Certificate Management
The certificate management page provides functions for uploading, generating, exporting, and deleting certificates, supporting CA certificates (root/intermediate certificates for issuing or proofreading authentication certificates), server certificates (presented by the gateway as the server), and client certificates (presented when the gateway connects to external systems).
First, look at the terminology
| terminology | On-site understanding |
|---|---|
| CA certificate | Used to issue or verify root certificates or intermediate certificates for other certificates. A CA must be present before server certificates or client certificates can be issued. |
| Server certificate | Identification presented when the gateway acts as a server, such as HTTPS, MQTT Server, OPC UA Server. |
| Client Certificate | Identification presented by the gateway when connecting to an external system, commonly used in scenarios where the other party requests two-way authentication. |
| TLS / SSL | encrypted communication methods. Once enabled, both parties in the connection use certificates to confirm their identities and encrypt the transmitted content. |
| PFX / PEM / CER / DER | certificate file formats. PFX typically includes both the certificate and the private key; PEM is commonly found in Linux; CER/DER are mostly certificate public key files. |
| Private Key | Sensitive key corresponding to the certificate. After a private key is leaked, the other party may impersonate the gateway or client. |
| Subject / SAN | Subject is the name of the certificate subject; SAN is a list of domain names or IPs permitted by the certificate. When accessing services via IP, write the IP into the SAN. |
Function Entry
After logging into GatewayRuntime Web, click the "Development Configuration → Certificate Management" menu on the left.
Certificate List
| Columns | Description |
|---|---|
| Certificate Name | Certificate Identifier Name |
| Purpose | CA Certificate/Server/Client |
| Format | PFX/PEM/CER/DER |
| Subject | Certificate Subject Name |
| Issuer | Certificate Issuer |
| Validity Period | Certificate Validity Period |
Certificate Purpose
| Purpose | Description |
|---|---|
| CA Certificate | Root certificate or intermediate certificate, Used for issuing server certificates and client certificates, and can also be used to verify peer certificates. Before generating server or client certificates, CA certificates should be created or uploaded first. |
| Server | Gateway is used as a server listener, such as MQTT Server, OPC UA Server, or HTTPS scenarios. When the client connects to the gateway, the certificate will be verified. |
| Client | gateways are used when clients connect to external systems, such as MQTT Client bidirectional TLS or scenarios where external systems require client certificate authentication. |
Certificate Filtering
The page supports filtering certificates by the following criteria:
| Filter Criteria | Description |
|---|---|
| Certificate Name | Search by Name Keywords |
| Purpose | Filter by CA/Server/Client |
| Format | Filter by PFX/PEM/CER/DER |
Operation Functions
| Functions | Description |
|---|---|
| Upload certificates | Upload existing certificate files |
| Generate CA certificates | Generate new CA root certificates |
| Generate server certificates | Issue server-side certificates based on existing CA certificates |
| Generate client certificates | Issue client certificates based on existing CA certificates |
| Edit | Edit certificate information |
| Export | Export certificate files |
| Delete | Delete certificates |
| Batch delete | Batch delete Select certificates |
| Refresh | Refresh certificate list |
Upload certificate
Click "Add → Upload certificate" to open the upload dialog box:
Configuration Item
| Field | Description |
|---|---|
| Certificate Name | Certificate Identifier Name |
| Certificate Purpose | CA/Server/Client |
| Certificate Format | PFX/PEM/CER/DER. PFX: Binary format with private key (commonly used on Windows); PEM: Base64 text format (commonly used in Linux); CER/DER: Certificate format for public key only |
| Certificate file | certificate file |
| Private key file | Private key file (PEM format) |
| certificate password | PFX certificate password, or the password used to protect private keys when generating or exporting certificates. |
| Private Key Password | Enter when the PEM private key file is protected by a password. |
Generate CA Certificate
Click "Add → Generate CA Certificate" to open the Generation dialog box. CA certificates are used for subsequent issuance of server and client certificates. It is recommended to clearly use a name to indicate the certificate's purpose and field scope.
