Dear Sir, One of Customer is using KEPserver for Communication with AXCF2152. He has given exported file with (.der) from KEPServer , which I am unable to Import Also I shared certificate from AXCF2152 to customer , Which Customer is not able to Import Agenda is to use .der certificate from KEPserver in to AXCF2152. Can you please guide for the same info :Customer is having multiple PLC’s , Some are AXCF2151 and Some S7 1500 PLC , with Siemens S7 1500 PLC he able to do so .
Hello Martin,
Thanks for Solution,
But By this way Customer already getting data from AXC2152 to Kep Server but as he has to trust our certificates to go ahead ,there lies problem to Customer.
Here As I already told there from Siemens , He Has to Import .der certificate from Kep Server needs to be Imported in PLC and then One Certificate from Siemens Controller he exports and Imports Back to Kep server , this they feel secure connection.
Can we do same. So Coming back to question Can we Import .der Certificate from KepServer and Share .der Certificate from PLC to Import back to kep server. Regards Chetan
Hi Chetan, I do not understand the problem. You said that your customer is already getting data from AXC F 2152 to Kep Server, but “he has to trust our certificates to go ahead”. What do you mean by “go ahead”? Using the setup that I described earlier, the connection between the AXC F 2152 and the Kepserver OPC UA Client Driver is already secure. Are you able to give us some screen shots, or perhaps a short video, showing what driver you are using, and where the device certificate must be entered? - Martin
Hi Chetan, I’ve been looking at the Kepserver software a little more. If your customer selects “Yes” in the dialog box below when they first connect to the AXC F 2152: 
… then they really don’t need to do anything else . At that point they are confirming that they trust the PLC that they’ve just connected to. If anyone ever tries to substitute this exact PLC with another one, or if you even change the firmware in the PLC, then the server certificate will be different and Kepserver will complain that the “new” PLC is not one that it trusts. When you select the “View” button in the dialog box above, you will see something like this: 
If this certificate is not installed in the Windows Certificate store, then the “Certificate Status” field will show a message something like this: 
This message doesn’t really matter, but if you want the Certificate Status to say that the certificate is OK, then proceed as follows:
* On the Web Based Management page of the PLC, navigate to the page "Certificate Authentication" -> "Identity Stores". * In the "OPC UA self-signed" section, download the "Certificate". This will save a .crt file to your PC. * On the machine running Kepserver, right-click on the .crt file and select "Install certificate". * Select either the user or the machine depending on how you're running Kepserver - probably "machine" - and click "Next". * Install the certificate in the "Trusted Root Certification Authorities" store on the Kepserver PC. * Click Next, then Finish.Now, when you view the certificate for this PLC in the Kepserver OPC UA Configuration tool, you will see the “OK” message like my one above. Finally: If your customer wants the ultimate in security (and it sounds like they do), then they can replace the self-signed certificate in the PLC with a certificate signed by their own trusted CA. I hope this solves your problem. - Martin.
Hi Chetan,</p>\nHere’s a short video showing how to connect KepServer to a PLC using the OPC UA Client driver.</p>\nDoes this answer your question?</p>\n- Martin.</p>\n
</p>
Hello Dear Martin,
Is it possible you can send me the short video again please, because I don´t see it and I would like to replay those steps with my PLC AXC F 2152.
Thanks so much.
Hi, sorry for the missing attachments - for some reason they got lost during a past upgrade of this forum site.
Unfortunately it’s now quite difficult to share videos through this Forum.
I have copied the my last message from above, and added the missing screen shots.
The connection using the KepWare client was really quite simple - just use the IP address of the PLCnext Control device as the server URL, just like in UaExpert.
If you can describe the problem you’re having with the KepServer client, maybe someone can help.If your customer selects “Yes” in the dialog box below when they first connect to the AXC F 2152:
Snag_e1bf7f0.png
… then they really don’t need to do anything else . At that point they are confirming that they trust the PLC that they’ve just connected to. If anyone ever tries to substitute this exact PLC with another one, or if you even change the firmware in the PLC, then the server certificate will be different and Kepserver will complain that the “new” PLC is not one that it trusts.
When you select the “View” button in the dialog box above, you will see something like this:
Snag_e1d20c1.png
If this certificate is not installed in the Windows Certificate store, then the “Certificate Status” field will show a message something like this:
Snag_e2285db.png
This message doesn’t really matter, but if you want the Certificate Status to say that the certificate is OK, then proceed as follows:* On the Web Based Management page of the PLC, navigate to the page "Certificate Authentication" -> "Identity Stores". * In the "OPC UA self-signed" section, download the "Certificate". This will save a .crt file to your PC. * On the machine running Kepserver, right-click on the .crt file and select "Install certificate". * Select either the user or the machine depending on how you're running Kepserver - probably "machine" \- and click "Next". * Install the certificate in the "Trusted Root Certification Authorities" store on the Kepserver PC. * Click Next, then Finish.Now, when you view the certificate for this PLC in the Kepserver OPC UA Configuration tool, you will see the “OK” message like my one above.