Cryptography Next Generation (CNG) Certificates

This chapter gives an overview of how Cryptography Next Generation (CNG) support works in WinCC OA. It also includes detailed technical explanations and diagrams to help you understand better.

Microsoft's Cryptography API: Next Generation (CNG) is the modern Windows framework for handling all cryptographic tasks, like managing certificates and private keys. Many of these keys are kept in the CNG Key Storage Providers (KSPs), which follow strict security rules. One important rule is the non-exportability policy, which ensures that the private parts of the keys never leave the secure store.

Normally, OpenSSL cannot directly access the CNG KSP. This makes it hard to use Windows-managed certificates and keys in OpenSSL-based programs, such as WinCC OA. The new CNG Provider for OpenSSL solves this problem by creating a smooth connection between OpenSSL and Windows cryptographic services. It lets OpenSSL list, use, and work with CNG-protected keys without breaking their non-exportability rules.

What is an OpenSSL Provider?

An OpenSSL Provider is a component added in OpenSSL 3.0 as part of its new provider-based architecture. Providers enable OpenSSL to manage various cryptographic algorithms, key management systems, and other features. This flexible framework allows OpenSSL to work with external libraries, services, or hardware devices, making it more versatile and easier to extend.