Certificates

Create Certificate Authority

The Certificate Authority (CA) is responsible for creating and managing the root certificate. This root certificate acts as the trusted authority within the system and is used to sign all subsequently generated certificates. It forms the foundation of the trust chain and ensures that issued certificates are recognized as valid within the environment.

Upon generation, two files are created: the certificate file (ca.crt) and the private key file (ca.key).

The ca.crt file represents the public certificate of the Certificate Authority. This certificate must be installed on all client machines as a Trusted Root Authority to ensure that any certificates signed by this CA are recognized and trusted within the environment.

The ca.key file is the private key associated with the Certificate Authority. This key must remain strictly confidential at all times, as it is used to sign new certificates. If the private key is compromised, unauthorized parties could issue trusted certificates, effectively breaking the security of the entire Public Key Infrastructure (PKI). In such a case, the full PKI would need to be revoked and rebuilt.

For security reasons, private keys generated through this tool are never stored within EnvisionSCADA. It is strongly recommended to use the Certificate Generator only on trusted systems and secure networks.

All generated certificates use a 2048-bit key length and are signed using the SHA-256 hashing algorithm, ensuring compliance with modern security standards.

Installing the CA can be done by clicking on the cert.crt and clicking the install certificate button.

Select Local Machine (administrator rights are required)

Place the certificates in the trusted root certification authorities

Finish

Repeat the same on the client devices or every device that needs access to EnvisionSCADA.

Issue a Certificate

The Certificate Issuance is used to generate individual certificates for specific services or endpoints. These certificates are signed by the Certificate Authority, allowing them to be trusted by clients and systems that recognize the CA. During this process, parameters such as hostname, validity period, and usage can be defined.

In this step, you will be required to use the two files generated during the Certificate Authority (CA) creation process.
These files consist of the CA certificate (ca.crt) and the corresponding private key (ca.key). Together, they are used to sign and issue new certificates for services or endpoints.

Ensure that both files are available and securely stored before proceeding. The integrity and confidentiality of the private key are essential, as it is used to establish trust within the certificate chain.

Upon certificate issuance, a single file is generated: the certificatename.pfx. In environments configured with redundancy, this procedure must be performed on all servers within the setup.

For a redundant node connected to two networks (dual-LAN), enter both of that node's IP addresses in the IP Address and IP Address (LAN 2) fields, so the single certificate is valid on both networks and the redundancy channel keeps working after a failover to the second network.

This file is password-protected and contains both the public certificate and its associated private key. When installed on a system, it allows services such as IIS, proxies, or other secure endpoints to authenticate themselves and enable HTTPS communication.

It is critical that the IP address or DNS name of the machine matches the Common Name (CN) defined in the certificate. If this does not match, clients will reject the certificate as untrusted.

The .pfx file and its password must remain strictly confidential at all times. If this file is compromised, an attacker could potentially brute-force the password and impersonate the system. In such a scenario, the affected machine should be considered untrusted, decommissioned, and replaced with a newly provisioned system using a newly issued certificate.

All generated certificates use a 2048-bit key length and are signed using the SHA-256 hashing algorithm, ensuring compliance with modern security standards.

Installing this certificate can be done by clicking on the certificatename.pfx and needs to be installed on all destination devices.

Select Local Machine

Enter the password that was created earlier.

Place the certificates in the personal store

Finish

Repeat the same on the client devices or every device that needs access to EnvisionSCADA.