certificate from the device and save on the PC.

For CODESYS Control in Version 3.5.18.0 and higher, you can export PKCS#12 container files (certificate + key) from the controller if this has been permitted for the container. In this case, select a name, location, and file type (*.p12 or *.pfx) for the container file to be created in the local file system. The Export Certificate Container dialog opens where you specify a password for the container file. This kind of container can then be imported, for example, into the Own Certificates category on another controller (see above: toolbar on the left _csa_icon_download_cert.png).

_csa_icon_details_certificate.png: Details about the selected certificate: Opens the Certificate dialog with the General tab, Details tab, and Certification Path tab

_csa_icon_recreate_certificate.png: Generate a new certificate on the device. Opens the Certificate Settings dialog:

  • To issue an additional new certificate for a certificate that will expire soon, with the same purpose and specified key length.

  • If there is no certificate for the chosen purpose, then a new certificate can be issued.

The predefined values in the dialog are adapted, if necessary, depending on the selected certificate.

IconSigningRequestCreate.png: Generate the files <component>.csr for a CSR (Certificate Signing Request) which should be sent to a CA (Certificate Authority). This is an alternative to generating CSRs via the PLC shell and requires the corresponding permissions and at least CODESYS V3.5 SP17. The button opens the Certificate Signing Request Settings dialog. You can specify for which Component(s) the CSR files should be generated. After you click OK to confirm, a message is displayed that the files are being generated. You can see the status of the creation in the device log. To save the files to your computer, use the _csa_icon_download_cert.png button. Here you specify how the Encoding should be: ASN.1 or (by default) Base64.

For more information, see the following:

In this section: