Actions

Difference between revisions of "OPC UA for AlphaCom - Installation"

From Zenitel Wiki

m (Software installation)
(Added chapter "Server Browsing")
Line 14: Line 14:
 
==OPC UA clients==
 
==OPC UA clients==
 
This article describes the setup of the OPC UA server and the test clients that come with it. OPC UA clients from other suppliers may have different methods of installing and certificate handling than described in this article for the test clients. Please follow the instructions as supplied with these OPC UA clients. The process normally involves:
 
This article describes the setup of the OPC UA server and the test clients that come with it. OPC UA clients from other suppliers may have different methods of installing and certificate handling than described in this article for the test clients. Please follow the instructions as supplied with these OPC UA clients. The process normally involves:
 +
 
*Making the OPC UA Client trust the OPC UA Server by importing the server certificate
 
*Making the OPC UA Client trust the OPC UA Server by importing the server certificate
 
*Creating a certificate for the client
 
*Creating a certificate for the client
Line 276: Line 277:
 
[[File:AlphaCom-OPC service.PNG|thumb|left|500px|Server is running and set to Automatic]]
 
[[File:AlphaCom-OPC service.PNG|thumb|left|500px|Server is running and set to Automatic]]
 
<br style="clear:both;" />
 
<br style="clear:both;" />
 +
 +
==Server Browsing==
 +
Before the background service is set for running after installation an available UA-server browsing must be executed.
 +
 +
This is done by starting the uaPLUS.Net4.exe and check that it connects to the AlphaCom. The test client  DA3TestClientUaNet4.exe is started and "Network"  discovery (may be omitted) is carried out by pushing the "Network" followed by the server browsing by pushing the "Browse Servers". This should result in two links to the server ('''''name''''' is the computer name):
 +
 +
ua:[http://name http://'''''name''''']:80/Advosoll/PLUS, and  (please check that port 80 is open in the firewall)
 +
 +
ua:opc:tcp:[http://name ://'''''name''''']::80/Advosoll/PLUS
 +
 +
Select a link and push the "Connect" button, which should result in connection established and push the "Browse Items" to check that data from the AlphaCom is received.
 +
 +
The uaPLUS.Net4.exe and the test client can now be shot down. Start the AlphaCom_OPC service and the test client an check that connection now again can be established to the AlphaCom.
 +
 +
<br />
  
 
==Related articles==
 
==Related articles==

Revision as of 09:20, 10 October 2019

AlphaCom icon 300px.png

Introduction

This document is an installation manual describing how to install the Vingtor-Stentofon OPC UA Server and all required additional software components. The Vingtor-Stentofon OPC UA Server makes it possible to control and monitor the Alphacom using the OPC UA protocol.

Scope

The article describes:

  • The software packages required for the installation
  • Installation of packages
  • Configuration of the OPC UA Server, Local Discovery Server and test clients.
  • Setup and use of the test OPC UA DA (data) and OPC UA AE (Alarm & Event) Clients

OPC UA clients

This article describes the setup of the OPC UA server and the test clients that come with it. OPC UA clients from other suppliers may have different methods of installing and certificate handling than described in this article for the test clients. Please follow the instructions as supplied with these OPC UA clients. The process normally involves:

  • Making the OPC UA Client trust the OPC UA Server by importing the server certificate
  • Creating a certificate for the client
  • Making the OPC UA Server trust the OPC UA Client by importing the client certificate

Prerequisites

Vingtor-Stentofon OPC UA Server is based on .NET version 4.6.2. This package can be freely downloaded from Microsoft.

