Dynamic Runtime Certificate Generation and Replacement Using ArCert

Share Info & Ideas How-To & Wikis
1

Introduction

This article describes how to generate a certificate at runtime and replace the default certificate using ArCert function blocks.

Runtime Certificate Generation

Delete Default Certificate

First, delete the default certificate using:

  • ArCertDeleteOwn

Generate New Certificate

After deleting the default certificate, generate a new one using:

  • ArCertGenerateX

Important:

  • The certificate name and key name must be the same as the default certificate
  • The names must include the file extension, for example:
    • CertName.cer
    • KeyName.key

Otherwise, the TLS configuration will not be able to refer to the new certificate.

Optional: Export Certificate

Export Process

The new certificate can be exported using:

  • ArCertExportOwn

Then use FileIO function blocks to write the exported data:

  • FileCreate
  • FileOpen
  • FileWrite (point to exported data from ArCertExportOwn)
  • FileClose

Storage and Transfer

  • The certificate can be exported to CF
  • It can then be copied to the device via FTP

Final Steps

After completing the steps:

  • Change the IP address of the PLC and/or perform a warmstart

Note:

  • Default settings remain valid until a warmstart is executed

Usage

After that, install and configure the new certificate in:

  • Automation Studio (AS)
  • PVI
  • or wherever required

Created based on solution provided by @Thomas.Haindl here Automation Studio 6: Encrypted ANSL Communication with TLS → ANSLS – Problems with Dynamic IP Change and Trusted Certificates - #12 by Thomas.Haindl

1 Like
Automation Studio 6: Encrypted ANSL Communication with TLS → ANSLS – Problems with Dynamic IP Change and Trusted Certificates