I am trying to add a listener with TLS enabled to the Web IQ runtime on my ctrlX core. I generated the certificate and private key via SSH into the core. I recieve the error below when applying this configuration in Web IQ designer. This is not listed in their API documentation.
Is there a documented method of doing this correctly somewhere?
You have to register for the internal aera of SmartHMI web page.https://www.smart-hmi.com/user/download/deliver/docs/documentation-manual-connect-configuration-tool...
Section: TLS Configuration example
These are the instructions I referenced. I recieved the error message above when configuring via the designer. The command line tools cannot be run from within their snap installation folder on the core. That directory is formatted such that it is read only and cannot be changed by chmod.
Your screenshot clearly shows that you did not enter a port number.
If you enter a port number it should work. This is a mandatory field and as such you are getting an error when you leave it empty (albeit not a good one, unfortunately).
Specifying the port allowed the listener to be added and I can access the page with the specified FQDN as (192.168.100) and using self signed certificate, but I recieve a certificate not valid error and the HMI application is not displayed.
Is there a correct location I should be storing the certificates?
Currently, I have them in a folder in the core /home directory, since I can't place them in the snap folder.
Can you please specify what "cannot access" means? Are you getting a timeout in the browser when accessing https://192.168.100/ - or any other error message?
Then everything is working correctly from the WebIQ (and probably ctrlX) side. Browsers behave like this if you use a self-signed certificate, that's a security feature and not a bug and happens with any website.
This might help you to find a solution: https://www.google.com/search?q=google+chrome+insecure+self+signed&oq=google+chrome+insecure+self+si...
"Certificate is not valid" might also point to the time not being setup correctly on your ctrlX but you would still get these error messages from any browser.
I installed the certificate as trusted in my browser. The page still indicates unsecure and the HMI application is not displayed.
It seems to me these might be separate issues?
I can access the HMI application at the HTTP endpoint, port 10123.
I tried disabling the listener on port 10123 and changing the TLS listener to port 888, in case it was interfering with the ctrlX web interface. I then recieve this error which I can't find in the API reference.
You should never disable the listener on port 10123 as then you won't be able to connect with WebIQ Designer anymore. Just add a new listener on a different port, e.g. port 443 for the standard HTTPS port.
I assume the error occurs because the certificate files cannot be read by WebIQ Server due to a permission issue. Do the files have the correct permissions? If it's related to those files it would rather be a ctrlX and not a WebIQ issue and unfortunately then I cannot help you any further and someone from ctrlX would have to step in here as I don't know how you could change the permissions in ctrlX.
Permissions on the private key files are by default very strict for obvious reasons.
Sorry for the late reply.
We had a look to this topic and think that it as a problem because the WebIQ server does not have access to the certificates you uploaded. Please beware of following points:
I do not see a configuration folder for WebIQ Server over WebDAV. Does this mean the server app would need to be modified to support upload of TLS certificates?
I was able to activate a listener after packaging the certificate files with the published app. The path to the certificate files is then:
I can now reach the web application at the listener endpoint. In my case it is https://192.168.1.100:12345/cp_1/
The browser still displays a "Not Secure" tag and I see the error messages below in the service logs.
The error messages in the log are correct, because the browser you're using tries to connect using SSL which has been disabled for security reasons in WebIQ a long time ago.
A browser will always display certificate warnings if you're not using an officially signed TLS certificate. Valid certificates must have these features:
Please note that all of this has nothing to do with WebIQ specifically and is the same for any webserver you would be using without any difference whatsoever. The certificate files are the same for any webserver like NGINX, Apache or WebIQ - there's really no difference.
So whenever you're having issues with the browser not trusting your certificate you should be able to find solutions on Google.
WebIQ already fully supports TLS, see https://www.smart-hmi.com/blog/faq-items/does-webiq-support-ssl-tls-encryption-for-encrypted-https-c... for details
Yes, in addition, TLS certificates should never be put inside an HMI project as that way they could very easily be stolen (i.e. copied) because anyone would be able to download both the certificate and private key from the server through the browser!
Also, as certificates are not bound to any HMI, but to the server (as a port can be used by a single application only on a system) they belong to the WebIQ Server (Runtime) and not to any specific HMI.
However, with the current implementation of WebIQ on ctrlX this is not really comfortable for a user, I agree.
@Sgilk Security issue demo:
The user could download your full certificate data through these URLs:
Put the certificate files into the .db directory - then these files will not be served and are not accessible from the browser: