Working with BACnet/SC certificates

There are 6 scenarios that require renewing operational certificates. Follow the procedure for renewing operational certificates for any of the cases listed below.

• Operational certificate is expired.
• Root certificate is expired or must be renewed by a request to IT.
• Routine periodic renewal of the operational certificate.
• Changes in the PKI settings of a project.
• Device name, ID or IP address has changed.
• Operational certificate has been compromised.

Working with BACnet/SC root certificates

Working with ABT Site BACnet/SC operational certificates

External BACnet/SC certificates with external CA

ABT Site creates an individual device certificate signing request for each device. It must be signed by some external CA and deemed trustworthy by the authentication server. Signed certificates are imported back into ABT Site, and loaded to each device afterwards.

This solution has higher engineering effort, but may be deemed more trustworthy by a customer’s IT department.

Basis workflow for intermediate BACnet/SC certificates with external CA

ABT Site exports a certificate signing request for its project root signing key. It must be signed by an external CA and deemed trustworthy by the authentication server. The signed certificate is imported back to ABT Site. ABT Site creates an individual device certificate for each device, signed with its project key. That project signing certificate is now no longer a trusted root, but part of a longer trust chain.

You can transition from ABT Site as CA to an intermediate solution with an external CA at a later date as needed. The ABT Site root certificate then trusts the external signed certificate to complete the trust chain. Devices need not be reloaded in this case.