Requesting Certificates

In production environments, creating an intermediate CA for signing UA certificates might be preferable due to security considerations. See here for more details.

To get a signed certificate from the Certificate Authority (CA), the Requesting Party has to send a Certificate Signing Request (CSR) to the CA. This includes the the public key for the Requesting Party so a private key is required for creating this CSR.

Generating the Private Key for the Requesting Party

To create the private key (called TheRequestingParty.key.pem) execute the following command:

PS> openssl genrsa `
        -aes256 `
        -out requesting-party/private/TheRequestingParty.key.pem `
        2048
Details

In this command …​

  • -aes256 encrypt the generated private key with 256 bit AES encryption

  • -out defines the output filename for the private key as 'TheRequestingParty.key.pem' in the 'private' folder of the CA envivronment.

  • 2048 sets the length of the key to 2048 bits

For further options of the 'genrsa' command see the OpenSSL documentation.

This starts the following dialog.
In the dialog, enter a secret password for the key of the Requesting Party instead of the '<requester key pass phrase>':

Enter PEM pass phrase: <requester key pass phrase>
Verifying - Enter PEM pass phrase: <requester key pass phrase>

Creating a Certificate Signing Request (CSR)

A CSR is a digital request to the CA to create a digital document (the certificate) that attests the identity of the Requesting party as well as its ownership of its public key, which is included in the certificate so that it can be used for encrypted communication with the Requesting Party.

When requesting a certificate from a third-party Certificate Authority (CA), the CSR needs to specify all the extensions which the certificate should include, so that the CA knows what to include in the granted certificate.

When you are going to act as your own CA, there is no need for you, as the Requesting Party, to communicate the extension which the certificate should include to the Certificate Authority (i.e. yourself).
In this case the CSR only has to include the Requesting Party’s public key and the Distinguished Name.

To create a minimal Certificate Signing Request for the new private key, execute the following 'openssl req' command line:

PS> openssl req `
        -new `
        -sha256 `
        -config requesting-party/request.cnf `
        -key requesting-party/private/TheRequestingParty.key.pem `
        -out requesting-party/csr/TheCertificateRequest.pem
Details

In this command …​

  • -new - triggers the generation of a new Certificate Signing Request where the user will be prompted for field values. The fields which are specified in the configuration file and extensions will be used as default values.

  • -sha256 - specifies the digest type of the signature to be a 256 bit SHA-2 encrypted hash;
    To see a list of all available options execute

    PS> openssl dgst -list

  • -config - specifies the OpenSSL configuration file; in this example the [ua_app_inst_client_cert] extension is used

    Click here to review the [ua_app_inst_client_cert] extension section

    The [ua_app_inst_client_cert] Extension Section

    [ ua_app_inst_client_cert ]
# Extensions for UA client certificates; see https://www.openssl.org/docs/manmaster/man5/x509v3_config.html
basicConstraints = CA:FALSE
nsCertType = client
nsComment = "OpenSSL Generated Client Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment
extendedKeyUsage = clientAuth
subjectAltName = @alt_names_client (1)

[alt_names_client]
URI=urn:<domainname>:RequestingPartyCompany:<application Name> (2) (3)
DNS.1=<hostname> (4)
DNS.2=<fully qualified domain name> (5)
DNS.3=localhost
    1 for the client, use the options defined in the [alt_names_client] group below instead of a single subjectAltName
    2 Replace 'RequestingPartyCompany' with your company name
    3 specify the application URI for clients
    Click here to show/hide more information

    The application URI is a globally unique identifier for the instance of the application. For clients like AspenTech Inmation DataSources it’s following this scheme:

    urn:<Domain Names>:<Organization Name>:<Application Name>

    The value of the 'URI' option in the certificate’s subjectAltName extension of the OpenSSL configuration file and the application URI configured on the client (e.g. another Node) need to match.

    For OPC UA DataSources the Domain Names, Organization Name, and Application Name are fetched from the same-named properties in the Own Certificate Details property compound of the Node object to which the Datasource object belongs.

    Property Description

    Application Name

    This is a read-only property which defaults to 'AspenTech Inmation OT DataFabric'.

    Organization Name

    This should be the name of the organization running the datasource. Can be empty.

    Domain Names

    A list of domain names.
    If empty, a reverse domain name look-up is attempted using the 127.0.0.1 IP address.
    If the look-up fails, the computer host name is used.
    If the list is not empty, all entries are used in the application URI.

    It is recommended to use only a single domain name entry in the Domain Names property to avoid varying results for the reverse domain name look-up.

    With the property values shown in the screenshot, the OPC UA application URI used by the UA Datasource object is

    urn:MYHOST:MYCOMPANY:AspenTech Inmation OT DataFabric`
    4 replace with the actual name of the machine on which application/service is running
    5 replace with actual fully qualified domain name

  • -key - specifies the private key file created in the previous step. The corresponding public key is included in the CSR to be certified with the certificate.

  • -out - sets the path/filename for the generated Certificate Signing Request;

For further options of the 'req' command see the OpenSSL documentation.

