dl-breadcrumbs__homedl-breadcrumb-item__separatorConfiguration and programmingdl-breadcrumb-item__separatorProgramming with CODESYSdl-breadcrumb-item__separator...dl-breadcrumb-item__separatorAutomation Builderdl-breadcrumb-item__separatorProgramming of Applications dl-breadcrumb-item__separatorProtecting an Application dl-breadcrumb-item__separatorEncrypting an application with a certificate
dl-pagination__prev-inactivedl-pagination__prev-activedl-pagination__next-inactivedl-pagination__next-active
Encrypting an application with a certificate dl-permalink__symbolPermalink

To make sure that the boot application data is transferred in an unreadable form, you should encrypt it using certificate-based encryption. License-based encryption (dongle) is no longer recommended.

Note: In case you want to download the application to different controllers, you will need the suitable certificate for each controller.

Requirement: You have a project with an application.

  1. In the device tree, select the application.

  2. In the context menu, click Properties.

    The Properties – <application name> dialog opens.

  3. Click the Security tab.

  4. For Protection, select the Encryption with certificates option.

    If the Enforce encryption of downloads, online changes and boot applications option is selected on the Users tab in the Security Level area of the Security Screen view, then the Encryption with certificates option is already permanently set.

    The Certificates for encryption dialog field is enabled.

  5. If you already have a valid certificate for application encryption on your computer, but this has not yet been entered in the table, then click the  button. If you do not yet have a certificate, continue with Step 7.

    The Certificate Selection dialog opens for selecting a certificate from the local Windows Certificate Store.

  6. In the lower area, select a certificate and add it to the upper area by clicking the  button. Click OK to confirm.

    The certificate is shown in the Certificates for encryption field of the Security dialog.

  7. If you do not yet have a valid certificate, then you can immediately generate one. In the Properties dialog of the application, click the Encryption Wizard button. In the Encryption Wizard dialog, click the Start button.

    The Encryption Wizard prompts you to enter the Key length (bit) and Validity period (days).

    Now the application can only be read by the controller with the specified certificate.

  8. Note: To sign the boot application: In the Properties dialog, select the Digitally sign application code option and complete Steps 1–13 of the "Signing the boot application only with a certificate (no encryption)" instructions below.