ℹ️ Available starting with QuickHMI 14.12.1

The Certificate Manager manages all QuickHMI server identities and trust relationships in a central location. It replaces the previous, scattered certificate configuration (global SSL/OPC keystores).

With the Certificate Manager, you can:

• create, import, export, replace, and delete your own certificates,
• Specify which certificate serves as the default for TLS (web interface) or the application (OPC UA identity),
• control which remote certificates are trusted,
• Assign a separate TLS certificate to each port.

Where can I find the Certificate Manager?

The Certificate Manager is available in three locations and accesses the same central storage from all of them:

• in the RuntimeManager (graphical user interface),
• in the ConsoleRuntimeManager (headless/CLI configuration),
• From within the editor: Project Explorer → Security → Certificates.

Note: When you first launch QuickHMI, it automatically generates self-signed default certificates (TLS and Application) using the local hostname and local IP addresses. You can get started right away and customize the certificates later.

Structure

The navigation bar divides the Manager into the following sections:

• Overview – displays the active default certificates and warnings (expired certificates, new rejected certificates).
• Custom Certificates – Certificates that include a private key; see Custom Certificates & Standard Certificates.
• Issuer, Trusted, Rejected – Trust Management; see Manage Trust.
• TLS mappings – port-specific certificates; see TLS mappings.
• Log – History of all certificate actions.

The Overview

The overview shows the two active default certificates:

• Standard TLS – for TLS-secured connections (e.g., web interface, opc.https, MQTT over TLS/WSS, …)
• Standard Application – the application identity (e.g., OPC UA)

You can change the defaults on the page Custom Certificates & Standard Certificates .

The Minutes

The log lists all certificate actions (creation, import, export, default changed, assignment, trust, etc.) along with the timestamp and the user who performed the action.

In the ConsoleRuntimeManager

The ConsoleRuntimeManager offers the same set of features without a user interface via the “Certificate Manager” menu:

Certificate Manager
0: Exit
1: Own certificates
2: Issuer certificates
3: Trusted certificates
4: Rejected certificates
5: Default certificates
6: TLS assignments
7: Event log

The submenus correspond to the sections described in this topic.

Migration from Older Versions

During the update, existing global SSL/OPC application keystores are automatically transferred to the central certificate manager. The previous individual global options are no longer available.

⚠️ Behavior Change (OPC): Self-signed OPC UA server certificates are now verified when “Automatically Accept Certificates” is disabled and may need to be approved once. For details, see the pages ” Create OPC Data Sources ” or ” Manage Trust.”