Configuration Files

The OpenSSL commands used on the following pages build upon the configuration files below.

A number of the options specified in these files can be overridden by specific parameters for the openssl commands. If they are not specifically set for the individual command, the missing values are taken from the configuration file specified in the command line.

To prepare for the next pages, …

save The CA Configuration File as D:/certificate-environment/certificate-authority/ca.cnf,
save The Request Configuration File as D:/certificate-environment/requesting-party/request.cnf,
save The OPC UA Extensions File as D:/certificate-environment/certificate-authority/ua_app_ext.cnf,

and then edit the files according to the explanations given below each of the listings.

The CA Configuration File

The file shown below provides the openssl configuration for the Certificate Authority. Save this as as D:/certificate-environment/certificate-authority/ca.cnf and edit the marked items according to the explanations provided below.

The options in the configuration file are documented in the CONFIGURATION FILE OPTIONS section of OpenSSL Documentation on the 'ca' command (scroll down).

# OpenSSL root CA configuration file

[ ca ]
# see https://www.openssl.org/docs/manmaster/man1/openssl-ca.html

default_ca = CA_DEFAULT

[ CA_DEFAULT ]
# Directory and file locations.
dir               = d:/certificate-environment/certificate-authority (1)
certs             = $dir/certs
crl_dir           = $dir/crl
new_certs_dir     = $dir/newcerts
database          = $dir/index.txt
serial            = $dir/serial
RANDFILE          = $dir/private/.rand

# The root key and root certificate.
private_key       = $dir/private/TheCertificateAuthority.key.pem (2)
certificate       = $dir/certs/TheCertificateAuthority.cert.pem (2)

# For certificate revocation lists.
crlnumber         = $dir/crlnumber
crl               = $dir/crl/ca.crl.pem
crl_extensions    = crl_ext
default_crl_days  = 30

# SHA-1 is deprecated, so use SHA-2 instead.
default_md        = sha256

name_opt          = ca_default
cert_opt          = ca_default
default_days      = 375
preserve          = no
# use policy_strict in real world use cases, with an intermediate CA
policy            = policy_loose (3)

[ policy_strict ]
# The root CA should only sign intermediate certificates that match.
# See the POLICY FORMAT section of https://www.openssl.org/docs/manmaster/man1/openssl-ca.html
countryName             = match
stateOrProvinceName     = match
organizationName        = match
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ policy_loose ]
# Allow the intermediate CA to sign a more diverse range of certificates.
# See the POLICY FORMAT section of https://www.openssl.org/docs/manmaster/man1/openssl-ca.html
countryName             = optional
stateOrProvinceName     = optional
localityName            = optional
organizationName        = optional
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ req ]
# Options for the `req` tool (`man req`).
default_bits        = 2048
distinguished_name  = req_distinguished_name
string_mask         = utf8only

# SHA-1 is deprecated, so use SHA-2 instead.
default_md          = sha256

# Extension to add when the -x509 option is used.
x509_extensions     = v3_ca

[ req_distinguished_name ]
# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
countryName                     = Country Name (2 letter code)
stateOrProvinceName             = State or Province Name
localityName                    = Locality Name
0.organizationName              = Organization Name
organizationalUnitName          = Organizational Unit Name
commonName                      = Common Name
emailAddress                    = Email Address

# Optionally, specify some defaults.
countryName_default             = (4)
stateOrProvinceName_default     = (4)
localityName_default            = (4)
0.organizationName_default      = (4)
organizationalUnitName_default  = (4)
emailAddress_default            = (4)

[ v3_ca ]
# Extensions for a typical CA; see https://www.openssl.org/docs/manmaster/man5/x509v3_config.html
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

[ v3_intermediate_ca ]
# Extensions for a typical intermediate CA; see https://www.openssl.org/docs/manmaster/man5/x509v3_config.html
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true, pathlen:0
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

[ crl_ext ]
# Extension for CRLs ; see https://www.openssl.org/docs/manmaster/man5/x509v3_config.html
authorityKeyIdentifier=keyid:always

[ ocsp ]
# Extension for OCSP signing certificates; see https://www.openssl.org/docs/man1.0.2/man1/ocsp.html
basicConstraints = CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
keyUsage = critical, digitalSignature
extendedKeyUsage = critical, OCSPSigning

1	set the actual base path of your CA environment folder
2	replace TheCertificateAuthority with the name of the party issuing the certificate
3	The applied validation policy. Set this to policy_strict for a production environment
4	The values defined here will be used as the default values when creating the CA Root Certificate.