Configuration Items
| Fields | Descriptions |
|---|---|
| Certificate Name | The unique name of the certificate in the system; select this name when configuring the CA certificate later. |
| Subject | Certificate Subject, usually filled in CA name, organization name, or field root certificate name. |
| Validity Period | Certificate validity period, unit: years, interface limit 1 to 50. |
| Key length | selectable between 2048 bits or 4096 bits; CA certificates are recommended to use 4096 bits. |
| Certificate and password | optional. After filling it out, it is recommended to protect the private key used to generate the certificate; it is recommended to set up and properly store it in the production environment. |
Generate Server Certificate
Click "Add → Generate Server Certificate" to open the Generation Dialog:
The server certificate must be issued by an existing CA certificate. If the CA certificate list is empty, first execute "Generate CA Certificate" or "Upload Certificate," then reopen the server certificate generation popup.
Configuration Items
| Fields | Description |
|---|---|
| Certificate Name | The unique name of the server certificate within the system. Subsequent configurations such as OPC UA Server, MQTT Server, and HTTPS will be referenced by name. |
| Subject Name | Certificate Subject, usually filled in as the service domain name, device name, or site name. |
| CA Certificate | The CA certificate used to issue the server certificate. The dropdown option comes from certificates listed for CA purposes. |
| SAN domain name | List of subject alternate domain names. After entering the domain name, press Enter to add; multiple domains are supported. |
| SAN IP address | subject alternate name IP address list. When accessing services via IP, you must provide the corresponding IP. |
| Validity Period | Certificate validity period, unit: years, interface limited to 1 to 10. |
| Key length | can be selected between 2048 bits or 4096 bits. |
| Certificate password | optional. It is used to protect the private key or export file that generates the certificate. |
SAN Configuration Description
SAN (Subject Alternative Name) is an extension field of the certificate, used to specify the valid domain name and IP address of the certificate. After configuring the SAN, the certificate can support access to multiple domain names and IP addresses.
Usage Scenario:
- The server has multiple domain names that need access.
- The server has multiple IP addresses that need access.
- Internal network environment uses IP addresses to access
Operation Method:
- Enter the domain name or IP in the input box After the address, press Enter to add.
- The same certificate can be configured for multiple SAN domains and multiple SAN IP addresses simultaneously.
- If the client accesses the service via an IP address, entering only the subject name is usually insufficient; the SAN IP address should also be provided.
Generate Client Certificate
Click "Add → Generate Client Certificate" to open the Generation Dialog Box:
Client Certificate is used for two-way authentication scenarios, For example, OPC UA client certificates, MQTT client certificates, or other external systems that require mTLS. You also need to prepare a CA certificate before generation.
Configuration Items
| Fields | Description |
|---|---|
| Certificate Name | The unique name of the client certificate within the system. |
| Subject Name | Client Identity Name, which can be filled in the client application name, device name, or external system identifier. |
| CA Certificate | The CA certificate used to issue the client certificate. |
| Validity Period | Certificate validity period, unit: years, interface limit 1 to 10. |
| Key length | selectable between 2048 or 4096 bits. |
| Certificate Password | Optional. Used to protect the client certificate private key. |
Export Certificate
Click the "Export" button in the certificate list to open the export dialog:
Export Configuration
| Fields | Description |
|---|---|
| Export Formats | PEM/PFX/CER/DER |
| Includes private key | Displayed only in PEM format. After opening, the exported content contains the private key, making it suitable for migrating to other gateways or clients. |
| Export password | optional. Fill in when exporting PFX or when you need to protect your private key. |
Export Format Instructions
| Format | Instructions |
|---|---|
| PEM | Base64 encoded text format, commonly used in Linux systems |
| PFX | binary format, containing certificates and private keys, commonly used in Windows systems |
| CER | binary format, containing only certificates |
| DER | binary format, containing only certificates |
Export results
After successful export, certificate details and export content will be displayed:
| Content | Description |
|---|---|
| Certificate (PEM) | PEM format certificate content, supports copying and downloading |
| Private Key (PEM) | PEM format private key content, supports copying and downloading |
| PFX files | Binary file download in PFX format |
| CER content | certificate content in CER format |
| DER file | Binary file download in DER format |
PEM or PFX files containing private keys should be managed as sensitive files. After exporting, do not send via regular chat tools, public cloud drives, or unencrypted emails; The certificate password should be stored separately from the certificate file.
Related Links
- System Settings - Gateway System Configuration
- Plugin Management - Plugin Enable and Disable