Certificate Installation for HTTPS Communication

Installing the certificate is a required commissioning step for any client that communicates with the solution over HTTPS (for example a .NET-based order management or PLC integration).

The solution is served over HTTPS using a self-signed certificate. Until the client machine trusts this certificate, every HTTPS request is rejected before any data is exchanged. This is independent of the specific request being made — it is not caused by submitting an order, it is a prerequisite for establishing the secure connection at all.

Why It Is Needed

A client only accepts an HTTPS connection when it can verify the server's certificate against a trusted authority. Because the certificate is self-signed, it must be added manually to the client machine's trusted root store during commissioning. If this step is skipped, connections fail with a message such as:

The underlying connection was closed:
Could not establish trust relationship for the SSL/TLS secure channel.

Downloading the Certificate

Download the public certificate on the client machine:

  • Web interface: Options > Download Certificate in the top navigation bar.
  • API endpoint: GET /api/download-cert

The downloaded file is named palletizing_root_cert.crt.

Verify the Downloaded File

Before installing, confirm the file is a real certificate and not an HTML error page:

certutil -dump "C:\path\palletizing_root_cert.crt"

This should print the certificate details (issuer, validity period, SAN). If it errors or you see HTML text, re-download the file via Options > Download Certificate.

Installing the Certificate on Windows

The certificate must be placed in the Local Machine → Trusted Root Certification Authorities store. Use Local Machine (not Current User), because clients that run as a Windows service under a system account read from the machine store.

If double-clicking the .crt file does not offer an Install Certificate… button (e.g. the file opens in a text editor because of a wrong file association), import it directly using one of the following, run as Administrator:

PowerShell

Import-Certificate -FilePath "C:\path\palletizing_root_cert.crt" -CertStoreLocation Cert:\LocalMachine\Root

certutil

certutil -addstore -f "Root" "C:\path\palletizing_root_cert.crt"

MMC snap-in

  1. Run certlm.msc (opens the Local Machine certificate store directly).
  2. Navigate to Trusted Root Certification Authorities → Certificates.
  3. Right-click → All Tasks → Import… and follow the wizard.

After importing, restart the client application or service.

Additional Requirements

  • Matching hostname: The client must call the exact hostname listed in the certificate's subjectAltName (SAN), not a raw IP address or a different alias.
  • TLS version: Older .NET Framework clients may default to an outdated protocol. Force TLS 1.2 in the client code:

csharp ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12; * Certificate validity: Ensure the certificate is not expired and the client machine's date and time are correct, as certificate validation is time-dependent.