Create a self-signed SSL/TLS certificate

To open the FactoryTalk Updater application in a browser, you must use Transport Layer Security (TLS) 1.2 or later. Rockwell Automation recommends using a certificate signed by a certificate authority (CA). You can create a self-signed certificate on the FactoryTalk Updater Server.
To open the
FactoryTalk
 Updater application in a browser, you must use Transport Layer Security (TLS) 1.2 or later.
Rockwell Automation
 recommends that you disable TLS 1.0 and TLS 1.1 in the system.
Rockwell Automation
 also recommends using a certificate signed by your organization's internal certificate authority (CA) or a commercial certificate authority. Alternatively, you can create a self-signed certificate on the
FactoryTalk
 Updater server.
  1. Follow these steps to create a self-signed certificate:
  2. On the
    FactoryTalk
     Updater server computer, run the following PowerShell command to create a self-signed certificate:
    New-SelfSignedCertificate -FriendlyName EXAMPLE_CERT_NAME -DnsName EXAMPLE_FULL_COMPUTER_NAME -KeyUsage DigitalSignature
    Replace
    EXAMPLE_CERT_NAME
     with the name that should appear in the
    Server Certificates
     list in Internet Information Services (IIS). For example, use the name "FactoryTalk Updater".
    Replace
    EXAMPLE_FULL_COMPUTER_NAME
     with the fully qualified domain name of the server. For example, use the name
    4sk2h63.example.com
    .
  3. Open the application.
  4. Select
    Server Certificates
    .
  5. In the
    Server Certificates
     window, verify that the self-signed certificate is visible in the list.
  6. (optional) If you have a CA certificate, right-click in
    Server Certificates
    , then:
    1. If you have a PFX file containing the certificate (public keys) and the corresponding private keys, select
      Import
      .
    2. If you have a file from a CA containing the CA's response (such as a CER file), select
      Complete Certificate Request
      .
  7. In the
    Connections
     list, right-click the UpdaterWebServer certificate and select
    Edit Bindings
    .
  8. In the
    Site Bindings
     dialog, select the
    https
     binding and select
    Edit
    .
  9. In the dialog, in the
    SSL certificate
     menu, select the certificate and select
    OK
    .
  10. In the
    Connections
     list, right-click the certificate and select
    Manage Website > Restart
    .
  11. Follow these steps to export the self-signed certificate as a PFX file:
  12. On the
    FactoryTalk
     Updater Server computer, open the application.
  13. Select
    Server Certificates
    .
  14. In the window, identify the self-signed certificate, then write down or copy its
    Certificate Hash
     value. This value will be used in the following steps.
  15. Open PowerShell, then run the following command to create a password for the PFX file:
    $mypwd = ConvertTo-SecureString -String 'EXAMPLE_PASSWORD' -Force -AsPlainText
    Replace
    EXAMPLE_PASSWORD
     with the password that will secure the self-signed certificate.
  16. In the same PowerShell window, run the following command to export the self-signed certificate as a PFX file:
    
$cert =  Get-ChildItem -Path Cert:\LocalMachine\My\EXAMPLE_CERTIFICATE_HASH | Export-PfxCertificate -FilePath C:\mypfx.pfx -Password $mypwd
    Replace
    EXAMPLE_CERTIFICATE_HASH
     with the Certificate Hash value identified in previous steps. For example, the value might be
    ca7e070c4448bc7ae47db59b65e39e8199edae08
    .
    Replace
    C:\mypfx.pfx
     with the file path for the new self-signed PFX file.
  17. Follow these steps to import the self-signed PFX file on
    FactoryTalk
     Updater Client computers:
  18. Copy the PFX file created in the previous steps to the
    FactoryTalk
     Updater Client computer.
  19. Double-click the PFX file. The appears.
  20. For
    Store Location
    , select
    Local Machine
     and select
    Next
    .
  21. Verify that the certificate file name appears in the
    File name
     box and select
    Next
    .
  22. Select
    Place all certificates in the following store
     and select
    Browse
     to open the dialog.
  23. Enter the password that you set for the certificate and select
    Next
    .
  24. Select the
    Trusted Root Certification Authorities
     folder and select
    OK
    .
  25. Select
    Next
    .
  26. Select
    Finish
    .
Provide Feedback
Have questions or feedback about this documentation? Please submit your feedback here.
Normal