Fixing WinCC Unified V17 Non-Integrated Connection PLC Certificate Errors

When a WinCC Unified V17 Runtime client is configured against a SIMATIC PLC that lives in a separate TIA Portal project (a so-called non-integrated connection), the HMI often refuses to come online and surfaces a TLS/certificate warning. The failure is not a wiring, IP, or PG/PC interface problem: it is the TIA Portal V17 security model refusing to trust the remote controller. This reference walks through the architecture, the root cause, the step-by-step certificate import, PLCSIM Advanced V4.0 specifics, the device-proxy fallback, and a verification matrix that takes a non-integrated Unified station from "red X" to green.

1. Architecture: Integrated vs Non-Integrated Connection

Understanding the difference between an integrated and a non-integrated connection is the prerequisite for understanding the certificate error. In TIA Portal, the type of connection is selected when you drag a PLC onto an HMI device or when you create an HMI connection node manually under Connections > HMI connections.

Non-integrated is not "unsupported"; it is a legitimate topology. The catch is that the security model in TIA Portal V17 onward no longer accepts the PLC's certificate silently. The Unified Runtime evaluates the certificate chain on every connection attempt, and if the PLC's issuer is not in its trust store, the connection is rejected before any tag read can occur.

2. Symptom Matrix: What the User Actually Sees

Depending on the build of WinCC Unified PC RT (V17.0, V17.0.1, V17 Update 3, or V17 Update 5) and whether the diagnostic channel is enabled, the failure surfaces in several different ways. The table below maps the visible symptom to the underlying TIA Portal state.

3. Root Cause: TIA Portal V17 Security Model

Starting with TIA Portal V17, the connection between an HMI panel (or Unified PC RT) and a SIMATIC controller is protected by mutual TLS. Each side presents an X.509 certificate, and each side must trust the other side's issuer. The protection is enabled by default and is enforced by the Secure PG/PC and HMI Communication project property, which lives in Project tree > [CPU] > Properties > Protection & Security > Connection mechanisms.

For an integrated connection, TIA Portal signs both the HMI configuration and the PLC configuration with the same project fingerprint during compile, so the trust is implicit. For a non-integrated connection, the two fingerprints are independent. The PLC keeps its own self-signed certificate (or a CA-signed certificate if the customer has rolled out PKI), and the Unified Runtime has never seen that certificate before. The connection is therefore rejected with an SSL_ERROR_HANDSHAKE translated into the Unified-specific error string "certificate is not trusted".

Siemens documents this exact scenario in entry ID 109799540 in the Siemens Industry Online Support. The KB is the canonical procedure for importing a controller's certificate into the Unified Runtime trust store. The remainder of this article implements that procedure end-to-end.

4. Prerequisites

Before touching certificates, confirm that the lower layers of the stack are working. The following checks eliminate false positives.

1. PG/PC interface on the engineering station: set to S7ONLINE -> TCP/IP -> [your NIC] in Control Panel > Set PG/PC Interface. Verify with Online > Accessible nodes: the PLC must appear with its IP and rack/slot.
2. Unified Runtime target must be reachable from the engineering station. Confirm with ping and telnet <plc-ip> 102; ISO-on-TCP uses TCP port 102.
3. PLCSIM Advanced V4.0 instance must be running in Accessible nodes with a softbus license seat. Set PLCSIM Advanced Virtual Ethernet Adapter as the PG/PC interface when the simulator is local, or as a routable IP if the simulator is on a remote workstation.
4. Unified PC RT V17 must be installed, and the project must be loaded to the RT at least once with RT Loader so that the trust store directory exists on disk.
5. Administrative rights on the PC running the RT, because the certificate store lives under %ProgramData%\Siemens\Automation\CertStore\Unified\RT.

5. Step-by-Step Solution: Import the PLC Certificate

The procedure is identical whether the remote PLC is real, a PLCSIM Advanced instance, or a soft controller. The only variable is where you read the certificate from.

5.1 Export the certificate from the PLC

1. Open the PLC project in TIA Portal V17.
2. Right-click the CPU in the project tree, choose Properties > Protection & Security > Certificate manager.
3. Select the entry whose Subject matches the CPU's serial number or device name; this is the Device certificate (often labeled S7-1500 with role Controller).
4. Click Export and save the file as PLC_Controller.cer (DER format). Note the file path; you will copy it to the RT machine.

For PLCSIM Advanced V4.0, the certificate is generated the first time the simulated CPU is started. If you skipped the certificate export wizard, the file lives at %ProgramData%\Siemens\Automation\PLCSIM\Certificates\<InstanceID>\controller.cer.

5.2 Transfer the certificate to the RT machine

Use a USB stick, a file share, or a WinSCP session. Do not paste the certificate through a clipboard encoder: a single corrupted byte turns the trust chain invalid.

5.3 Import into the Unified Runtime trust store

There are two accepted methods. Pick the one that matches your workflow.

Method A — HMI Certificate Manager (recommended for most engineers).

1. On the RT machine, open Start > Siemens Automation > WinCC Unified > Certificate Manager.
2. Switch to the Trusted devices tab.
3. Click Add, browse to PLC_Controller.cer, confirm the SHA-256 fingerprint matches what the CPU displays.
4. Restart the Unified Runtime service: net stop "Siemens WinCC Unified RT" && net start "Siemens WinCC Unified RT".

Method B — Direct file placement (scriptable, used in OEM builds).