For the aforementioned Distinguished Name the following dialog will be displayed.
Please enter your company’s information for the requesting party, replacing the '<examples>' with your actual data:

Enter pass phrase for private/TheRequestingParty.key.pem: <requester key pass phrase> (1)
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) []: <DE>
State or Province Name []: <NRW>
Locality Name []: <Cologne>
Organization Name []: <TheRequestingCompany>
Organizational Unit Name () []: <Requester>
Common Name []: <TheCompany.com>
Email Address []: <requester@thecompany.com>
1 This refers to the pass phrase specified when Generating the Private Key for the Requesting Party.

Reviewing the CSR

The following command can be used to review the newly generated CSR:

PS> openssl req `
                -text `
                -noout `
                -verify `
                -in requesting-party/csr/TheCertificateRequest.pem
Details

In this command …​

  • -text - prints out the certificate request in text form.

  • -noout - prevents output of the encoded version of the certificate request.

  • -verify - verifies the self-signature on the request.

  • -in - specifies the path/filename of the CSR that is to be verified

For further options of the 'req' command see the OpenSSL documentation.

The CSR should similar to the one below, the Subject line containing the information you entered in the previous dialog.

Certificate request self-signature verify OK
Certificate Request:
    Data:
        Version: 1 (0x0)
        Subject: C=DE, ST=NRW, L=Cologne, O=TheRequestingCompany, OU=Requester, CN=TheCompany.com, emailAddress=requester@thecompany.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:d9:05:a2:d7:e3:bb:0e:bd:26:f5:60:49:5d:a0:
                    93:03:e8:5b:9d:0d:e4:8b:d3:03:15:7d:50:4c:6f:
                    13:f3:83:76:d6:43:01:ac:8d:dc:b0:2d:fe:40:ae:
                    e7:f9:0c:03:5a:72:24:b5:e9:d7:7b:76:eb:6f:c6:
                    81:34:d0:56:a8:6a:d1:da:17:65:59:1f:9e:d6:6e:
                    d7:d0:60:9b:c3:2e:da:fc:05:98:9a:27:17:4c:6b:
                    74:5c:aa:69:1f:fe:73:15:c4:12:bc:ff:0e:75:42:
                    c8:96:bf:84:72:36:3a:95:02:b4:bb:e3:24:ae:e8:
                    82:4a:c9:8e:02:e7:bb:36:0b:c4:01:7d:de:ab:56:
                    a8:cf:f3:e9:89:3e:62:07:dc:29:5e:e3:ed:3f:fd:
                    0a:d5:cf:4c:9c:d3:bd:26:d7:0e:92:11:84:0e:92:
                    ab:91:eb:d1:23:24:70:a6:ee:2b:2b:e3:56:5c:92:
                    2a:96:26:dd:37:59:ed:06:f4:d3:fd:5d:cc:91:62:
                    33:ba:2c:1a:7c:0b:e2:9e:64:61:f7:cf:d7:8a:7c:
                    9c:5f:e3:0d:93:73:c1:f9:11:f6:d3:69:6e:79:c9:
                    23:35:6c:03:21:f9:b1:85:a1:b6:fc:d5:ae:ce:09:
                    f4:40:50:e7:31:f6:a1:ca:d0:61:11:02:31:4c:57:
                    ad:b7
                Exponent: 65537 (0x10001)
        Attributes:
            (none)
            Requested Extensions:
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        43:10:80:cd:4b:aa:bb:8c:94:05:24:a1:cc:b3:db:fe:19:45:
        cd:73:a4:65:3c:bc:bf:48:72:1f:8b:08:b8:a2:32:db:ef:21:
        28:d3:f8:9b:cf:e1:29:a5:a8:d7:b9:79:71:72:1e:11:ce:6c:
        c9:72:d3:aa:ad:2a:c4:fc:cc:ba:62:79:3a:fc:a1:66:d2:96:
        1e:3e:a7:f9:65:20:1e:df:11:5a:bf:40:10:dd:3e:17:c3:54:
        75:b3:7c:61:8b:d8:3c:db:a2:99:46:3b:fd:f7:9f:77:82:8d:
        e3:20:65:da:89:73:d2:32:1e:64:86:63:26:f7:75:d6:62:12:
        d7:36:87:b9:34:65:46:22:17:b5:d8:f5:12:b3:f8:f2:2d:61:
        4d:da:e2:2a:27:64:e9:58:67:ec:7e:c5:1a:01:82:4c:58:3a:
        45:17:a3:45:34:7f:4b:cb:f6:17:a1:2c:5b:73:15:06:f6:6e:
        d3:fa:83:91:94:40:00:02:9e:bf:6a:60:85:15:7c:13:79:35:
        63:80:1a:7d:c2:0d:62:cd:c8:76:7b:dc:30:7b:43:54:bd:88:
        e3:ac:6b:9a:69:12:42:96:d9:0d:2f:42:83:21:a3:87:b6:0e:
        98:2e:ad:a1:61:4f:c5:40:5f:45:09:9a:a4:01:66:32:6e:77:
        ba:44:09:e9

Transferring the CSR to the Certificate Authority

If you would request a certificate from a third-party CA, the newly generated CSR would now be sent to this CA.
Since we are acting as our own CA in this example, we can simply copy the the CSR into our CA folder:

PS>  Copy-Item -Path ".\requesting-party\csr\TheCertificateRequest.pem" -Destination ".\certificate-authority\csr\"

Continue Reading

Now that you created the CSR as the Requesting Party, you can become the Certificate Authority and create a signed certificate for this CSR. How this is done, is addressed on the Signing Certificates page.