How to configure a secure connection between mappView server and mappView client

[kovarj (Jaroslav Kovar)]

Introduction

• The aim of this how-to is not to cover theory of secured communication
• it is how to example of a configuration in Automation studio project running in real PLC and in chrome browser

Source of information:
mappView server: B&R Online Help
certificates and SSL B&R Online Help

1. certificate creation
Ethernet IP address and hostname configuration

Go to the configuration view and navigate to “Access and Security"→"Certificate Store"→"Own certificates”. Double click “New OPC UA certificate”

In the new window enter your information. Make sure that you set the expiring date far enough into the future so that you don’t have to renew the certificate within the machine lifespan. It is important to add the IP address of the PLC. Certificates without a specific domain name or IP address can be imported but will create the error message ERR_CERT_COMMON_NAME_INVALID.

Add a SSL configuration and select the certificate and key file created before.

Check/set time on PLC (time and date on client, server and in certificate must match)

2. certificate import on local PC
To avoid warning that connection is not private, you have to install your certificate on local PC

To add certificates to the Trusted Root Certification Authorities store for a local computer. Just go to folder with certificate, double click on it for installation.

Make sure to close the browser and reopen it!

3. mappView server configuration
Open the mappView configuration, change the Protocol to HTTPS

and select the SSL Configuration.

4. test with browser
Url in my test is https://192.168.0.1:443 or https://192.168.0.1/

[kovarj (Jaroslav Kovar)]

Additional info to this topic:

Question:

Is it possible to configure the mappView server to validate the communication partner (mappView client) using a client certificate?

Answer:

• “Trusted certificates” is not evaluated by the mapp View server … so in general this is currently not possible at all!

Please notice here:

The mapp View server has usually a certificate – and the client has (hopefully) the possibility to validate the certificate … if the client does not have this possibility, the client (=browser) will usually ask the user, if he wants to trust this certificate.

In the scenario the customer wants to have, this “validation” would need to work in both direction, meaning also the client would need to have a certificate and the server would need to check it. Technically this is possible, but rather uncommon.

As this is rather uncommon, this was never implemented on the mapp View server side.

Jaroslav