Hi everyone,

After upgrading WinCC Unified PC Runtime from V18 Update 3 to V18 Update 5 (18.5), our SIMATIC HMI Option+ IPC V1.1.13 can no longer open an OPC UA session.

Environment

• Runtime WinCC Unified PC RT V18 U5 (Windows 10 IoT LTSC 2021)
• Option+ IPC V1.1.13, clean install
• Endpoint opc.tcp://<PC>:4890, Basic256Sha256 / Sign & Encrypt
• Test UaExpert connects fine (server shows the policy correctly)

Symptom

In the Unified Certificate Manager the Option+ certificate turns green, but flips back to yellow when I close and reopen the manager.
Option+ Runtime log loops with:

Connect: Exception occurred: Opc.Ua.ServiceResultException: Error establishing a connection: Error received from remote host: at Opc.Ua.Bindings.ChannelAsyncOperation`1.End(Int32 timeout, Boolean throwOnError) at Opc.Ua.Bindings.UaSCUaBinaryClientChannel.EndSendRequest(IAsyncResult result) at Opc.Ua.SessionClient.CreateSession(RequestHeader requestHeader, ApplicationDescription clientDescription, String serverUri, String endpointUrl, String sessionName, Byte[] clientNonce, Byte[] clientCertificate, Double requestedSessionTimeout, UInt32 maxResponseMessageSize, NodeId& sessionId, NodeId& authenticationToken, Double& revisedSessionTimeout, Byte[]& serverNonce, Byte[]& serverCertificate, EndpointDescriptionCollection& serverEndpoints, SignedSoftwareCertificateCollection& serverSoftwareCertificates, SignatureData& serverSignature, UInt32& maxRequestMessageSize) at Opc.Ua.Client.Session.Open(String sessionName, UInt32 sessionTimeout, IUserIdentity identity, IList`1 preferredLocales, Boolean checkDomain) at Opc.Ua.Client.Session.<Create>d__78.MoveNext()

What I’ve tried

1. Fresh CA in Unified; certificates trusted on both sides; cleared pki folders.
2. Edited IpcConfiguration.xml to request Basic256Sha256.
3. Manually created an RSA-2048 certificate for Option+ 

Suspected cause

Option+ V1.1.13 still creates 1024-bit keys, while Unified V18 U5 now requires ≥ 2048 bits for Basic256Sha256. I’ve heard about a hot-fix Option+ IPC V1.1.15 (internal tag PMD 108012794) that solves this, but it isn’t publicly available.

Questions to the community

1. Has anyone run into this?
2. Any workaround (without falling back to Basic128Rsa15) on version 1.1.13?
3. Has anyone received the SimaticHmiOptionPlus_IPC_V1_1_15.exe or knows how to get it?

Any tips appreciated — I need Update 5 for its stability fixes, but can’t lose the Option+ monitoring.

Thanks in advance!