4. Signing ABT Site certificates for Desigo CC

Additional information on the certificate process is available in the Desigo CC help. Search for OpenSSL to get the corresponding information.

 

1. Download Win64 OpenSSL

2. Generate certificate signing request

  1. On your management station, run the Command Prompt as an administrator, go to the installed OpenSSL directory, C:\program files\OpenSSL-win64\bin, and enter the following command:

    openssl req –new –newkey rsa:2048 –nodes –keyout server.key –out server.csr

    When prompted, complete the fields for your certificate, for example,
    Country: CH
    State: Zug
    Location: Zug
    Organization: Siemens
    Organization unit: SI
    Common name: CCServer
    Email: (empty)
    Challenge password: Do not enter a challenge password.
    Optional company name: (empty)

  2. A server.csr and server.key files are created, which you can use in ABT or provide to a third party to sign.
    Notice:     Server.key contains the private key, is security-critical, and needs to be kept private. It should never leave the computer where Desigo CC is running. Whoever has access to that key file can impersonate Desigo CC and compromise the BACnet/SC traffic!
  3. Copy the files server.csr to the ABT Site computer, for example, C:\CC_Cert.
info

In a larger project, for example, a certificate may be required for each Desigo CC port. A naming convention allows a clear distinction between the individual certificates, for example, Siemens_DesigoCC_[client_driver?_port?]
Refer to the chapter How many Desigo CC certificates are needed?

 

 

3. Export root certificate for BACnet/SC in ABT Site

  1. Launch ABT Site.
  2. Go to Building.
  3. Open the Certificates management task.
    Certificates management
  4. Select the BACnet/SC tab.
  5. Click Export root certificate (/SC).
  6. Click OK.
  7. A [ABT_project_name_current_date].crt file is created.
  8. Copy the created *.crt file in the directory C:\CC_Cert.

 

4. Sign the Desigo CC certificate signing request

  1. Go to Settings.
  2. Open the Root certificates task.
  3. Select the BACnet/SC certificates tab.
  4. Click Sign external CSR.
  5. Select the Desigo CC certificate signing request file server.csr and click Open.
  6. The Sign external CSR dialog box opens. The added file information from the OpenSSL step displays.
  7. Click Yes.
  8. The certificate requests from Desigo CC are now signed.
  9. A new server.p12 file is created in the folder C:\CC_Cert.
  10. A log entry is written in Settings > Root certificates > External CSR signing activities.
  11. Copy the files *.cet, *.cer, *.csr, *.p12 to the Desigo CC computer into the folder C:\program files\OpenSSL-win64\bin.

 

5. Validate the certificate in Desigo CC

To validate the certificate on the Desigo CC computer and to create a server.pfx file, do the following:

  1. Go to the OpenSSL directory and enter the following command to generate a server.pfx file from the server.cer and server.key.

    openssl pkcs12 –export –in server.cer –inkey server.key –out server.pfx
  2. Click <Enter>.
  3. Enter a password.
    Note: This password is used when the certificate on the Desigo CC computer is imported and when the driver port is created.
  4. Verify the password.
  5. Click <Enter>.
  6. The server.pfx file is ready to use.

 

6. Import the BACnet/SC root certificate into the Desigo CC computer

  1. In Windows Search, enter Manage computer certificates (not manage user certificates), and run the application.
  2. The Microsoft Management Console Certificates dialog box displays.
  3. In the Certificates tree, right-click Trusted Root Certification Authorities, and select All Tasks > Import.
  4. The Welcome to the Certificate Import Wizard dialog box displays.

  5. Click Next.
  6. The File to Import dialog box displays.
  7. Click Browse and select the root (CA) [ABT_project_name_current_date].crt certificate from ABT Site.
  8. Click Open, and then click Next.
  9. The Certificate Store dialog displays.

  10. Accept the default store location and click Next.
  11. Click Finish, and then click OK.
  12. The root certificate [ABT_project_name_current_date] is available in the folder Trusted Root Certification Authorities > Certificates.

7. Import the BACnet/SC client certificate into the Desigo CC computer

  1. In Windows Search, enter Manage computer certificates (not manage user certificates), and run the application.
  2. The Microsoft Management Console Certificates dialog box displays.
  3. In the Certificates tree, right-click Personal, and select All Tasks > Import.
  4. The Welcome to the Certificate Import Wizard dialog box displays.
  5. Click Next.
  6. The File to Import dialog box displays.
  7. Click Browse and select a host certificate (file type server.pfx).

  8. Click Open, and then click Next.
  9. The Private key protection dialog displays.

  10. Do the following:
    • Enter the password for this certificate.
    • Select Mark this key as exportable, and then click Next.
      Note: Do not enable strong private key protection. If your security policy automatically enables it, you must modify the Windows service that runs the Desigo CC services to run in a user account with administrative rights or privileges.
  11. The Certificate Store dialog box displays.
  12. Accept the default store, and then click Next.
  13. The Completing the Certificate Import Wizard dialog box displays.
  14. Click Finish, and then click OK.
  15. The two certificates you imported are ready to be used when you configure the BT BACnet Stack.
  16. In the OpenSSL directory, delete or secure the server.key.