Software package contents

The software packages consist of the Vingtor-Stentofon OPC UA package (VS-OPC UA). It installs:

  • AE-UATestClientNet4.exe
  • DA3TestClientUaNet4.exe
  • UaClientConfigHelper.exe
  • UaPLUS.Net4.exe
  • UaServerConfigHelperNet4.exe
  • AlphaOPCConfigurator.exe
  • UA Local Discovery Server (OPC Foundation Home Page)
  • srvman.exe
  • Install_AlphaCom_OPC.bat

Software installation

Double-click on the msi-installation package and follow the instructions:

  • VS-OPC UA for AlphaCom_Setup_vx.x.x.x.msi (x.x.x.x is the version number, always check the AlphaWiki download page for the latest version)


By default, the software is installed in the following directory: C:\Program Files (x86)\Vingtor Stentofon\VS-OPC UA for AlphaCom Ensure that ALL executables in this directory run in Administrator Mode. Right click on each executable and select 'Properties->Compatibility'. Set check mark in 'Run this program as an administrator'. This is necessary because the executable accesses restricted areas.

Install the Advosol OPC Core Components Redistributable. By default the installation package is located in the directory: C:\Program Files (x86)\Vingtor Stentofon\VS-OPC UA for AlphaCom\OPC Core Components For 64-bit operating systems it is necessary to install both (x86 and x64) packages

UA Local Discovery Server

The Local Discovery Server (LDS) provides the necessary infrastructure to publicly expose the OPC UA Servers available on a given computer. The LDS is included in the installation package. The latest release can be downloaded from the following link: https://opcfoundation.org/developer-tools/developer-kits-unified-architecture/local-discovery-server-lds

  • Navigate to C:\Program Files (x86)\Vingtor Stentofon\VS-OPC UA for AlphaCom
  • Double-click on the installation package and follow the instructions:OPC UA Local Discovery Server x.x.x.exe

Check in the services dialog that OPC UA Local Discovery Server is running and will automatically start at system reboot.

  • Open Search Windows and enter Services in the input field. Click on the search result Services
LDS status: Running and Automatic


  • Status: Running
  • Startup Type: Automatic

in case these settings are not made, right click on the entry in the services dialog and select Properties. Make the appropriate selections under the TAB General and click OK.

UA Security

Introduction

The UA security is based on X509 Certificates.
Each UA server and client application requires a certificate with the Application URI of the application. Self-signed certificates can be created with the uaPLUS UaServerConfigHelper utility. uaPLUS maintains certificates in the Windows Certificates Store. The certificates are by default in the stores LocalMachine\UA Applications and LocalMachine\Trusted UA Applications The stores are defined in the application UA configuration and can be changed if necessary. The UaServerConfigHelper utility creates and imports certificates into the stores defined in the configuration. With the server and client on the same machine the certificates are in the right place when created or imported with the Advosol UaServerConfigHelper and UaClientConfigHelper utilities. With server and client on different machine the following steps are required:

  • On the server machine create a certificate for the server. UaClientConfigHelper automatically exports created certificates into a .DER file in the utility directory.
  • Copy the client certificate .DER file to the server machine and import it with the UaServerConfigHelper utility.
  • Copy the server .DER certificate file to the client machine and import it. The location depends on the client application. For Advosol UA client applications the UaClientConfigHelper utility imports the certificate to the proper location.

uaPLUS stores untrusted certificates it receives from connecting clients in the store defined in the UA configuration settings for rejected certificates (default: LocalMachine\Rejected UA Certificates). Instead of importing the client certificate before the client connects, the rejected certificate can be copied after a failed connect. The UaServerConfigHelper utility has an option (MOVE button) to copy the certificate. Note: The certificates must be configured for the Windows store type.

The Windows Certificates manager can be used to check and maintain the certificates beyond the capabilities of the UaServerConfigHelper utility.

Creating a Certificate for uaPLUS Server

The UaServerConfigHelper utility is provided with the uaPLUS server toolkit. This utility should be used to edit the UA server configuration file whenever possible. The UaServerConfigHelper also supports the import, export and creation of the necessary certificates. Certificates need to be created with this tool to meet all UA requirements. The Edit UA Configuration dialog edits the UA configuration XML file for the selected application.

The uaPLUS.Net4.exe is the generic part of the OPC UA server. Creating a certificate for the server is carried out in the way described below.

