Open Source Software Table of Contents
12345678A
Overview
SICAM
Enrollment over Secure Transport (EST) SICAM GridPass
GridPass
Workflow Step-by-Step User Management Certificate Management Managing EST
V1.50
Manual
Other Features Glossary
E50417-H8940-C598-A6
NOTE
For your own safety, observe the warnings and safety instructions contained in this document, if available.
i
- Disclaimer of Liability
- Copyright
Subject to changes and errors. The information given in this document only contains general descriptions and/or performance features which may not always specifically reflect those described, or which may undergo modification in the course of further development of the products. The requested performance features are binding only when they are expressly agreed upon in the concluded contract.
Copyright © Siemens 2018 – 2020. All rights reserved. The disclosure, duplication, distribution and editing of this document, or utilization and communication of the content are not permitted, unless authorized in writing. All rights, including rights created by patent grant or registration of a utility model or a design, are reserved.
Document version: E50417-H8940-C598-A6.01 Edition: 05.2020
Trademarks
SIPROTEC, DIGSI, SIGRA, SIGUARD, SIMEAS SAFIR, SICAM, and MindSphere are trademarks of Siemens. Any unauthorized use is prohibited.
Version of the product described: V1.50
Open Source Software
The product contains, among other things, Open Source Software developed by third parties. The Open Source Software used in the product and the license agreements concerning this software can be found in the Readme_OSS. These Open Source Software files are protected by copyright. Your compliance with those license conditions will entitle you to use the Open Source Software as foreseen in the relevant license. In the event of conflicts between Siemens license conditions and the Open Source Software license conditions, the Open Source Software conditions shall prevail with respect to the Open Source Software portions of the software. The Open Source Software is licensed royalty-free. Insofar as the applicable Open Source Software License Conditions provide for it you can order the source code of the Open Source Software from your Siemens sales contact – against payment of the shipping and handling charges – for a period of at least 3 years after purchase of the product. We are liable for the product including the Open Source Software contained in it pursuant to the license conditions applicable to the product. Any liability for the Open Source Software beyond the program flow intended for the product is explicitly excluded. Furthermore any liability for defects resulting from modifications to the Open Source Software by you or third parties is excluded. We do not provide any technical support for the product if it has been modified.
- SICAM, GridPass, Manual
- 3
E50417-H8940-C598-A6, Edition 05.2020
Table of Contents
Open Source Software..................................................................................................................................3 Overview...................................................................................................................................................... 6
1
1.1 1.2 1.3 1.4
General...............................................................................................................................7 Public Key Infrastructure (PKI)............................................................................................. 7 Certification Authority (CA)................................................................................................. 7 PKI Workflow...................................................................................................................... 8
23
Enrollment over Secure Transport (EST).................................................................................................... 10 2.1 2.2 2.3
Function........................................................................................................................... 11 Authentication..................................................................................................................11 CRL................................................................................................................................... 12
SICAM GridPass...........................................................................................................................................13 3.1 3.2 3.3 3.4
Overview.......................................................................................................................... 14 Workflow.......................................................................................................................... 14 Integration........................................................................................................................15 Operating Overview.......................................................................................................... 16
4
Workflow Step-by-Step...............................................................................................................................18
- 4.1
- Setup................................................................................................................................19
Preconditions.............................................................................................................. 19 Description..................................................................................................................19 Setup.......................................................................................................................... 19 Licensing Description...................................................................................................26 Licensing.....................................................................................................................26
Login Procedure................................................................................................................30
Initial Login................................................................................................................. 30
Create Operational CA.......................................................................................................35 Create a Server Certificate for Web UI and EST Server.........................................................40 Download and Trust the CA Certificate.............................................................................. 45 Set the Created Server Certificate as SICAM GridPass Web-Server Certificate.......................53 Configure Centralized Syslog Logging................................................................................55
4.1.1 4.1.2 4.1.3 4.1.4 4.1.5 4.2 4.2.1 4.3 4.4 4.5 4.6 4.7
5
User Management...................................................................................................................................... 56
- 5.1
- Introduction......................................................................................................................57
Overview.....................................................................................................................57
User Administration.......................................................................................................... 57
Local User Administration............................................................................................ 57 Logout........................................................................................................................ 60
