Resolving SmartClient Android Access Failures on Siemens HMI

1. Problem Statement

Field reports describe a consistent access asymmetry on Siemens Unified Comfort Panels (UCP) and compatible SIMATIC HMI devices that run the integrated SmartServer web service: a Windows PC equipped with a VNC viewer (TigerVNC, RealVNC, TightVNC) can establish a remote session to the HMI, while a smartphone running the Android SmartClient app (or the SINEMA Remote Connect client) cannot reach the same panel over what appears to be the same WAN connection.

The two endpoints share an identical logical destination (the HMI's LAN IP and TCP/5900 or TCP/443), but the Android client fails to complete the TLS handshake, fails to resolve the panel hostname, or fails to receive a route through the active VPN tunnel. Because the PC succeeds, the failure is almost always attributable to one of the following layers:

• Per-device VPN client configuration and certificate assignment on the phone.
• Different routing table on the Android device (split-tunnel behavior, IPv6 preference, captive portal).
• SmartClient-specific authentication material (X.509 certificate) that is not present in the PC's VNC client.
• DNS or IP target mismatch between what the VNC client and the SmartClient use to address the panel.

2. Architecture: SmartServer, SmartClient, VNC, and Sinema RC

Understanding the difference between the two remote-access paths is the prerequisite to every diagnostic step.

According to the Siemens Unified Comfort Panels documentation, "If the SmartServer is started on an HMI device, you can access the HMI device via the SmartClient application or a VNC client, such as TigerVNC." Both clients can be active concurrently and they do not share session state, credentials, or certificate stores. Each client must therefore be validated independently.

3. Root Cause Analysis

When a PC reaches the panel and a phone does not, the engineer should walk a four-layer model. The first layer to fail is the one to fix.

3.1 Layer 1 — IP Reachability

The phone must have a valid route to the panel's LAN IP (typically 192.168.x.y or 10.x.x.y). If the phone is on a cellular network and the panel is behind an office router, the route does not exist unless a VPN tunnel is up. The PC in the report works because it is on the same LAN as the panel or because it has an OpenVPN / IPsec tunnel that is already established.

3.2 Layer 2 — VPN Tunnel Establishment

Sinema RC issues a per-device X.509 certificate. The certificate must be installed in the phone's user certificate store (Android: Settings → Security → Encryption & credentials → Install a certificate → VPN & app certificate). If only the CA certificate is installed and the client certificate is missing, the OpenVPN session will appear connected (icon visible) but the tunnel will not pass traffic, and the SmartClient login screen will time out.

3.3 Layer 3 — DNS / Target Address

The VNC client on the PC is typically configured with a numeric IP (e.g. 192.168.0.10), while the SmartClient on the phone is typically configured with a hostname (e.g. hmi-line1.plant.local). When the phone cannot resolve the hostname, the SmartClient sits on a white screen while the VNC client on the PC keeps working. This is the single most common misdiagnosis: the engineer concludes that "VPN is up" because the icon is on, when in fact DNS is broken and the SmartClient has no destination.

3.4 Layer 4 — SmartClient Certificate Trust

The SmartClient uses mutual TLS. The panel's SmartServer presents a server certificate; the phone must trust its CA. If the panel's certificate is self-signed and the phone has not been told to trust the issuing CA, the SmartClient will reject the connection after the TLS handshake, with the symptom "Cannot connect to server" and no further detail in the UI.

4. Prerequisites for the Diagnostic

• Panel IP address, subnet mask, and default gateway.
• SmartServer status (must show "Running" in the HMI's Control Panel → Network and Internet → Remote Connection).
• Admin password for the HMI (to enable / disable SmartServer and to load certificates).
• Android phone with the latest SmartClient from the Google Play Store and a ping utility (e.g. PingTools Pro, HE.NET Network Tools).
• PC with the VNC viewer that already works, plus a console cable or SSH to the office router for trace routing.
• The X.509 certificates (CA + client) provisioned for the phone, in .p12 or .pfx format.

5. Step-by-Step Diagnostic Procedure

1. Confirm the SmartServer is running. On the panel, open Control Panel → Network and Internet → Remote Connection. Verify the SmartServer toggle is On and the VNC server toggle matches the PC's working configuration.
2. Verify IP reachability from the phone. Disconnect the phone from Wi-Fi and from any VPN. Open a ping app and ping the panel's LAN IP. If the ping fails, the phone is on a different broadcast domain and you must establish the VPN before continuing.
3. Bring up the VPN. Open the Sinema RC client on the phone. Confirm the status changes to Connected and that the assigned tunnel IP falls inside the expected RFC1918 range (e.g. 10.8.0.x). Re-run the ping. If the ping still fails, the tunnel is up at the icon level but not at the routing level — proceed to step 4.
4. Check the phone's routing table. On Android, install a tool such as Network Analyzer or use adb shell ip route over USB debugging. Verify that the panel subnet has a route through the tunnel interface (tun0). If the route is missing, the OpenVPN client has not pushed the route — the fix is on the SINEMA RC server (route push for the panel subnet).
5. Resolve the hostname locally. If the SmartClient is configured with a hostname, perform an nslookup from the phone. A successful VPN tunnel does not guarantee DNS. Use a numeric IP in the SmartClient as a temporary workaround to isolate the issue.
6. Validate certificate trust. From the phone browser, navigate to https://<panel_ip>/. If the browser raises a certificate warning, the phone does not trust the SmartServer certificate. Install the issuing CA into Android's VPN & app store (not the System store, which Android 7+ refuses to populate without root).
7. Re-test the SmartClient. Launch SmartClient, enter the IP, accept the certificate prompt, and log in. A successful connection is indicated by the panel screen appearing within 3–5 seconds on a typical broadband link.
8. Compare with the PC. On the PC, open the VNC viewer and connect. If the PC connects and the phone does not, the network and panel services are confirmed healthy. The remaining issue is on the phone only.

6. VPN and Certificate Configuration Reference

For installations using SINEMA Remote Connect as the central remote-management platform, every client device (PC, phone, or another HMI) receives a unique X.509 certificate at commissioning. The phone's certificate must be enrolled against the device ID of the phone, not the panel. A common commissioning error is to bind the phone's certificate to the panel's device ID, which produces exactly the symptom described in the source report: VPN icon on, no traffic to the panel.

7. SmartClient vs VNC: Use Cases and Limits

The two clients are not interchangeable. Knowing which to use saves significant commissioning time.

When the use case is "operator wants to see a running line from a phone while walking the plant," the SmartClient is the correct tool. When the use case is "engineer needs a full keyboard and mouse for commissioning," the VNC viewer on a PC is faster. Running both in parallel during commissioning is normal and is the recommended path for first-time setup.

8. Network Reachability Checks in Detail

The "ping from the phone" diagnostic is the single highest-value step in the procedure. Engineers often skip it because they assume the VPN icon means the tunnel is up. The VPN icon indicates only that the OpenVPN process has a peer. The tunnel can be up at the OpenVPN layer and down at the IP layer if any of the following are true:

• The SINEMA RC server has not pushed a route for the panel subnet to the phone.
• The phone's cellular provider is blocking UDP/1194 and only TCP/443 fallback is allowed (verify in the .ovpn profile).
• An Android "private DNS" setting is forcing DNS over TLS to a public resolver, bypassing the corporate DNS push.
• The phone's battery saver or data saver is throttling background VPN traffic.

The corrective action for each is:

1. Edit the phone's .ovpn to include route 192.168.0.0 255.255.255.0 or push it from the SINEMA RC server's device policy.
2. Change the .ovpn proto and port to proto tcp-client, port 443.
3. Disable Android's Private DNS feature (Settings → Network & internet → Private DNS → Off) so the corporate DNS is reachable.
4. Add the Sinema RC client to the data saver exemption list.

