Secure Connection Configuration

For secure connections between the IP.21 Server service and the IP.21 gRPC Datasource either the default certificate which is automatically generated during the installation of the IP.21 Server service (signed by AspenTech’s default CA) or a custom certificate can be used. In any way, the configurations on both objects need to match to establish a connection.

IP.21 Server Configuration

To configure the IP.21 Server to use a secure connection for communication with an IP.21 gRPC Datasource …​

1 In the I/O Model, select the IP.21 Server object.

2 In the Properties Panel, expand the gRPC Server compound.

3 Enable the checkbox for the Secure Connection property.

4 Expand the Certificate Configuration sub-compound.

5 In the Server Certificate Type property, specify whether the built-in or a custom certificate is used for the secure connection.

Changing this property while a connected IP.21 gRPC Datasource object has its Certificate Authority property set to System requires the re-initialization of the TLS Credentials on said Datasource object.

Built-In (default) - the default certificate is used. The Built-In Certificate Credentials > Server Certificate property is automatically configured to point at this certificate.

Custom - use certificates generated by another Certificate Authority (other than AspenTech CA), e.g. a self-signed certificate as described in Creating a Self-signed Certificate.

If you select this option, follow these steps:

1 In the Certificate Credentials > Certificate property, specify the server certificate file
(e.g. D:\certificate-environment\IP21\certs\server.cert.pem from Creating a Self-signed Certificate).

2 In the Certificate Credentials > Certificate Key" property, specify the server private key file
(e.g. D:\certificate-environment\IP21\private\server.key.pem from Creating a Self-signed Certificate).

6 Click Apply to confirm the changes on the properties.

IP.21 gRPC Datasource Configuration

The Secure Connection configuration on the IP.21 gRPC Datasource object has to match the configuration on the IP.21 Server object (addressed above).

1 In the I/O Model, select the IP.21 gRPC Datasource object.

2 In the Properties Panel, expand the Server Type compound and verify that this Datasource is of type IP.21 gRPC and Host Name or IP and Port match the configuration on the IP.21 Server object.

3 Enable the checkbox for the Secure Connection property.

4 Expand the TLS Credentials sub-compound.

5 Set the Certificate Authority property to specify the certificate store where the system looks for the CA Certificate against which the server certificate is validated.

The following options are available:

Built-In (default): the CA certificate is taken from the system itself. In this case AspenTech’s CA Certificate is used to validate the server certificate. This is the standard option to choose if the Secure Connection on IP.21 Server object addressed above is configured to use the built-in Server Certificate.

Custom: the custom CA certificate is taken from a location in the file system. In this case the full path to the certificate needs to be specified in Custom CA Certificate property to specify the CA certificate against which the server certificate is validated. This is the standard option to choose if the Secure Connection on IP.21 Server object is configured to use a custom Server Certificate.

System: Alternatively to the Built-In and the Custom option, the root CA certificate chain based on the Windows certificate store can be used to validate the server certificate. The System Mode Requirements need to be fulfilled if this option is to be used.
For this, the CA certificate needs to be added to the Windows certificate store.
If the IP.21 Server object is configured to use the Built-in option, this needs to be the AspenTech CA certificate which comes along with the AspenTech InfoPlus21 system.
For the Custom option , this needs to be your custom CA certificate (e.g. D:/certificate-environment/certificate-authority/certs/TheCertificateAuthority.cert.pem ).

The Custom CA Certificate property specifies the CA Certficate which is used if the Custom option is selected for Certificate Authority property. Click on the Import icon to browse the file system to set the path to the CA Certificate. The eye icon opens the Certificate Viewer. Clicking on the Trashcan icon empties the property.

6 Click Apply to confirm the changes on the properties.

System Mode Specifics

This section addresses requirements regarding the System option for the Certificate Authority property of the IP.21 gRPC Datasource as well as specific steps which may be necessary when using this mode.

System Mode Requirements

For the System option it is necessary that the Connector service is running with administrator privileges.

To promote the Connector service, …​

  1. log-in to the machine on which said service is running with an administrator account.

  2. Run the Windows services appp and find the Connector service.

  3. Right-click the service and select Properties from the context menu.

  4. Go to the Log on tab and select the This account: option and click Browse.

  5. In the Select User dialog, enter a the name of a user to which administrator privileges have been granted in the Enter the object name to select text field and click Check Names.

  6. Click OK to confirm the selected user name and close the dialog.

  7. Back in the Log on tab of the service properties, enter the password for the selected user in the Password field and repeat it in the Confirm Password field.

  8. Then click Apply to confirm the changes. Some feedback messages will be displayed. Confirm them by clicking OK.

  9. Back in the services list, right-click on the service and select Restart from the context menu.

Re-Initializing the Certificate in System Mode

If System is configured as the Certificate Authority property on a IP.21 gRPC Datasource while the Server Certificate Type property on the IP.21 Server object is changed , the TLS Credentials on the IP.21 gRPC Datasource object need to be re-initialized with the other CA Certificate.

To do this, switch the Certificate Authority property to any other option but System, click Apply, switch the Certificate Authority property back to System and click Apply once more.