5.1.1 5.2 5.2.1 5.2.2
- 4
- SICAM, GridPass, Manual
E50417-H8940-C598-A6, Edition 05.2020
Table of Contents
- 5.2.3
- Initial Login with a Local Account.................................................................................61
6
Certificate Management.............................................................................................................................63
- 6.1
- Overview of Import, Export, and Creation of Certificates.................................................... 64
Remote Requests.............................................................................................................. 65 Local Requests.................................................................................................................. 66
Create a Certificate...................................................................................................... 66 Import a CSR and Issue a Certificate............................................................................. 70 Import a Certificate with CA Chain............................................................................... 73 Export a Certificate...................................................................................................... 76 Revoke a Certificate..................................................................................................... 78
Certification Authorities.................................................................................................... 79
Create a Root-CA......................................................................................................... 79 Import a Certification Authority....................................................................................79 Export a CA Certificate................................................................................................. 80 Create a CRL Manually................................................................................................. 82 Revoke Certification Authority......................................................................................82
CRL Distribution Point........................................................................................................83 Subject Alternative Name..................................................................................................84
6.2 6.3 6.3.1 6.3.2 6.3.3 6.3.4 6.3.5 6.4 6.4.1 6.4.2 6.4.3 6.4.4 6.4.5 6.5 6.6
7
Managing EST.............................................................................................................................................87
- 7.1
- Introduction......................................................................................................................88
Overview.....................................................................................................................88
EST Administration............................................................................................................88
Managing EST Clients.................................................................................................. 88 Managing EST Server................................................................................................... 89 Managing Remote Requests.........................................................................................90 Certificate Revocation List (CRL)...................................................................................91
7.1.1 7.2 7.2.1 7.2.2 7.2.3 7.2.4
8
Other Features............................................................................................................................................94
- 8.1
- Local User Management....................................................................................................95
Remote User Management................................................................................................97 Certificate Export to an LDAP Directory Service or Microsoft Active Directory.................... 100
Configuration............................................................................................................ 100 Certificate Export to LDAP.......................................................................................... 101
Attribute Certificates....................................................................................................... 106 Auto Logout....................................................................................................................114 Backup and Restore.........................................................................................................114 Signing Server.................................................................................................................119 Logging.......................................................................................................................... 119 Update to a New SICAM GridPass Version........................................................................ 122 Roles and Area of Responsibility according to IEC 62351-8...............................................123
8.2 8.3 8.3.1 8.3.2 8.4 8.5 8.6 8.7 8.8 8.9 8.10
A
Glossary.................................................................................................................................................... 126
- SICAM, GridPass, Manual
- 5
E50417-H8940-C598-A6, Edition 05.2020
- 1
- Overview
1.1 1.2 1.3 1.4
- General
- 7
778
Public Key Infrastructure (PKI) Certification Authority (CA) PKI Workflow
- 6
- SICAM, GridPass, Manual
E50417-H8940-C598-A6, Edition 05.2020
Overview
1.1 General
- 1.1
- General
Enrollment over secure transport, followed shortened as EST, is defined in RFC 7030 and profiles certificate enrollment for clients using Certificate Management over CMS (CMC) messages over a secure transport. This profile describes a simple yet functional certificate management protocol targeting Public Key Infrastructure (PKI) clients that need to acquire client certificates and associated Certification Authority (CA) certificates. Enrollment over Secure Transport (EST) describes the use of Transport Layer Security (TLS) and Hypertext Transfer Protocol (HTTP) to provide an authenticated and authorized channel for simple Public Key Infrastructure (PKI) Requests and Responses. Architecturally, the EST service is located between a Certification Authority (CA) and a client. It performs several functions traditionally allocated to the Registration Authority (RA) role in a PKI. EST specifies how to transfer messages securely via HTTP over TLS (HTTPS), where the HTTP headers and media types are used in conjunction with TLS.
1.2 1.3
Public Key Infrastructure (PKI)
A public key infrastructure (PKI) is a set of roles, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates and manage public-key encryption.
Certification Authority (CA)
Parts of a PKI amongst others are one or more Certification Authorities (CA) which are entities issuing digital certificates. A digital certificate certifies the ownership of a public key by the named subject of the certificate.
Digital Certificate
A digital certificate is a data structure that binds a public key value to a subject. A binding is achieved by a trusted certification authority (CA) verifying the identity of the subject and digitally signing the certificate. The digital certificate has a limited lifetime that is checked by the relying party along with the signature.