1. Copy PLC_Controller.cer to C:\ProgramData\Siemens\Automation\CertStore\Unified\RT\Trusted\.
2. If the directory does not exist, create it.
3. Recreate the trust index by running Siemens.Automation.CertStoreRefresh.exe (found in the Unified RT installation directory), or restart the RT service as in Method A.

5.4 Verify in TIA Portal

1. Back on the engineering station, open the Unified project.
2. Select Connections > [your HMI connection] > Properties > Connection mechanisms.
3. The status of the partner should now read Certificate is trusted; the previous red icon turns green.
4. Compile the HMI and download to the Unified RT again so the new connection metadata is on the target.

6. PLCSIM Advanced V4.0: Specific Considerations

PLCSIM Advanced is the most common environment for engineers who first hit this error, because a non-integrated connection is often built up specifically to test the scenario where the PLC project and the HMI project live on different TIA Portal instances. Two configuration points are easy to miss.

PLCSIM Advanced V4.0 added an explicit Export certificate for external HMI button on the instance's ribbon. If you use it, the resulting file already matches the format expected by the Unified trust store and can be dropped directly into CertStore\Unified\RT\Trusted without re-export from TIA Portal.

7. The Device-Proxy Fallback

When an engineer cannot solve the certificate import in a reasonable time, the most common workaround reported in the field is to convert the non-integrated HMI connection into an integrated one through a device proxy. A device proxy is a TIA Portal object that embeds a remote PLC into the local project. Behind the scenes, the proxy carries the remote PLC's certificate, and the resulting HMI connection is treated as integrated by the compiler.

1. In the HMI project's TIA Portal, right-click Devices & networks > Add new device > PLC > SIMATIC S7-1500 > Device proxy.
2. Point the proxy at the remote project's TIA file (a TIA Portal export package, file extension .zip).
3. Drag a connection from the HMI to the proxied PLC. The connection is now integrated from the compiler's point of view, and the certificate trust is automatic.
4. Compile and download. Connection comes online.

8. Verification Procedure

After the import, run the following checks in order. Each one is a gate; if it fails, fix it before moving on.

1. Service health: Get-Service "Siemens WinCC Unified RT" must return Running.
2. Trust-store presence: dir "C:\ProgramData\Siemens\Automation\CertStore\Unified\RT\Trusted\PLC_Controller.cer" must show the file with the expected byte count.
3. Connection status: in the Unified RT diagnostics view, the connection state transitions from Not connected (certificate error) to Establishing to Connected within five seconds.
4. Tag read: force a value at the PLC (e.g. MW0 := 1234 in the PLCSIM Advanced watch table) and read the corresponding HMI tag in the diagnostics view. The value must update within 1 s.
5. Log scan: tail the Connection.log and confirm there are no 0x80131500 or SEC_E_UNTRUSTED_ROOT entries for the connection in question.
6. Survive restart: reboot the RT machine. The connection must re-establish automatically without operator intervention. This confirms the trust is persisted, not just cached in memory.

9. Troubleshooting Matrix

10. Long-Term Best Practice: Roll Out a Project-Specific CA

For organizations that run many non-integrated connections, importing one certificate per PLC does not scale. TIA Portal V17 onward supports a Certificate Authority project property where the engineer generates a project-wide CA, signs every CPU and every HMI with that CA, and the Unified Runtime only has to trust the CA once. The flow is:

1. Open the PLC project, Properties > Protection & Security > Certificate authority.
2. Click Create CA; provide a name and validity (recommended: 5 years).
3. Export the CA's public certificate (ProjectCA.cer).
4. Import ProjectCA.cer into the Unified RT trust store, into the Issuers folder rather than the Trusted devices folder, so any CPU signed by this CA is automatically trusted.
5. Repeat for every PLC. No further per-CPU import is needed.

This setup survives CPU firmware updates as long as the CPU is re-signed with the same CA, which happens automatically if the engineer keeps Auto-update device certificates enabled.

11. Field-Proven Caveats

• Antivirus exclusion. Some endpoint protection suites quarantine CertStoreRefresh.exe as a "credential manager". Add the entire C:\ProgramData\Siemens\Automation tree to the AV exclusion list on the RT machine.
• Domain vs. workgroup. If the RT machine is in a workgroup and the PLC is in a domain, certificate validation by the local policy still works as long as the certificates are X.509 v3; the problem is with NTLM/Kerberos, not with X.509. The two should not be conflated.
• CPU firmware 2.9 boundary. S7-1500 CPUs older than firmware 2.9 do not support the V17 security model. Upgrade firmware or fall back to V16 RT for those CPUs.
• Unified RT upgrade in place. When you upgrade Unified RT from V17.0 to V17 Update 5, the trust store is preserved, but the index is rebuilt on first start. Plan for a 30-60 s boot delay during that rebuild.
• Cloud-bridged connections. If the PLC is reached through a Siemens Industrial Edge or a Teamcenter bridge, the bridge must be added to the trust store as a forwarding proxy, and its certificate must include the Subject Alternative Name matching the bridged PLC's IP.

12. Standards and References

Two ISO/IEC documents anchor the design decisions above and are worth keeping in the project folder:

• IEC 62443-3-3 — System security requirements and security levels, which is what the V17 certificate model implements in practice.
• RFC 5246 / RFC 8446 — TLS 1.2 and TLS 1.3 specifications; Unified PC RT negotiates TLS 1.2 with mutual authentication, so the PLC cert must include the id-kp-clientAuth extended-key-usage flag.