Creating OEM application licenses

The following diagram provides a general overview of the licensing process:

The left part of the diagram (light gray box) illustrates the creation of a License Request File for a TwinCAT 3 license and its verification in the TwinCAT 3 runtime.

The right part of the diagram (dark gray box) illustrates the licensing processes, which are handled by the Beckhoff license server.
The issuing process of an OEM application license is handled by the OEM through signing with the OEM private key. In other words, the Beckhoff license server is not integrated in the OEM application license generation process.

OEM certificates should only be used in a secure environment Since generating an OEM application license requires handling of the OEM certificate and its password, the process should only be carried out in an environment that is protected against malicious software (= hardened, protected PC), in order to prevent the password for the OEM private key being accessed by malicious software.

If the control computer and the engineering computer are separate devices, the process flow looks as follows:

Server hardening means reducing the attack surface and ensuring a secure, traceable operational state on an ongoing basis. To this end, the BSI provides general recommendations for securing servers.

Examples of practical key measures:

• Minimizing installed software and active service processes
• Strict firewall
• Monitoring by antivirus solutions
• Minimum access rights for a limited number of people and processes
• Only for the specific purpose they need
• An effective backup and restore strategy practiced on a regular basis
• …