Working with IEEE 802.1X certificates

There are 6 scenarios that require renewing operational certificates. Follow the procedure for renewing operational certificates for any of the cases listed below.

• Operational certificate is expired.
• Root certificate is expired or must be renewed by a IT request.
• Routine periodic renewal of the operational certificate.
• Changes in the PKI settings of a project.
• Device name, ID or IP address has changed.
• Operational certificate has been compromised.

IEEE 802.1X certificates are only supported as of device version V1.6 (check the device version in the Details pane > System folder > Device version).

IEEE 802.1X certificates must be applied in different ways depending on customer requirements. Each of the scenarios has its advantages/disadvantages in terms of trustworthiness or effort involved in certifying the certificates.

⁽¹⁾ Less does not mean that connections with this type of certification are unsafe. There are customers who have their own certification authority and therefore do not trust this ABT Site as a certification authority.

⁽²⁾ The customer's IT department must be involved and available to sign certificates.

IEEE 802.1X certificates with ABT Site as root CA (internal certificates)

ABT Site creates an individual device certificate for each device, signed by the internal ABT Site project root certificate. The project root certificate must be exported to the customer’s IT department, and deemed trustworthy by the authentication server.

IEEE 802.1X certificates with external CA

ABT Site creates an individual device certificate signing request for each device. It must be signed by some external CA and deemed trustworthy by the authentication server. Signed certificates are imported back into ABT Site, and loaded to each device afterwards.

This solution has higher engineering effort, but may be deemed more trustworthy by a customer’s IT department.

IEEE 802.1X certificates with external CA and ABT Site as Intermediate CA

ABT Site exports a certificate signing request for its project root signing key. it must be signed by an external CA and deemed trustworthy by the authentication server. The signed certificate is imported back to ABT Site. ABT Site creates an individual device certificate for each device, signed with its project key. That project signing certificate is now no longer a trusted root, but part of a longer trust chain.

You can transition from ABT Site as CA to an intermediate solution with an external CA at a later date as needed. The ABT Site root certificate then trusts the external signed certificate to complete the trust chain. Devices need not be reloaded in this case.