# SSL Certificates **URL:** https://www.wago.community/t/ssl-certificates/807 **Category:** Hardware and Linux **Tags:** security **Created:** [March 7, 2024, 9:28pm UTC](https://www.wago.community/t/ssl-certificates/807 "2024-03-07T21:28:40Z") **Posts on this page:** 5 **Page:** 1
### Author: ![WagoKurt](https://sea2.discourse-cdn.com/flex016/user_avatar/www.wago.community/wagokurt/32/11_2.png) [@WagoKurt](https://www.wago.community/u/WagoKurt) #### Post date: [March 7, 2024, 9:28pm UTC](https://www.wago.community/t/ssl-certificates/807/1 "2024-03-07T21:28:40Z")
The WBM on WAGO devices uses unsigned certificates, and requires the browser to allow an exception. Has anyone found a way to install custom signed certificates to avoid this warning message? If so, is there a service out there to manage/automate updating the certs on remote devices on a yearly basis (before they expire)? Using http is not an option in some cases, because certain IT departments do not allow that any longer. I am thinking something like Key Manager Plus over a VPN might be a solution… [![](https://us1.discourse-cdn.com/flex016/uploads/wago/original/1X/1db4f0e589363e631c6ae5b90bdcdddf4e02c727.jpeg "SSL certificate management made easy with Key Manager Plus.") ](https://www.youtube.com/watch?v=fp1TM-kDJLA) ---
### Author: ![WagoKurt](https://sea2.discourse-cdn.com/flex016/user_avatar/www.wago.community/wagokurt/32/11_2.png) [@WagoKurt](https://www.wago.community/u/WagoKurt) #### Post date: [March 7, 2024, 9:49pm UTC](https://www.wago.community/t/ssl-certificates/807/2 "2024-03-07T21:49:42Z")
On a related note, does anyone have instructions for creating SSL certificates using Lets Encrypt service? > **[Let's Encrypt](https://letsencrypt.org/)** > > Let's Encrypt is a free, automated, and open certificate authority brought to you by the nonprofit Internet Security Research Group (ISRG). Read all about our nonprofit work this year in our 2023 Annual Report. 1. **Understanding Let’s Encrypt** : - **Let’s Encrypt** is a free and automated certificate authority (CA) that provides SSL/TLS certificates. - It’s widely used for securing web servers, including IoT devices like your controller. 1. **Prerequisites** : - Ensure you have a **DNS-resolvable domain name** that points to your controller’s public IP address. Let’s Encrypt will verify your domain ownership. - You’ll need **administrator access** to your controller and the ability to install software. 1. **Steps to Create Signed Certificates** : a. **Install Certbot** : - Certbot is a tool that simplifies the process of obtaining and renewing Let’s Encrypt certificates. - Install Certbot on your local machine or a server that can communicate with your controller.b. **Generate the Certificate** : - Run the following command to generate a certificate for your domain (replace `` and `` with your actual email and domain): ```auto sudo certbot certonly \ --manual --preferred-challenges dns \ --email \ --server https://acme-v02.api.letsencrypt.org/directory \ -d ``` - Certbot will guide you through the DNS challenge process. You’ll need to create a DNS TXT record to prove domain ownership.c. **Retrieve the Certificate Files** : - Certbot will save the certificate files (including the private key) in a directory (usually `/etc/letsencrypt/live/`). - You’ll find files like `cert.pem` (certificate), `privkey.pem` (private key), and `fullchain.pem` (certificate chain).d. **Configure Your Controller** : - Upload the certificate files to your controller. - Configure your web server (e.g., Nginx, Apache) on the controller to use these certificates. - Specify the paths to `cert.pem` and `privkey.pem` in your server configuration.e. **Automate Certificate Renewal** : - Let’s Encrypt certificates expire after 90 days. Set up a cron job or systemd timer to automatically renew the certificates using Certbot: ```auto sudo certbot renew ``` I dont think certbot will run on the WAGO Linux… ---
### Author: ![quenorha](https://sea2.discourse-cdn.com/flex016/user_avatar/www.wago.community/quenorha/32/429_2.png) [@quenorha](https://www.wago.community/u/quenorha) #### Post date: [March 8, 2024, 10:44am UTC](https://www.wago.community/t/ssl-certificates/807/3 "2024-03-08T10:44:38Z")
Hi Kurt, There’s a docker version of certbot. There are also a lot of ACME implementation : > **[ACME Client Implementations - Let's Encrypt](https://letsencrypt.org/docs/client-options/)** > > Last updated: Jul 22, 2023 | See all Documentation Let’s Encrypt uses the ACME protocol to verify that you control a given domain name and to issue you a certificate. To get a Let’s Encrypt certificate, you’ll need to choose a piece... I used acme.sh once. But for all those solution note that you need an open https port and a DNS to be set up. You can use CRON in order to update on a regular basis the certificates. (Let’s encrypt certificates expires after 90 days) ---
### Author: ![espenbo](https://avatars.discourse-cdn.com/v4/letter/e/c57346/32.png) [@espenbo](https://www.wago.community/u/espenbo) #### Post date: [January 11, 2025, 11:38pm UTC](https://www.wago.community/t/ssl-certificates/807/4 "2025-01-11T23:38:47Z")
Hello, Has anyone successfully used Let’s Encrypt to generate and automatically update SSL certificates for OPC UA communication in a WAGO-based automation setup? If so, could you share any insights or recommendations on the process. ---
### Author: ![quenorha](https://sea2.discourse-cdn.com/flex016/user_avatar/www.wago.community/quenorha/32/429_2.png) [@quenorha](https://www.wago.community/u/quenorha) #### Post date: [January 13, 2025, 7:38am UTC](https://www.wago.community/t/ssl-certificates/807/5 "2025-01-13T07:38:50Z")
I’ve not tried with Let’s encrypt, and last time I tried with a PKI (self-signed certificate created with openssl) I wasn’t able to set it up. If you have any information I’m also interested ! > [@Tech Note: 3S Runtime with OPC UA Server](https://www.wago.community/t/tech-note-3s-runtime-with-opc-ua-server/305/9): > > Does anyone have successfully create his own certificates using openssl and not CODESYS ? The aim is to add the IP in the SubjectAltName, which is not part of the CODESYS generated certificates (only DNS is provided). Sor far here is what I’ve done : Create a ssl.conf file : [req] default\_bits = 3072 serial = 0 default\_md = sha256 distinguished\_name = subject req\_extensions = req\_ext x509\_extensions = req\_ext string\_mask = utf8only prompt = no [req\_ext] basicConstraints = critical, CA:T…