Managing Mutual TLS Certificates in Hardware Manager

Hardware Manager uses mutual transport layer security (TLS) to authenticate devices to one another and help prevent unauthorized systems from participating in control or data traffic.

Note By default, certificates are auto-generated, self-signed certificates on each machine. Each certificate management interface supports certificate replacement. If your organization uses centrally issued certificates, use the Set Certificate button to replace the default certificate.

Automatic Certificate Exchange between Host and Target

The Exchange Certificate dialog box includes an Installed Services table that lists services that can automatically exchange certificates. The list consists of installed, available services on both the PC and the remote target. The remote target, functioning as the server, initiates the exchange.

  1. In Hardware Manager, select a remote target and expand the Software section in the right rail.
  2. Click Exchange certificates to open the dialog box.

The Certificate Exchange dialog box.

Note The Unmatched Services table lists services that are only installed on the target. Install the corresponding PC software to enable certificate exchange for these services.

  • For a matched service, review the TLS state and the status of both certificates.

  • Green checkmark—Certificates are valid and exchanged.
  • Orange indicator—Certificates are mismatched or expired.
  • No glyph—TLS is disabled for the service.
  • Select Exchange Certificate to apply pending settings and exchange certificates in the background. Restart the target when prompted. Reopen the Exchange Certificate dialog box to verify TLS status.

Managing Client Certificates

The Manage client certificates dialog box:
  • Lists trusted servers for client services on the device under configuration.
  • Provides interfaces to set a signed certificate for the local device.
  • Allows you to download the local self-signed certificate for deployment.
  1. In Hardware Manager, click Manage client certificates to open the dialog box.
    • Available in the right rail of the Hardware Manager interface.
    • Visible for either a PC or remote target where the installed software causes the device to function as a client.
  2. In the Service list, select the service for which you want to configure server certificates.
  3. Click Add Server to add the certificate for a server connection for the selected service.
    Note During server definition, you must define the server name. If you do not define a server name, Hardware Manager uses a default value.
  4. Complete the steps to add the server certificate. Restart the server if prompted.

The Manage Client Certificates dialog box.

Managing Server Certificates

The Manage server certificates dialog box:

  • Lists and manages trusted client connections for individual server applications.
  • Provides interfaces to set a signed certificate for the local server.
  • Allows you to download the local self-signed certificate for deployment.

You can also use the Enable TLS setting to enable or disable TLS for server-side services.

  1. In Hardware Manager, click Manage server certificates to open the dialog box.
    • Available in the right rail of the Hardware Manager interface.
    • Visible for either a PC or remote target where the installed software causes the device to function as a server.
  2. In the Service list, select the service for which you want to configure client certificates.
  3. Click Add Certificate to add the certificate for a client connection for the selected service.
  4. Complete the steps to add the client certificate. Restart the server if prompted.

The Manage Server Certificates dialog box.

Certificate Exchange between Targets

Use manual certificate transfer when automated exchange is unavailable; for example, in target-to-target communication scenarios. The exact path varies depending on whether each device functions in a client role or server role.

To manually exchange certificates:

  1. Export the certificate for each device. Open Manage client certificates or Manage server certificates and click Download Certificate to retrieve the device certificate.
  2. Transfer each exported certificate to the opposite device with removable media or a trusted file transfer path.
  3. On each device, open Manage client certificates or Manage server certificates. Click Add Server or Add Certificate to load the exchanged certificate and assign a display name, if needed.
  4. Restart the targets if prompted so the updated trust relationship takes effect.