Hi, since we’ll face the same issue, i did some tests generating certificates at runtime. Two FBs from ArCert will do the basics. First delete the default certificate with ArCertDeleteOwn and after that create a new one with ArCertGenerateX (Important: name of certificate and key have to be the same as the default certificate and must be specified with the file extension (e.g. CertName.cer & KeyName.key), otherwise the TLS-configuration will not be able to refer to the new certificate).
Optional you can export the new certificate with FBs from ArCert (ArCertExportOwn) and FileIO (FileCreate → FileOpen → FileWrite (point to exported data from ArCertExportOwn) → FileClose). I exported the new certificate to the CF and copied it to my device via FTP.
After all that being done, you can change the IP-address of the plc and/or do a warmstart (default settings will be vaild until you do a warmstart) and finally install & configure the new certificate in AS, PVI or whereever.
BR
Thomas