9. Sinema RC Configuration Notes

When the customer environment uses SINEMA Remote Connect (the Siemens remote-management server), the SmartClient on the phone is normally used in conjunction with the SINEMA RC client. The SINEMA RC client establishes the tunnel; the SmartClient then connects through the tunnel to the panel's SmartServer. The two apps must be configured in the following order:

1. Install the SINEMA RC client and import the device-specific .ovpn profile.
2. Import the CA certificate into Android's VPN & app store.
3. Import the client certificate (and key) as a .p12 into the same store.
4. Establish the tunnel. Confirm the assigned tunnel IP.
5. Launch SmartClient and point it at the panel's tunnel-side IP or at the hostname published by the SINEMA RC server's address book.

When step 5 is performed before step 4, SmartClient will cache a "host unreachable" error and may require a force-stop to retry. This is a known Android behavior, not a SmartClient bug.

10. Step-by-Step Resolution

1. On the phone, open Settings → Network & internet → VPN and confirm the SINEMA RC profile is present. If only the PC profile is present, export the phone profile from the SINEMA RC server console and import it.
2. Open Settings → Security → Encryption & credentials → Trusted credentials → User tab. Confirm the SINEMA RC CA is listed. If not, copy the .crt to the phone and install it as VPN & app.
3. Open Settings → Security → Encryption & credentials → Install a certificate → VPN & app certificate. Select the .p12 file and enter the device password.
4. Open the SINEMA RC client and tap Connect. The status should report Connected and display the assigned tunnel IP (typically 10.x.x.x).
5. Open a ping utility on the phone and ping the panel's LAN IP. A successful reply confirms the tunnel is forwarding traffic.
6. Open the SmartClient. If the existing connection entry uses a hostname, change it to the numeric IP. If the existing entry is correct, tap Connect. The SmartClient should display the panel screen within 3–5 seconds.
7. If the connection still fails, tap the menu (three dots) → Settings → Enable Verbose log, retry, and inspect the log for TLS error codes. Common codes and their meanings are listed in section 11.
8. Once the SmartClient is connected, restore the hostname entry in the connection profile for future convenience, and verify name resolution with another ping on the hostname.

11. Troubleshooting Matrix

12. Verification

After applying the fix, perform the following four checks before declaring the issue resolved:

1. Ping test: From the phone, ping the panel's LAN IP. A reply within 100 ms on a healthy link confirms L3 reachability.
2. Browser test: From the phone browser, navigate to https://<panel_ip>/. The SmartServer landing page should load with no certificate warnings.
3. SmartClient test: Launch the SmartClient, connect, and perform a screen refresh. The latency from tap to on-screen response should be under 250 ms on a healthy broadband or LTE link.
4. Sustained test: Leave the session open for 15 minutes and verify no mid-session disconnects. If a disconnect occurs, capture the verbose log and check the keepalive setting on the SINEMA RC client.

Document the working configuration: panel IP, panel hostname, certificate thumbprint, tunnel IP range, and the phone's device ID in the SINEMA RC server. This avoids repeating the diagnosis on the next device.

13. Field-Proven Caveats

• Android 7+ refuses to install CA certificates into the System store without root. Always install into the VPN & app store.
• The SmartClient does not always refresh its connection cache. After a network change (Wi-Fi ↔ LTE), force-stop the SmartClient and relaunch.
• The panel's SmartServer and the panel's VNC server are independent services. A firmware update can change one without changing the other; verify both after every panel update.
• If the PC's VNC client was set up before the phone, the PC's VNC connection may be holding an ARP entry that the phone cannot claim. A router-side ARP refresh (or simply waiting for the entry to age out) is sometimes the only remaining step.
• When the customer reports "the phone stopped working yesterday," check the phone's OS update. A patch-level Android update can change the default certificate trust store and silently invalidate a previously working VPN & app certificate.

14. Standards and Reference Documentation

For the underlying network and TLS behavior, the following standards and Siemens documentation are the authoritative references. The panel's remote-connection chapter, in particular, defines the supported clients and the ports the SmartServer and VNC server listen on.

• Siemens Unified Comfort Panels — Operating the control panel → Network and Internet → Remote Connection: docs.tia.siemens.cloud — Remote Connection
• RFC 5246 — The Transport Layer Security (TLS) Protocol Version 1.2 (mutual TLS used by SmartClient).
• RFC 6143 — The Remote Framebuffer Protocol (used by VNC).

FAQ