Automated Certificate Management for Automation Installations

A service function of a control system of a technical installation, which is established to function as an intermediary between at least one registration authority of the technical installation and at least one installation component during certificate requests by the at least one installation component;

• wherein the at least one installation component is already part of the technical installation or is provided for integration into the technical installation;
• and
• wherein the service function acting as an intermediary at least involves identifying a registration authority of the technical installation responsible for the at least one installation component and forwarding a certificate request of the at least one installation component to the corresponding registration authority;
• and
• wherein the registration authority is established and provided to forward the certificate request to a certification authority of the technical installation.

A control system of a technical installation, comprising:

• in particular manufacturing or process installation:
• a software database for a public key infrastructure of a technical installation, which comprises at least one unique identification of installation components involved in the technical installation, the software database including information for at least one installation component, in relation to which a unique identification is stored in the software database comprising:
• a) a device certificate issued by at least one of (i) a manufacturer of the installation component and (ii) an operator of the technical installation;
• and
• b) at least one operational certificate, which has been issued for the installation component in the technical installation;
• and
• a service function of a control system of a technical installation, which is established to function as an intermediary between at least one registration authority of the technical installation and at least one installation component during certificate requests by the at least one installation component;
• wherein the at least one installation component is already part of the technical installation or is provided for integration into the technical installation;
• wherein the service function acting as an intermediary at least involves identifying a registration authority of the technical installation responsible for the at least one installation component and forwarding a certificate request of the at least one installation component to the corresponding registration authority;
• and
• wherein the registration authority is established and provided to forward the certificate request to a certification authority of the technical installation.

A method for applying for a certificate at a registration authority of a technical installation on a part of a component of the technical installation, the method comprising:

• a) transferring a certificate request of an installation component to a registration authority, responsible for the installation component, of the technical installation via a service function;
• b) performing, by the registration authority, an examination to determine whether at least one of (A) a certificate attached to the certificate request and issued by at least one of (i) a manufacturer of the installation component and (ii) an operator of the technical installation and (B) an operational certificate, which has been issued for the installation component in the technical installation, is stored in a software database;
• c) performing, by the registration authority, an examination to determine whether a signature of the certification request is correct;
• and
• d) performing, by the registration authority, an examination to determine whether at least one of (A) a public key of the certification request matches a public key contained in the certificate issued by at least one of (i) the manufacturer of the installation component and (ii) the operator of the technical installation and (B) an operational certificate, which has been issued for the installation component in the technical installation.