Siemens SR640XA User manual

Generating SSH Keys and SSL
Certificates for ROS and ROX
Using Windows
AN22
Application Note
6/2013
Introduction 1
Installing OpenSSL on
Windows 2
Installing the Scripts 3
Using Scripts to Create SSL
Certificates 4
Using the Scripts to Create
SSH Keys for ROS 5
Adding a Root CA Certificate
to the List of Trusted Root
CAs 6
PEM Formatted Certificates
and Keys 7
Generating a Certificate
from a Certificate Request in
Windows 2008 CA 8
Frequently Asked Questions
(FAQs) 9

RUGGEDCOM
Application Note
ii
Copyright © 2013 RuggedCom Inc.
All rights reserved. Dissemination or reproduction of this document, or evaluation and communication of its contents, is not authorized
except where expressly permitted. Violations are liable for damages. All rights reserved, particularly for the purposes of patent application or
trademark registration.
This document contains proprietary information, which is protected by copyright. All rights are reserved. No part of this document may be
photocopied, reproduced or translated to another language without the prior written consent of RuggedCom Inc.
Disclaimer Of Liability
Siemens has verified the contents of this manual against the hardware and/or software described. However, deviations between the product
and the documentation may exist.
Siemens shall not be liable for any errors or omissions contained herein or for consequential damages in connection with the furnishing,
performance, or use of this material.
The information given in this document is reviewed regularly and any necessary corrections will be included in subsequent editions. We
appreciate any suggested improvements. We reserve the right to make technical improvements without notice.
Registered Trademarks
ROX™, Rugged Operating System On Linux™, CrossBow™ and eLAN™ are trademarks of Siemens AG. ROS® is a registered trademark of
Siemens AG.
OpenNMS® is a registered trademark of The OpenNMS Group, Inc.
Microsoft Windows XP and Microsoft Windows 7 are registered trademarks of Microsoft Corporation in the United States and other countries.
Other designations in this manual might be trademarks whose use by third parties for their own purposes would infringe the rights of the
owner.
Security Information
Siemens provides automation and drive products with industrial security functions that support the secure operation of plants or machines.
They are an important component in a holistic industrial security concept. With this in mind, our products undergo continuous development.
We therefore recommend that you keep yourself informed with respect to our product updates. Please find further information and newsletters
on this subject at: http://support.automation.siemens.com.
To ensure the secure operation of a plant or machine it is also necessary to take suitable preventive action (e.g. cell protection concept) and
to integrate the automation and drive components into a state-of-the-art holistic industrial security concept for the entire plant or machine.
Any third-party products that may be in use must also be taken into account. Please find further information at: http://www.siemens.com/
industrialsecurity.
Contacting Siemens
Address
Siemens AG
Industry Sector
300 Applewood Crescent
Concord, Ontario
Canada, L4K 5C7
Telephone
Toll-free: 1 888 264 0006
Tel: [phone]
Fax: [phone]
E-mail
[email protected]
Web
www.RuggedCom.com

RUGGEDCOM
Application Note Table of Contents
iii
Table of Contents
Chapter 1
Introduction .......................................................................................................... 1
Chapter 2
Installing OpenSSL on Windows ......................................................................... 3
Chapter 3
Installing the Scripts ............................................................................................ 5
Chapter 4
Using Scripts to Create SSL Certificates ............................................................ 7
4.1 Scenario 1: The Machine Hosting the Scripts Becomes the Root CA ............................................... 7
4.2 Scenario 2: The CA Resides Elsewhere ........................................................................................ 9
4.3 Scenario 3: Self-Signed Device Certificates ................................................................................. 11
Chapter 5
Using the Scripts to Create SSH Keys for ROS ................................................ 15
Chapter 6
Adding a Root CA Certificate to the List of Trusted Root CAs ........................... 17
Chapter 7
PEM Formatted Certificates and Keys .............................................................. 19
Chapter 8
Generating a Certificate from a Certificate Request in Windows 2008 CA ........ 21
Chapter 9
Frequently Asked Questions (FAQs) ................................................................. 27