Drag the uaPLUS.Net4.exe over the UaServerConfigHelperNet4.exe. This gives a quick access to the server configuration:

Drag and drop uaPLUS.Net4.exe onto UaServerConfigHelperNet4.exe



UA Server Configuration Helper main screen


Press the Create UA Configuration button and accept any changes.

Press the Edit UA Configuration and check if it looks as shown below. 'User Name' is not supported in the current version of the server.

UA Configuration


Note: The default directory for the trace log file is where the executables are installed: C:\Program Files (x86)\Vingtor Stentofon\VS-OPC UA for AlphaCom. This is a restricted area. Therefore, the log file name specification should be prefixed with for instance C:\Tmp\Log\ as is shown in the picture above.
The Trace Mask can be changed by clicking the Change button. Enabling all options will set the trace mask to the value 1023 as shown above.
Click Save to save the changes.
Click on Certificates

Manage Certificates


Click Create to create a certificate.
Click OK
Click Save and Close
In the UA Server Configuration Helper main screen, click on Firewall Exceptions. Make certain that port 62841 is in the column Ports Open in Firewall.

Port 62841 Open in Firewall


Click Done
Click Done

Creating a certificate for clients

The paragraphs below describe how to create certificates for the test clients. In 'real' installations, it will also be required to create certificates for the clients which are installed on the specific site. The procedure to create those certificates may differ, please consult the with those clients provided documentation.

The UaClientConfigHelper utility is provided with the uaPLUS server toolkit. This utility is only needed for the configuration of the provided test client applications, mainly the management of the needed certificates. The main dialog manages the configuration files.

Creating a Certificate for DA3TestClientUaNet4

To create a certificate for the UA-DA test client drag the DA3TestClientUaNet4.exe over UaClientConfigHelperNet4.exe

Drag and drop DA3TestClientUaNet4.exe onto UaClientConfigHelperNet4.exe


UA DA Client Configuration Helper main screen


Press the Create UA Configuration-button to overwrite the existing file.
Press the Edit UA Configuration-button.

UA DA Client Configuration


Note: The default directory for the trace log file is where the executables are installed: C:\Program Files (x86)\Vingtor Stentofon\VS-OPC UA for AlphaCom. This is a restricted area. Therefore, the log file name specification should be prefixed with for instance C:\Tmp\Log\ as is shown in the picture above.
The Trace Mask can be changed by clicking the Change button. Enabling all options will set the trace mask to the value 1023 as shown above.
Click Set, Save and Certificates.

Create UA-DA Client Certificate


Click Create

UA-DA Client Certificate has been created


In the Server Certificates group box, click Browse and select the server certificate.

Add server certificate to the UA-DA Client store


Click Select
Click OK
Click Save and Close
Click Firewall Exceptions

Port 62841


Check that port 62841 is open in the firewall.
Click Done
Click Done

Creating a Certificate for AE-UATestClientNet4

To create a certificate for the AE test client drag the AE-UATestClientNet4.exe over UaClientConfigHelperNet4.exe

Drag and drop AE-UATestClientNet4.exe onto UaClientConfigHelperNet4.exe


UA AE Client Configuration Helper main screen


Press the Create UA Configuration-button and to overwrite the existing file.
Press the Edit UA Configuration-button.

UA AE Client Configuration


Note: The default directory for the trace log file is where the executables are installed: C:\Program Files (x86)\Vingtor Stentofon\VS-OPC UA for AlphaCom. This is a restricted area. Therefore, the log file name specification should be prefixed with for instance C:\Tmp\Log\ as is shown in the picture above.
The Trace Mask can be changed by clicking the Change button. Enabling all options will set the trace mask to the value 1023 as shown above.
Click Set, Save and Certificates.

Create UA-AE Client Certificate


Click Create

UA-AE Client Certificate has been created


In the Server Certificates group box, click Browse and select the server certificate.

