plc.myforum.ro

on · Junior Joined: 29 Dec 2016 Posts: 19

How do you provide new root certificates for Windows 7 or Windows Server 2008 R2 if the PCs do not have an internet connection?
https://support.industry.siemens.com/cs/document/109748887/

Updating certificate storage on offline systems
SIMATIC applications, components and drivers receive digital signatures to ensure the trustworthiness and authenticity of the applications. Certificates are used for the digital signature and if necessary they are checked when the applications are run. The certificate check therefore supports safe operation of the plant and WinCC system.

If signer certificates (root certificates) cannot be found or are not up to date, an error message might be displayed or the application start is aborted.

Windows Certificate Storage
To check the digital signatures the operating system needs access to a current certificate storage. Normally an internet connection is used for updating the certificate storage.

If your system configuration does not allow direct access to the internet, you have to ensure yourself the completeness and up-to-dateness of the certificate lists in the certificate storage.
This entry gives an example of how to proceed to provide up-to-date certificate lists for offline systems.
Further information and procedures are available in the Microsoft KB 2813430.

Windows Administrator Knowledge
You need in-depth Windows administrator knowledge for the described procedure. In general, no warranty can be given for direct changes in the Registry because this is entirely the responsibility of the user. In any event, you are advised to make a backup of the Registry before undertaking the actions described here.
Microsoft KB 2813430
https://support.microsoft.com/en-us/kb/2813430
Microsoft - Certificates (FAQ)
http://windows.microsoft.com/en-us/windows/certificate-faq
Requirements
You need administrator rights for all the relevant PCs of the configured system.
You need a PC with network share that provides the loaded certificate lists in the network
of the configured system.
This PC is named in the further description "Certificate Server".
You need a PC with access to the internet that loads the certificate lists and stores them in the network share of the certificate server.

Procedure - Example