Table of Contents
RUGGEDCOM
Application Note
iv

RUGGEDCOM
Application Note
Chapter 1
Introduction
1
Introduction
ROS (beginning with ROS v3.12.1 and onwards) and ROX can accept SSL certificates and SSH keys created
externally. This document, along with some useful scripts developed by Siemens, is intended to help users
working with Microsoft Windows® to generate their own keys and certificates for their ROS and/or ROX devices.
The Microsoft Windows Operating System has a Certificates Management console. However, the nature of key
creation and export is not particularly suitable for ROS/ROX purposes. A separate key and certificate generation
application is required.
There are many free, open source applications, such as OpenSSH and PuTTygen, that can create keys and
certificates. The instructions in this document utilize OpenSSL, a free cryptography toolkit, to generate both SSH
and SSL keys, as well as SSL certificates.
ROS and ROX will accept self-signed certificates or certificates signed by a Certificate Authority (CA). This
document will make the Windows machine a Certificate Authority (CA) and sign certificates.
IMPORTANT!
Normally, the steps involved in creating the private key and creating the Certificate Signing Request
(CSR) are the ones that will be performed if a Certificate Chain of Trust is implemented in the
organization. The CSR files are then submitted to the appropriate department for it to be signed by
a CA. Once the certificate is issued, it is then uploaded to the device in the required format. When
certificates are self-signed, the trust (identity establishment) part of SSL cannot work because each
server is essentially its own CA. For the purpose of security, it is recommended that a proper Chain of
Trust is implemented for SSL.
This document describes:
• How to generate SSL certificates and SSH keys for ROS using Siemens scripts
• How to generate SSL keys and certificates for ROX using Siemens scripts
• How to import certificates on Windows machines so the SSL certificates provided by these devices can be
verified properly

RUGGEDCOM
Application Note
Chapter 1
Introduction
2

RUGGEDCOM
Application Note
Chapter 2
Installing OpenSSL on Windows
3
Installing OpenSSL on Windows
To install OpenSSL on Windows, do the following:
1. Download the OpenSSL Setup program (without sources) for Windows from http://gnuwin32.sourceforge.net/
packages/openssl.htm.
2. Double-click the downloaded file and install OpenSSL. During the installation process, change the installation
directory to C:\OpenSSL\. This is essential for the scripts to generate the certificates and keys properly.

RUGGEDCOM
Application Note
Chapter 2
Installing OpenSSL on Windows
4

RUGGEDCOM
Application Note
Chapter 3
Installing the Scripts
5
Installing the Scripts
To install the scripts, extract the contents of the Zip file (AN22.zip) obtained from Siemens into an appropriate
location on the script machine (the computer/server that hosts the scripts). A folder titled RCKeyGen will be
placed in the chosen location.

RUGGEDCOM
Application Note
Chapter 3
Installing the Scripts
6

RUGGEDCOM
Application Note
Chapter 4
Using Scripts to Create SSL Certificates
Scenario 1: The Machine Hosting the Scripts Becomes
the Root CA 7
Using Scripts to Create SSL
Certificates
The scripts provided by Ruggedcom can be used in three different infrastructure scenarios.
•Section 4.1, “Scenario 1: The Machine Hosting the Scripts Becomes the Root CA”
•Section 4.2, “Scenario 2: The CA Resides Elsewhere”
•Section 4.3, “Scenario 3: Self-Signed Device Certificates”
Section 4.1
Scenario 1: The Machine Hosting the Scripts
Becomes the Root CA
In the first scenario, the machine that hosts the scripts is the Root CA and it directly issues keys and certificates
for the ROS and ROX devices. In this case the certificate requests generated for each device will be signed by
the Root CA, which is also generated on the same machine hosting the scripts.
NOTE
The Root CA’s certificate and private key will also be created and need to be protected after issuing the
certificates.

