Certificate validation
A certificate is an electronic document used to prove the ownership of a public key. It contains information about the Certificate Authority (CA) who issues the certificate, the expiration date, public key, subject of the certificate, signature and algorithm.
When an
OPC
UA client makes connection with FactoryTalk Linx Gateway
, the certificates from both sides need to be trusted separately so that the connection can be established successfully.The process of validating the certificates
- AnOPCUA client sends a request to establish a connection with theFactoryTalk Linx Gateway.
- FactoryTalk Linx Gatewaypresents its certificate to theOPCUA client.TIP:The certificate includes a public key for data signing, encryption, and decryption.
- TheOPCUA client validates the certificate and select to trust it. For example:Certificate Validation
TIP:- Different OPC UA clients use different approaches to trust theFactoryTalk Linx Gatewaycertificate. See the associated help documentation for more information.
- The user can replace the self-signedFactoryTalk Linx Gatewaycertificate inC:\ProgramData\Rockwell\FactoryTalk Linx Gateway\PKI\ownwith its own certificate.Make sure the certificate replacement uses the same name, format, and password.
- TheOPCUA client presents its certificate toFactoryTalk Linx Gateway.Users can also manually import a certificate intoFactoryTalk Linx Gateway.
- TheFactoryTalk Linx Gatewayvalidates the incomingOPCUA client's certificate and generates a validation log message.To validate theOPCUA client certificate, theFactoryTalk Linx Gatewaywill check below items:
- Validate to
- Certificate Revoke List (CRL)
- Application URI
- Subject Name
- Validate from
- Expiration Time
- Issue to
- Issue by
- Certificate path
- Issuer
- Issuer certificate
- Signature hash algorithm
- Signature algorithmTIP:
- Apart from the items in certificate, theFactoryTalk Linx Gatewaywill also check the folderscrl,issuer,rejected,trustedunderC:\ProgramData\Rockwell\FactoryTalk Linx Gateway\PKI. This is to check if the incoming certificate has been validated before.
- Access to Internet is not required when theFactoryTalk Linx Gatewayperforms certificate validation.
- After validation, the certificate is placed into the rejected field inFactoryTalk Linx GatewayConfiguration Certificate Management tab.A diagnostic message "The certificate presented by the client <ClientName> is not trusted" is logged on FactoryTalk Diagnostics Log tab.
- Select the appropriate certificate, and then clickTrustto move the certificate to theTrusted Certificatesfield.A diagnostic message "Certificate <CertificateName> is trusted by user <UserName>." is logged on FactoryTalk Diagnostics Log tab.
- Connection established, theOPCUA client can communicate with theFactoryTalk Linx Gateway.
Provide Feedback