Add server certificate to the UA-AE Client store


Click Select
Click OK
Click Save and Close
Click Firewall Exceptions

Port 62841


Check that port 62841 is open in the firewall.
Click Done
Click Done

Make Clients Trusted Applications for the Server

Drag the uaPLUS.Net4.exe over the UaServerConfigHelperNet4.exe

Drag and drop uaPLUS.Net4.exe onto UaServerConfigHelperNet4.exe


Press the Edit UA Configuration

UA Server Configuration Helper main screen


Click Certificates

UA Configuration


Click Import a Client Certificate

Import a Client Certificate


Select first the OPC UA DA Client certificate and subsequently the OPC UA AE client certificate

Import the OPC-UA DA and OPC-UA AE Client Certificates


Click OK
Click Save and Close
Click Done

Make OPC UA Server trust LDS

The LDS certificate is stored in this location C:\ProgramData\OPC Foundation\UA\pki\own\certs\ualdscert.der.

Open a Command Prompt as administrator
Type mmc and press the ENTER-key
On the File menu, click Add/Remove Snap In
In the Available snap-ins box, select Certificates
Click Add
In the Certificates snap-in dialog box, select Computer account
Click Next
Note: If you are not an administrator of the computer, you can manage certificates only for your user account. Select My User account or Service account in the step above instead.
In the Select Computer dialog box, click Finish
In the Add/Remove Snap-in dialog box, click OK
In the Console Root window, click Certificates (Local Computer) to view the certificate stores for the computer.

Import LDS certificate into the store


Navigate to Certificates/Trusted UA Applications/Certificates
Right click on Certifcates and select All Tasks/Import ...
The 'Certificate Import Wizard' will open. On the Welcome screen, click Next
Browse to where the certificate is located (make certain to search for 'All files *.*') and click Next

Certificate import


In the following step, browse to Trusted UA Applications and click Next

Select certificate store


As the last step click Finish - the certificate will now be imported

Make LDS trust OPC UA Server

Open a Command Prompt as administrator
Type mmc and press the ENTER-key
On the File menu, click Add/Remove Snap In
In the Available snap-ins box, select Certificates
Click Add
In the Certificates snap-in dialog box, select Computer account
Click Next
Note: If you are not an administrator of the computer, you can manage certificates only for your user account. Select My User account or Service account in the step above instead.
In the Select Computer dialog box, click Finish
In the Add/Remove Snap-in dialog box, click OK
In the Console Root window, click Certificates (Local Computer) to view the certificate stores for the computer. Navigate to Certificates/Trusted UA Applications/Certificates
Right-click on Advosol uaPLUS Server and select All tasks > Export...

Export OPC UA Server certificate


The Certificate Export Wizard will open, click on Next
Select No, do not export the private key and click Next
Select DER encoded binary X.509 (.CER) and click Next
Browse to C:\ProgramData\OPC Foundation\UA\pki\trusted\certs; Enter the name of the certificate: Advosol uaPLUS Server.cer; click Save, click Next

Select OPC UA server certificate


As the last step click Finish - the certificate will now be exported

Installing the service

In File explorere, navigate to the installation directory C:\Program Files (x86)\Vingtor Stentofon\VS-OPC UA for AlphaCom
Go to File/Open Windows Powershell/Open Windows Powershell as administrator
Enter .\Install_AlphaCom_OPC.bat and press <Enter>
Before starting any clients make certain that the AlphaCom_OPC server is running and that the Startup Type has been set to Automatic

Server is running and set to Automatic


Server Browsing

Before the background service is set for running after installation an available UA-server browsing must be executed.

This is done by starting the uaPLUS.Net4.exe and check that it connects to the AlphaCom. The test client DA3TestClientUaNet4.exe is started and "Network" discovery (may be omitted) is carried out by pushing the "Network" followed by the server browsing by pushing the "Browse Servers". This should result in two links to the server (name is the computer name):

ua:http://name:80/Advosoll/PLUS, and (please check that port 80 is open in the firewall)

ua:opc:tcp:://name::80/Advosoll/PLUS

Select a link and push the "Connect" button, which should result in connection established and push the "Browse Items" to check that data from the AlphaCom is received.

The uaPLUS.Net4.exe and the test client can now be shot down. Start the AlphaCom_OPC service and the test client an check that connection now again can be established to the AlphaCom.


Related articles