The Request Configuration File

The file displayed below provides a basic openssl configuration for the Requesting Party. Save it as D:/certificate-environment/requesting-party/request.cnf and edit the marked items according to the explanations provided below.

# OpenSSL configuration file for the Requesting Party.

[ req ]
# Options for the `req` tool (`man req`).
default_bits        = 2048
distinguished_name  = req_distinguished_name
string_mask         = utf8only

# SHA-1 is deprecated, so use SHA-2 instead.
default_md          = sha256

[ req_distinguished_name ]
# See https://en.wikipedia.org/wiki/Certificate_signing_request
countryName                     = Country Name (2 letter code)
stateOrProvinceName             = State or Province Name
localityName                    = Locality Name
0.organizationName              = Organization Name
organizationalUnitName          = Organizational Unit Name
commonName                      = Common Name
emailAddress                    = Email Address

# Optionally, specify some defaults.
countryName_default             = (1)
stateOrProvinceName_default     = (1)
localityName_default            = (1)
0.organizationName_default      = (1)
organizationalUnitName_default  = (1)
emailAddress_default            = (1)

1	The values defined here will be used as the default values in the dialog when creating a Certificate Signing Request as the Requesting Party.

The OPC UA Extensions File

The file below configures the extensions which are required by certificates for OPC UA communication. According to the OPC UA specifications certificates need to be of the X.509 standard.

Save this file as D:/certificate-environment/certificate-authority/ua_app_ext.cnf and edit the marked items according to the explanations provided below.

[ ua_app_inst_client_cert ]
# Extensions for UA client certificates; see https://www.openssl.org/docs/manmaster/man5/x509v3_config.html
basicConstraints = CA:FALSE
nsCertType = client
nsComment = "OpenSSL Generated Client Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment
extendedKeyUsage = clientAuth
subjectAltName = @alt_names_client (1)

[alt_names_client]
URI=urn:<domainname>:RequestingPartyCompany:<application Name> (2) (3)
DNS.1=<hostname> (4)
DNS.2=<fully qualified domain name> (5)
DNS.3=localhost

[ ua_app_inst_server_cert ]
# Extensions for server certificates; see https://www.openssl.org/docs/manmaster/man5/x509v3_config.html
basicConstraints = CA:FALSE
nsCertType = server
nsComment = "OpenSSL Generated Server Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer:always
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names_server  (6)

[alt_names_server]
URI=urn:uuid:<component-guid> (7)
DNS.1=<hostname> (4)
DNS.2=<fully qualified domain name> (5)
DNS.3=localhost

1 for the client, use the options defined in the [alt_names_client] group below instead of a single subjectAltName

2 Replace 'RequestingPartyCompany' with your company name

specify the application URI for clients

Click here to show/hide more information

The application URI is a globally unique identifier for the instance of the application. For clients like AspenTech Inmation DataSources it’s following this scheme:

urn:<Domain Names>:<Organization Name>:<Application Name>

The value of the 'URI' option in the certificate’s subjectAltName extension of the OpenSSL configuration file and the application URI configured on the client (e.g. another Node) need to match.

For OPC UA DataSources the Domain Names, Organization Name, and Application Name are fetched from the same-named properties in the Own Certificate Details property compound of the Node object to which the Datasource object belongs.

Property Description

Application Name

This is a read-only property which defaults to 'AspenTech Inmation OT DataFabric'.

Organization Name

This should be the name of the organization running the datasource. Can be empty.

Domain Names

A list of domain names.
If empty, a reverse domain name look-up is attempted using the 127.0.0.1 IP address.
If the look-up fails, the computer host name is used.
If the list is not empty, all entries are used in the application URI.

It is recommended to use only a single domain name entry in the Domain Names property to avoid varying results for the reverse domain name look-up.

With the property values shown in the screenshot, the OPC UA application URI used by the UA Datasource object is

urn:MYHOST:MYCOMPANY:AspenTech Inmation OT DataFabric`

4 replace with the actual name of the machine on which application/service is running

5 replace with actual fully qualified domain name

6 for the server, use the options defined in the[alt_names_server] group below instead of a single subjectAltName

specify the application URI for servers

Click here to show/hide more information

Find the GUID for the Server object in the System Config App:
1. Go to the Server Model and select the Server.
2. In the Object Lens, expand the Component Identification.
3. See the Component GUID property for the relevant value.
In the [alt_names_server] section of the openssl.cnf file, replace <component-guid> with the value identified in the previous step.

Continue Reading

With the configuration files prepared you can now become you own Certificate Authority.