[sc_digital_certificate, 2, en_US]
- Figure 1-1
- Digital Certificate
- SICAM, GridPass, Manual
- 7
E50417-H8940-C598-A6, Edition 05.2020
Overview 1.4 PKI Workflow
Registration Authority
A registration authority (RA) verifies the identity of entities requesting digital certificates and sends the certificate signing request to the CA. CA and RA are often co-located.
Certificate Revocation List (CRL)
A certificate revocation list is a list of digital certificates that have been revoked by the issuing certificate authority (CA) before their scheduled expiration date and should no longer be trusted. The CRL distribution point, for example a Web server link, is stored inside the certificate. A CRL has a validity and has to be updated from the CA and downloaded from the entity before getting invalid. Often an interval of 24 hours is used.
[sc_certificate_revocation_list, 2, en_US]
- Figure 1-2
- Certificate Revocation List
- 1.4
- PKI Workflow
In the following figure, the PKI workflow with EST in the Siemens Energy environment is shown. In step (1) the entity creates an asymmetrical key pair to use it later for example as https server certificate. The entity creates a Certificate Signing Request (CSR) including the public key and entity information as well as the intended use of the requested certificate and sends it to the RA/CA (2). The RA/CA signs the CSR with the CA private key (3) and sends the created certificate back to the entity (4). In general certificates often will be stored in a public repository (Directory Service). In case of revoked certificates this CRL will also be stored in a public available repository (Directory Service or Web server).
- 8
- SICAM, GridPass, Manual
E50417-H8940-C598-A6, Edition 05.2020
Overview
1.4 PKI Workflow
[sc_pki_workflow, 2, en_US]
- Figure 1-3
- PKI Workflow
SICAM, GridPass, Manual E50417-H8940-C598-A6, Edition 05.2020
9
- 2
- Enrollment over Secure Transport (EST)
2.1 2.2 2.3
Function Authentication CRL
11 11 12
- 10
- SICAM, GridPass, Manual
E50417-H8940-C598-A6, Edition 05.2020
Enrollment over Secure Transport (EST)
2.1 Function
- 2.1
- Function
The EST protocol is described here as implemented for Siemens products in the Energy Automation/Digitalized Grid domain. All other flavors can be found inside the RFC 7030 of EST (https://tools.ietf.org/html/rfc7030). All other flavors can be found inside the RFC of EST. The EST protocol enables a PKI client (entity) to request a new certificate and a certificate renewal from a Certification Authority (CA). The EST Server acts as a Registration Authority (RA), the EST CA is logically "behind" the EST server. As EST is based on the TLS protocol, mutual authentication based on X.509 certificates is used here to authenticate the server against the entity and vice versa.
[sc_est_workflow, 2, en_US]
- Figure 2-1
- EST Workflow
- 2.2
- Authentication
At the beginning, the entity and EST server have X.509 certificates. The entity has initial imprinting certificates received during production phase or got the initial certificates during engineering phase. The SICAM GridPass EST server is placed inside the customer environment and gets the EST server certificate during the environment installation phase of SICAM GridPass as described in this document. The entities get the CA certificate which has issued the EST server certificate during engineering phase of the entity. The SICAM GridPass EST server gets the Siemens CA certificate during installation of SICAM GridPass in case Siemens imprinting certificates are used within the entities. In all other cases the CA certificates of all issuing CAs have to be imported beforehand. Now the chain of trust is established. The SICAM GridPass EST server can verify the entity certificates and the entities can verify the EST server certificate of SICAM GridPass. EST is based on TLS and is configured in Siemens Energy Automation products to use mutual authentication. The EST server is verifying the entity certificates and vice versa. The EST client (entity) is verifying the entity certificate during the TLS handshake. If the connection is established the CSR will be sent via the authenticated and secured connection. Also the signed certificate will be sent back to the entity via this connection.
- SICAM, GridPass, Manual
- 11
E50417-H8940-C598-A6, Edition 05.2020
Enrollment over Secure Transport (EST) 2.3 CRL
- 2.3
- CRL
The EST client and EST server check the validity of received certificates against a CRL. The CRL distribution point URL is stored inside the certificates and is generally a Web server (http). The CRL is updated continuously by the CA and the EST client has to retrieve the CRL before the next update information placed inside the CRL is reached. The CRL is signed by the CA which has issued the revoked certificate.