Community

I am trying to get MxProxy working with cngCert in WinCC OA 3.21.5.

The proxy runs on the server. I use certificates issued by a Windows CA with a custom template:
- RSA-4096
- Allow private key to be exported
- Authorize additional server accounts to access the private key
- EKU: Client Authentication + Server Authentication
- Key Usage: Digital Signature + Key Encipherment
- Key Usage extension is critical

The service account and computer account both have access to the private key.

Server:
[general]
data = "PMS10TEST02001"
event = "PMS10TEST02001"
securityMode = "cngCert"
cngCA = "MACHINE:ROOT"
cngCert = "MACHINE:MY:b2de45acae8f506951062d4952b18e0f8a3d20e7"

[proxy]
server = "PMS10TEST02001:4897"
server = "PMS10TEST02001:4998"


Client:
[general]
data = "PMS10TEST02001"
event = "PMS10TEST02001"
securityMode = "cngCert"
cngCA = "MACHINE:ROOT"
cngCert = "MACHINE:MY:a13e94aa52ce75cc16e8fe92ff08662834607eee"
mxProxy = "PMS10TEST02001 PMS10TEST02001 cngCert"

The CNG documentation explicitly shows cngCert and an MxProxy example:
https://www.winccoa.com/documentation/WinCCOA/latest/en_US/cng_certs/cng_certs/topics/cng_certs_config.html#cng_certs_config__section_rvq_xsy_f3c

However, the central securityMode reference only lists "cert | winCert":
https://www.winccoa.com/documentation/WinCCOA/latest/en_US/config_entries/sections/all__SPACE__sections.html#allsections__securityMode

Is this a documentation error, or is cngCert handled separately in 3.21.5? With cngCert the connection works, but even after the certificate expires it appears to remain connected.

With winCert I get:
WCCOAui (1), 2026.09.15 08:50:40.863, PARAM,SEVERE, 215, Private key for Certificate (...) is required.
WCCOAui (1), 2026.09.15 08:50:40.863, SYS, FATAL, 63, Connection error, create connection failed! Invalid argument

The private key uses a CNG Key Storage Provider (KSP), not a legacy CSP. Could KSP vs CSP be the reason for the winCert error? Is RSA-4096/KSP supported for MxProxy in WinCC OA 3.21.5?

Also, i have set the forcekeyprotection to 0 does the forcekeyprotection requirement from this documentation apply to cngCert as well?
https://www.winccoa.com/documentation/WinCCOA/latest/en_US/Authentication/WindowsCertStore/topics/certificates_windowscertstore_mxproxy_certs.html

Relevant documentation:
https://www.winccoa.com/documentation/WinCCOA/latest/en_US/cng_certs/cng_certs/topics/cng_certs_create_certs.html
https://www.winccoa.com/documentation/WinCCOA/latest/en_US/Multiplexing_Proxy/Multiplexing_Proxy-03.html
https://www.winccoa.com/documentation/WinCCOA/latest/en_US/config_entries/sections/general.html#cngCA
https://www.winccoa.com/documentation/WinCCOA/latest/en_US/config_entries/sections/general.html#cngCert

Thanks for helping!