Accessing secured Smartserver from Inductive automation Ignition

What security protocols are enabled on the SmartServer PC?  Type "Internet" in the win10 search box and edit the internet options.

Select "Advanced" tab. 

Scroll to bottom of list.

TLS below 1.3 should be disabled.

SSL below 3.0 should be disabled.

If everything starts working for this project, be aware other things might quit working, especially if the windows active directory / domain require one of the disabled security protocols to work properly. 

cam0217

Hello everyone,

I am currently working on a project where we use Inductive Automation Ignition 8.0.17 (vision module) to connect to a Siemens TP 1500 Comfort which is associated to a Siemens CPU 1515F-2 PN programmed with TIA Portal v16. Environment is Windows 10 Professional.

The idea is to have SmartServer enabled on Siemens side and connect to it securely through a web browser module in Ignition.

For now, we could not make it work from Siemens to Ignition.

We extracted the certificate from the Internet Explorer Smartserver web page. We installed that certificate into the 'Trusted Root Certification Authorities' in the windows certificate manager. This worked and secured the connection between IE and Smartserver.
From there, I tried adding the certificate into Ignition directories so it can load with the Ignition gateway which seemed to work as it can be seen in the Ignition gateway configuration.
The problem is connecting to the SmartServer doesn't work from there, we get the following error :

ERR_SSL_PROTOCOL_ERROR

I spent the morning trying various parameters in the Ignition.conf file with an Ignition expert. This is the file where we can specify options for the Ignition gateway.
Basically, here is part of the report of the Ignition Expert:

Ignition is trying to get an application developed in TIA Portal.
Ignition has all the parameters activated to get the app which makes me think that the access restriction must be on the Siemens side.
I was thinking about the referrer-policy which might be disabled in TIA Portal. These are usual restrictions for security purposes.

See Gateway Security HTTP Headers and Configuration for documentation on HTTP responses.

 

Even though we are not entirely sure that everything is OK on Ignition side I thought I should seek help here 

Any help with stuff to look for in TIA Portal would be helpful.
I am not  familiar with TIA Portal as it is programmed by our sub-contractor but I do have a VM with TIA Portal v16 with the project loaded so I can take a look at currently set parameters and report here.

Thank you very much for your help with this matter.