wir nutzen in Automation Studio 4 verschlüsselte ANSL-Kommunikation und konnten die IP-Adresse der Steuerung zur Laufzeit über CfgSetIPAddr() setzen. Danach war ein Verbindungsaufbau über ANSL mit der neuen IP-Adresse problemlos möglich.
In Automation Studio 6 scheint sich das Verhalten geändert zu haben:
Die IP-Adresse der SPS muss im Server-Zertifikat hinterlegt sein.
Wenn ich die IP-Adresse nun zur Laufzeit ändere (z. B. über CfgSetIPAddr()), stimmt die IP-Adresse nicht mehr mit dem Zertifikat überein.
Versuche ich anschließend, eine Online-Verbindung aufzubauen, erhalte ich den Fehler:
11017 – Fehler bei der Server-Zertifikat-Validierung: IP-Adresse oder Hostname im Server-Zertifikat nicht gefunden Link zur BR-Hilfe
Die Verbindung lässt sich danach nicht mehr herstellen.
Frage:
Hat jemand eine Lösung für dieses Problem?
Gibt es in AS6 eine Möglichkeit, die IP-Adresse im Zertifikat dynamisch anzupassen oder die Validierung zu umgehen (z. B. über eine Konfiguration)?
Oder muss das Zertifikat manuell neu erstellt werden, sobald sich die IP ändert?
Zusätzliches Problem: Trusted Certificates
Sobald ich in der SSL/TLS-Konfiguration (siehe Screenshot) ein Trusted Certificate hinterlege, kann ich mich nicht mehr mit der Steuerung verbinden – selbst wenn ich das gleiche Zertifikat in den Secure Configuration-Einstellungen der Online Settings verwende.
even if I have no idea right now (I’m out of office), I’m pretty sure that the changed IP address behavior has a Cyber Security / CRA background.
Because the validation of the IP address and / or the hostname is one part in the security chain to validate that the communication partner is the right one. So I could imagine that ANSL / PVI uses more strict validation algorithms within the ASW 6 versions.
Do you use also a hostname in the PLC, and the hostname is also part of the certificate?
Because from my basic knowledge, if IP addresses are changing, using a hostname instead is the way how it works (in IT environment, e.g. WWW).
I also remember about the usage of wildcards in hostnames (for example to have on certificate for several sub-domains), but I’m not sure right now if and how this works in the AS/AR environment.
I hope someone else here in the Community has some more insight / background info.
thank you for sharing this very important questions!
Unfortunately there is no way to change certificateparameters after creation- as you can imagin, thats because of cyber security reasons.
So it is neccessary to create a new certificate.
If the new connectionparameters are known before creation, you can enter all possible IP Adresses and Hostnames into SAN Parameter (Subject Alternative Name)
As @alexander.hefner mentoined the usage of a hostname could help here
Regarding your Issue with “Trusted certificates”
In Documentation (see TLS/SSL configurations) you can find the Information, that Trusted CAs (“Certificate Authority”) can be specified as “Trusted Certificate”.
This means, you need a chain of trust here to make this work
For testpurpose we started to create a guide for internal usage, how to create a simple chain of trust with “X - Certificate and Key management” (see X - Certificate and Key management). To share it here, we have to hide some sensitive information. As soon as we are so far, we will share it here.
Certificates must be created in PEM format (not DER)
Client certificate must be stored as .pfx in the Windows certificate store
As I mentoined, you need a chain of trust. As you can see in my screenshot of my last post, you have to insert the whole certificate chain including the intermediate certifcate must be add in the SSL configuration in AS
Unfortunately this Information is currently not available in AS Help. So we asked B&R to insert this important Information.
@alexander.hefner: yes, we discussed the usage - however, we are currently not deploying any DNS servers on our machines. @wagner2a: thanks for your very helpful information and ideas.
→ Great. I will test it
I’m curious to see if anyone else has had any experiences with ANSLS in AS6!
reagarding your first Question (Certificate Handling when Enduser can change the IP-Address) there is already an Thread from 2024, which goes in same direction: MappView Client: SSL certificate for https connection
