Skip to main content

How To: Request and provide CA-signed certificates via the PLC Shell

The PLC shell of the device editor can be used to create a CSR for a PLC certificate.

Important

When creating a CSR (Certificate Signing Request), the PLC adds all required X509 extensions to the CSR. As a result, a certification authority (CA) may add some extensions, but may not omit the existing extensions. If the extensions of the CSR do not exist in the signed certificate, then it cannot be used by the PLC.

The following entries are included in the CA-signed certificate and must therefore exist in the CSR:

  • Key Usage

  • Extended Key Usage

  • Subject Alternative Name

  • Each with the Critical flag

  1. First, you generate a certificate request for all required certificates or components (CSR = Certificate Signing Request). These can also become client certificates (for example, for the OPC UA client). To do this, click the PLC Shell tab of the controller. In the input line, type in the cert-createcsr command.

    Syntax: cert-createcsr [<number retrieved by \"cert-getapplist\">] [encoding=Base64 | ASN.1]

    <number retrieved by \"cert-getapplist\">

    Optional: Specify the number of a single component from the output of cert -getapplist. If not specified, certificates are generated for all generated components.

    encoding=Base64 | ASN.1

    Optional: Specify the export format (default setting: ASN.1).

    ANS.1: Binary file format for certificates, CSR, and asymmetric keys.

    Base64: Textual representation of ASN.1 data, based on Base64 encoding.

    Note

    The file format may be specified by CAs. Then the CSR is automatically generated in the correct format.

    Otherwise, lossless conversion of one format to the other is also possible. For example, OpenSSL can be used to do this:

    openssl req -in <file name> -inform <DER|PEM> -out <file name_new> -outform <PEM|DER>

    DER corresponds to ASN.1; PEM corresponds to Base64.

  2. Click the Log tab and then click the refresh button (_cds_icon_update.png).

    In the log entries, you can see that the CSR files were generated.

  3. Click the Files tab and open the file path cert/export in the right side of the Runtime dialog.

    The export folder contains the generated CSR files.

    Example: 0_CmpsecureChannl.csr, 1_CmpApp.csr, 2_CmpWebServer.csr

  4. Select a file path where you want to insert the CSR files in the left side of the Host dialog, mark the CSR files in the right side of the dialog, and click _cds_button_double_arrow_left.png.

    The CSR files are copied to the required folder.

  5. These certificate requests can be signed by a certificate authority (CA). As a result, you get a certificate signed from the certification authority.

  6. In the steps that follow, you import these signed certificates to your controller.

    Note

    After restarting the controller, the CA-signed certificates are used automatically.

    Tip

    Alternatively, you could also use the CODESYS Security Agent to transfer the certificates to the controller. For more information, see the following: CODESYS Security Agent

  7. Select the Path cert/import in the right side of the Runtime dialog.

  8. In the left side of the Host dialog, select the path in the file system where you saved the signed certificates and selected the certificates.

  9. Click the _cds_button_double_arrow_right.png button.

    The certificates are copied to the cert/import folder.

  10. Click the PLC Shell tab.

  11. Type in the cert-import own <file name of the certificate.cer> command in the input line of the tab and press the Enter key.

    The signed certificates are available to the runtime servers.

Note

In the configuration file of the controller (for example, CODESYSControl.cfg), the name of the organization can be set in the certificate for an OPC UA server with the following entry:

[CmpOPCUAServer]

SECURITY.CompanyOrOrganizationName="<organization name>"

If the CODESYS Security Agent is installed, then it is also possible to edit the Communication Settings on the communication settings tab of the device editor.

In this section: