Part 1 of 5 in our Security in plain words series. Staff who click past a browser warning every morning will click past the one that matters. Here is how an edge controller can earn the browser's trust instead.
The warning everyone has learnt to ignore
Open a browser to many of the devices on a plant network and the first thing you meet is a warning: the connection is not private, the certificate is not trusted. An engineer clicks through it and gets on with the job. By the end of the week it is a reflex.
That reflex is the real risk. A browser warning exists for the day someone puts a look-alike device on the network, or slips between your PC and the real one. On that day the warning looks exactly like every one before it, and it gets the same click.
The cause is simple. A device that signs its own certificate is vouching for itself, and a browser has no reason to believe it. The cure is simple in principle too: have the certificate signed by someone the PC already trusts. The hard part has always been doing that for every unit, on every site, without turning each one into a project.
What a certificate does, and what it does not
A certificate is a unit's ID card. It names the unit, and it is tied to a secret key that only the unit holds, so the unit can prove the card is its own. When an authority the PC trusts has signed the card, the browser accepts it without a warning, and everything sent over the connection - logins, settings, setpoints - is encrypted.
The limits matter too. A certificate proves that you have reached the genuine unit. It does not decide who may do what once you are there: that is the job of identity and roles, the subject of part 3. Within those limits, it removes a whole class of doubt.
How it works in CATIM Nimbus
In CATIM Nimbus, the edge controller now in field trials, the certificate is handled on one page of the console, in three steps.
- The unit makes its own key, and asks. The key is created on the unit and never leaves it: it is never downloaded, displayed or copied. From that key the unit makes a request naming the ways it is reached, which the page offers as a file.
- The authority you choose signs it. That can be your supplier's, your integrator's or your own company's - the one your IT department may already run. The choice is yours, because the unit only ever swaps a request for a signed certificate.
- The unit checks, then installs. Before it uses the signed certificate, the unit checks that it matches its own key, names everything it asked for and leads back to a trusted root. If the new certificate does not come up cleanly, the old one returns, so a unit is never left half done.
Only an administrator can change a unit's certificate, and every request and install is recorded.
One root, installed once
This is the part IT managers like. The browser trusts the unit because it can follow the signatures from the unit's certificate up to a root certificate it already holds. So the root is installed once on each PC - by hand, or across the fleet with the tools IT already uses to manage its computers - and never again for each unit.
The tenth unit on site, and the hundredth, are trusted the moment they carry a certificate from the same authority. If your company already runs its own authority, its root is often on every PC already, and there is nothing new to install.
The root is a public file, and the console offers it with both its fingerprints. Whoever installs it first compares its fingerprint with the one the authority supplied by another route. That one comparison is what makes the whole chain safe.
Before the warning comes back
Certificates fail in two quiet ways. The first is a name: a unit moves to a new address, or IT gives it a site name, and the certificate no longer covers how people reach it. The console lists every way the unit is reached and marks each one covered or not, and one that is not can be added to a fresh request.
The second is a date. Every certificate ends, and an expired one brings the warnings straight back. The console shows the end date and the days left, and warns well before the end, so renewal goes in the diary rather than arriving as a Monday-morning surprise. Renewing is the same three steps again.
None of it needs the internet. The request and the signed certificate move as files, so a site that keeps its plant network offline signs its units with its own authority. Part 2 of this series takes that further.
A warning that means something again
When no unit on site raises a warning, a warning means something again. Staff stop learning to click past them, and the one that matters gets noticed.
If your site has a habit of clicking past certificate warnings, we would like to hear about it. Talk to us about trusting every unit on your site, once.
About CATIM. CATIM - Creating Automation Technology In Motion - empowers people to engineer automation solutions that solve hard technical problems. CATIM Nimbus, the CODESYS edge controller with advisory AI, is the next generation of the Nimbus platform it has built since 2019.