Chapter 4
Using Scripts to Create SSL Certificates
RUGGEDCOM
Application Note
8
Scenario 1: The Machine Hosting the Scripts Becomes
the Root CA
1
32
Figure 1: Scenario 1
1. Root Certificate Authority (CA) 2. Certificate 3. ROS/ROX Devices
1. Navigate to the RCKeyGen folder on the script machine and open the file config.txt in a text editor.
NOTE
Do not use the default parameters provided in the config.txt file. They are provided as an
example only.
2. Make sure CREATE_ROOTCA equals 1.
3. Update the other parameters with relevant values.
4. Save and close the file.
5. Open the file device_data.txt in a text editor and replace the current content with a list of addresses
(one per line) for devices for which certificates are to be generated. The script will take the list of addresses
and use them as the Common Name parameter in the Distinguished name field (i.e. the Subject Identifier in
an X.509 certificate). The script can take both IP addresses and DNS names for the switches. The list must
have some addresses for the script to generate certificates.
NOTE
Setting the Common Name (IP address/DNS address) correctly will make sure browsers do not
complain about the certificate Common Name not matching the URL. The switch will also have
to be accessed using the DNS name or the IP address that was provided in device_data.txt.
Configuring an IP address for the Common Name and then accessing the unit with a DNS name
(or vice versa) will cause the browser to complain.
6. Save and close the file.
NOTE
For Windows XP, scripts should be launched through the command prompt in the same order as
described in this procedure.

RUGGEDCOM
Application Note
Chapter 4
Using Scripts to Create SSL Certificates
Scenario 2: The CA Resides Elsewhere 9
7. Double-click the script 1_ssl_root_CA_certgen.vbs to generate the root certificate.
8. Double-click the script 02_ssl_device_certgen.vbs to generate a certificate for each device listed in
device_data.txt and have them signed by the Root CA. When the script asks if the certificates need to
be self-signed, click No.
9. Double-click the script 03_ssl_formatting.vbs to convert the certificates into PEM format and clean up
any files that were created by the scripts. The finished certificates are available in the SSL_certs folder and
named according to their associated device, as defined in device_data.txt.
10. Upload the created certificates to their respective devices. For more information about uploading the
certificates, refer to the User Guide for the device.
Section 4.2
Scenario 2: The CA Resides Elsewhere
In this scenario, it is assumed that a CA has already been established in the organization, which can be used to
accept certificate requests from the computer that hosts the scripts and signs the certificates for ROS and ROX
devices. In this case, the script will simply generate a key and a corresponding certificate request, which will
then have to be submitted to the CA for a certificate to be issued. Once the certificates have been issued, the
certificate files will have to be copied to the SSL_certs folder (where the keys and the original signing requests
are still present). Once the certificates are placed in the SSL_certs folder, a script needs to be executed to
convert the certificates into PEM format, which is compatible with ROS devices.
NOTE
For examples of PEM formatted certificates and keys, refer to Chapter 7, PEM Formatted Certificates
and Keys.

Chapter 4
Using Scripts to Create SSL Certificates
RUGGEDCOM
Application Note
10 Scenario 2: The CA Resides Elsewhere
1
2
7
34
5
6
Figure 2: Scenario 2
1. Root Certificate Authority (CA) 2. Certificate Authorities (CAs) 3. Certificate 4. Certificate Request 5. Script Machine 6. ROS/
ROX Compatible Certificate 7. ROS/ROX Devices
1. Navigate to the RCKeyGen folder on the script machine and open the file config.txt in a text editor.
NOTE
Do not use the default the parameters provided in the config.txt file. They are provided as an
example only.
2. Make sure CREATE_ROOTCA equals 0.

RUGGEDCOM
Application Note
Chapter 4
Using Scripts to Create SSL Certificates
Scenario 3: Self-Signed Device Certificates 11
3. Update the other parameters with relevant values.
4. Save and close the file.
5. Open the file device_data.txt in a text editor and replace the current content with a list of addresses
(one per line) for devices for which certificates are to be generated. The script will take the list of addresses
and use them as the Common Name parameter in the Distinguished name field (i.e. the Subject Identifier in
an X.509 certificate). The script can take both IP addresses and DNS names for the switches. The list must
have some addresses for the script to generate certificates.
NOTE
Setting the Common Name (IP address/DNS address) correctly will make sure browsers do
not complain about the certificate Common Name not matching the URL. The switch or router
will also have to be accessed using the DNS name or the IP address that was provided in
device_data.txt. Configuring an IP address for the Common Name and then accessing the
unit with a DNS name (or vice versa) will cause the browser to complain.
6. Save and close the file.
NOTE
For Windows XP, scripts should be launched through the command prompt in the same order as
described in this procedure.
7. Double-click the script 02_ssl_device_certgen.vbs to generate a certificate signing request for each
device listed in device_data.txt. When the script asks if the certificates need to be self-signed, click No.
The SSL_certs folder now has both keys and Certificate Signing Requests for the ROS/ROX devices. The
CSRs need to be exported to and signed by the organizational CA.
8. Generate certificates from the Certificate Signing Requests. For more information, refer to Chapter 8,
Generating a Certificate from a Certificate Request in Windows 2008 CA.
9. Copy the certificates issued by the CA to the SSL_certs folder.
10. Double-click the script 03_ssl_formatting.vbs to convert the certificates into PEM format and clean up
any files that were created by the scripts. The finished certificates are available in the SSL_certs folder and
named according to their associated device, as defined in device_data.txt.
11. Upload the certificates to their respective devices. For more information about uploading the certificates,
refer to the User Guide for the device.
Section 4.3
Scenario 3: Self-Signed Device Certificates
In this scenario, each device certificate is signed by itself. If a CA has not been established in the organization
or a Root CA in the host computer is not desirable, perform the following steps to generate self-signed device
certificates that are signed by themselves.
NOTE
It is recommended to get the certificates for each device signed by a trusted Certificate Authority.

