Creating a Custom Certificate

This page provides detailed information on how to create the certificate and the key required for the Custom mode IP.21 Secure Connection.

Creating a Custom Server Certificate and Private Key

The steps on this page build upon the Preparations for the Self-Signed Certificates. As described there, …​

  • set-up the Certificate Environment,

  • copy the CA Configuration File and the Request Configuration File (the OPC UA Extensions File is not relevant in the IP.21 Server context) and

  • become your own Certificate Authority.

Environment

In the PowerShell command line interface, navigate to the root folder of the Certificate Environment (D:\certificate-environment) and execute the following commands to add the structure for certificates for the IP.21 Server service.

PS> New-Item -ItemType "directory" -Path . -Name "ip21-server-service"
PS> cd .\ip21-server-service\
PS> New-Item -ItemType "directory" -Path "certs", "csr", "private"

The Server Extensions File

Save the file below in the Certificate Environment as ip21-server-service/AT-IP21.cnf. This defines the extensions which will be granted with the certificate.

[req_distinguished_name]
countryName = US
stateOrProvinceName = TX
localityName = Houston
organizationName = AspenTech
organizationalUnitName = MES
commonName_max = 64

countryName_default = US
stateOrProvinceName_default = TX
localityName_default = Houston
organizationName_default = AspenTech
organizationalUnitName_default = MES

[ v3_req ]
# Extensions to add to a certificate request
authorityKeyIdentifier=keyid,issuer
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment
subjectAltName = @alt_names
[alt_names]
DNS.1 = <host name in lowercase>
DNS.2 = <HOST NAME IN UPPERCASE>
DNS.3 = <fqdn in lowercase>
DNS.4 = <FQDN IN UPPERCASE>
IP.1 = <the.ip.address.here>

Creating a Private Key for the Certificate Signing Request

Create a private key for requesting the certificate by executing the following command:

PS> openssl genrsa `
        -out ip21-server-service/private/server.key.pem `
        2048

Creating the Certificate Signing Request

To create a Certificate Signing Request with the private key created above, execute this command:

PS>  openssl req `
        -new `
        -sha256 `
        -config requesting-party/request.cnf `
        -key ip21-server-service/private/server.key.pem `
        -out ip21-server-service/csr/server.csr.pem

The dialog below will be displayed. Enter your information instead of the <examples>.

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) []: <DE>
State or Province Name []: <NRW>
Locality Name []: <Cologne>
Organization Name []: <TheCompany>
Organizational Unit Name []: <IT>
Common Name []: <CertificateName>
Email Address []: <it@thecompany.com>

Creating the Server Certificate

To create and sign the certificate which you requested on the previous step, execute the following command:

PS> openssl x509 `
        -req `
        -sha256 `
        -days 10950 `
        -in ip21-server-service/csr/server.csr.pem `
        -extfile ip21-server-service/AT-IP21.cnf `
        -extensions v3_req `
        -CA certificate-authority/certs/TheCertificateAuthority.cert.pem `
        -CAkey certificate-authority/private/TheCertificateAuthority.key.pem `
        -CAcreateserial `
        -out ip21-server-service/certs/server.cert.pem

The following dialog will be displayed, summing up the contents of the CSR and asking for the Certificate pass phrase for the Certificate Authority:

Certificate request self-signature ok
subject=C=DE, ST=NRW, L=Cologne, O=TheCompany, OU=IT, CN=CertificateName, emailAddress=it@thecompany.com
Enter pass phrase for certificate-authority/private/TheCertificateAuthority.key.pem: <The CA pass phrase>

The certificate is now stored as server.cert.pem in ip21-server-service/certs/server.cert.pem of the Certificate Environment (D:\certificate-environment).