Node certificates
To manage secure communication in a BACnet/SC network, you need three types of certificates:
- A single site (root or intermediate) CA certificate, also called an issuer certificate. The private key of this certificate signs the network’s server and client certificates.
- A client certificate for each node, also called an operational certificate.
- A server certificate for the nodes that host a hub function or nodes that accept direct connections. In some cases, the server certificate can also be used as a client certificate.
This drawing identifies the certificates required to secure the nodes of the BACnet network. A Supervisor station has the same requirements as any other node. Devices at the edge also require certificates.
| Function and comments | Required certificates | Where to configure | Property names | |
|---|---|---|---|---|
 |
Initiate a local hub connection to the node’s hub function or direct connections to other nodes | client (identified in green) | Expand and double-click Credentials. | Operational Certificate
|
| Verify the server certificate of another node when initiating a hub or direct connection.
Verify the client certificate submitted by another node when accepting a hub or direct connection. |
site CA (issuer) without its private key (identified in light red)
You may email this certificate. |
Issuer Certificate1
|
||
| Accept a hub or a direct connection initiated by another node | server | Expand and double-click WebService. | Main Https Cert |
|
 |
Initiate a hub connection to a hub or direct connections to other nodes | client (identified in green)
Each node has its own unique client certificate. |
Expand and double-click Credentials. | Operational Certificate |
| Verify the server certificate of another node when initiating a hub or direct connection. | site CA (issuer) without its private key (identified in light red).
You may email this certificate. |
Issuer Certificate1
|
||
 |
Used to sign all client and server certificates | site CA (issuer) with its private key (identified in red)
This certificate’s private key is password protected. Once you finish signing your server and client certificates you must store this certificate securely. Do not email it to anyone. |
Click . | N/A |