Using TIA portal 18,
PLC 6ES7 517-3AP00-0AB0 (V2.9) = TLS Client
External device = TLS Server

I want to use TCON with TCON_IP_V4_SEC to create a TLS connection from the PLC to the server.

Currently I am ending up with status 16#0000_80E1 (Error during handshake). As usual, this error can consist of 5 different causes, and AFAIK it is impossible to find out which of these 5 causes is the problem.I can also get status 80E2 or 80E4 depending on the configuration that I make for TLSServerCertRef and TLSClientCertRef

 

The comment for ExtTLSCapabilities states: "Bit 0: Just for client side: validate given IPv4 address against the subjectAlternateName of the server’s X.509 V3 certificate; Bit 1..15: for further extensions"

While the helpfile says "Bit 0: Only for the client side. A set bit means that the client validates the subjectAlternateName in the X.509-V3 certificate of the server to check the identity of the server. The certificates are checked when the connection is established"

According to the comment in the TCON_IP_V4_SEC it will validate the IP address, while I need to validate the hostname.

In C# (.NET8)  I have a testprogram using a

TcpClient("172.16.62.21", 8081)

with a SslStream(). on the SslStream I have to execute

sslStream.AuthenticateAsClient(servername, certCollection, false);

Where servername is the hostname of the server with the IP address used in TcpClient.

CertCollection contains the same certificate as in the PLC "Device certificate" with ID 25.
The Windows PC "Trusted Root Certificate Authorities" has the same certificate as in the PLC "Trusted certificates and root certificats" (this windows PC runs the C# project)

How can I enter the hostname (hardcoded) in the PLC to be used to authenticate in the same way as it is done in the C# program ?

According to the comment it will use the IP address. If I try that in C# the connection is not correct.
The connection will only work with hostname, not with IP address.

This is what the helpfile says for 80E1.

5 possible causes. Is there any way to know WHICH is casuing the error ? If it is not possible to know which one of the 5 is causing the problem, it is nearly impossible to find the cause.

I did, until error 80E1 occurs, and not possible to get any further.

I need to use the server hostname for TLS authentication, not the IPv4 address. How can I do that ? Please guide me where I can find instructions in the manual to do so.

Exectly that example fails with error 80E1 as I need to use HOSTNAME while ExtTlsCapabilities only supports 0 or 1 (IPv4 address)