Chapter 4
Using Scripts to Create SSL Certificates
RUGGEDCOM
Application Note
12 Scenario 3: Self-Signed Device Certificates
2
1
3
Figure 3: Scenario 3
1. Script Machine 2. Certificate 3. ROS/ROX Devices
1. Navigate to the RCKeyGen folder on the script machine and open the file device_data.txt in a text
editor.
2. Replace the current content with a list of addresses (one per line) for devices for which certificates are to
be generated. The script will take the list of addresses and use them as the Common Name parameter in
the Distinguished name field (i.e. the Subject Identifier in an X.509 certificate). The script can take both IP
addresses and DNS names for the switches. The list must have some addresses for the script to generate
certificates.
NOTE
Setting the Common Name (IP address/DNS address) correctly will make sure browsers do not
complain about the certificate Common Name not matching the URL. The switch will also have
to be accessed using the DNS name or the IP address that was provided in device_data.txt.
Configuring an IP address for the Common Name and then accessing the unit with a DNS name
(or vice versa) will cause the browser to complain.
3. Save and close the file.
NOTE
For Windows XP, scripts should be launched through the command prompt in the same order as
described in this procedure.
4. Double-click the script 02_ssl_device_certgen.vbs to generate a certificate for each device listed in
device_data.txt and have them signed by the Root CA. When the script asks if the certificates need to
be self-signed, click Yes.

RUGGEDCOM
Application Note
Chapter 4
Using Scripts to Create SSL Certificates
Scenario 3: Self-Signed Device Certificates 13
5. Double-click the script 03_ssl_formatting.vbs to convert the certificates into PEM format and clean up
any files that were created by the scripts. The finished certificates are available in the SSL_certs folder and
named according to their associated device, as defined in device_data.txt.
6. Upload the certificates to their respective devices. For more information about uploading the certificates,
refer to the User Guide for the device.

RUGGEDCOM
Application Note
Chapter 4
Using Scripts to Create SSL Certificates
Scenario 3: Self-Signed Device Certificates 14

RUGGEDCOM
Application Note
Chapter 5
Using the Scripts to Create SSH Keys for ROS
15
Using the Scripts to Create SSH
Keys for ROS
The generation of SSH keys is a single step process.
NOTE
For information on how to regenerate SSH keys for ROX, refer to the ROX User Guide for the device.
1. Navigate to the RCKeyGen folder on the script machine and open the file device_data.txt in a text
editor.
2. Replace the current content with a list of addresses (one per line) for devices for which SSH keys are to be
generated. The script can take both IP addresses and DNS names. The list must have some addresses for
the script to generate keys.
3. Save and close the file.
NOTE
For Windows XP, scripts should be launched through the command prompt in the same order as
described in this procedure.
4. Double-click the script 4_ssh_keygen.vbs. The keys are generated and saved in the SSH_keys folder.
5. The keys are now available for upload in the SSH_keys folder.
6. Upload the keys to their respective ROS devices. For more information about uploading the keys, refer to the
latest ROS User Guide for your device.

RUGGEDCOM
Application Note
Chapter 5
Using the Scripts to Create SSH Keys for ROS
16