Honeywell CIU 888 Configuration Manual page 159

FIGURE 4-10
NOTE: If different CA is used for Client application to sign: get its CA root certificate
NOTE: In case of a redundant CIU888, workflow steps have to done separately for
NOTE: If different CA is used for CIU888 to sign: get its CA root certificate and CA
Part No.: 4417584_Rev12
Commissioning of a Standalone System Setup
When prompted for a restart, click on Yes. Once the CIU restarts,
OPCUA client will communicate with the CIU888 securely over OPCUA.
(see FIGURE 4-10)
OPCUA CA Signed certificate.
and CA CRL of that CA and upload to CIU using "upload Certificate" under
OPCUA CA Signed Certificate. Browse CA Certificate and Browse CA CRL
only and click apply to upload the certificates. Now both CAs used for Client
and Server are uploaded to CIU888.
CIUA and CIUB. Both certificates are different.
4.8.2.3 Download Server Certificate:
To download the CA signed certificate created from CIU888. This is
useful after uploading the signed CIU888 certificate.
4.8.2.4 Workflow for OPCUA client applications (CA Signed):
1. The OPCUA Client application will also have a provision to generate
CSR.
2. Send the generated CSR to CA and get three certificates back from
CA.
a) Signed Client application certificate in format as application
requires.
b) Root CA certificate in format as application requires.
c) Root certificate revocation list (.crl).
3. Upload the received certificates to client application.
CRL of that CA and add to respective directory of client application certificate
management. Now Both CA root certificate and CA root CRL will be present.
Configuration Manual
CIU 888 4 - 14