Security Profile: Installing apps
Installing apps can compromise security
Before installing an app, you must perform a risk and threat analysis of the app and its impact on the security of the device and the application, taking into account the overall security context. In particular, investigate the following effects on the device and application:
- Data critically estimation
- Data in rest
- Data in transmission
- Integrity and authenticity
- PLCnext User Management
- Communication configuration (e. g. network interfaces, ports) and firewall integration
- Least functionality strategy
- Notifications
- Mobile and malicious code protection
To install apps, you must have admin rights. Otherwise, it is not possible to check and adjust the configurations in the WBM that may have been changed by the app due to the lack of access to the App Manager.
To install and license apps from the PLCnext Store, the App Manager must be activated. The App Manager is activated by default.
You install apps on the App management page (System → App management) in the WBM.
Security note To make sure that software or firmware files downloaded via internet have not been corrupted or tampered, perform an integrity check of the downloaded files. You can find further information in Integrity check of downloaded files.
For information on license management, refer to the main PLCnext Technology - Info Center or to the PLCnext Store - Info Center.
After you have installed the app, you must check which user rights, firewall settings and System Services the app requires.
- Make the required settings in the WBM, taking into account the risk and threat analysis performed.
- After app installation, check the System Services settings.
Apps can activate or deactivate System Services during installation. For example, when you launch container apps, the controller automatically reboots. This causes the App Manger to be deactivated if a Security Profile is active. You must re-activate the App Manger to check the installed apps or to install additional apps.
On the App management page (System → App management) in the WBM, the secure installation of apps and on the device can be handled. This page can be made unavailable by deactivating the App Manager service. If the App management entry is missing in the left-side navigation, check and maybe change the status of the App Manager service in the System → System services page. The App Manager is activated by default.
Note: Access to the specific pages in the WBM depends on user roles and their rights - see Accessibility for details.
PLCnext Technology Apps tab
PLCnext Technology Apps are provided in the PLCnext Store for direct installation to the decive (called "online installation"), or for download to the computer and installation via this Web‑based Management page (called "offline installation"). See PLCnext Store resources for more details.
App licenses
Developers of PLCnext Technology Apps distributed in the PLCnext Store can tie the use of their apps to a chargeable license. The license check result is displayed in this page for each installed app.
If the license check says Missing (No function), you need a license for the corresponding app. In that case, purchase, install and activate a license in the System → License management page.
App signatures
Signing apps and checking those signatures before using downloaded apps is a measurement to detect tampering. Developers upload their apps in the PLCnext Store preferably with a developer signature. An additional PLCnext Store signature is created automatically after uploading the app to the PLCnext Store.
In this page, the signature verification status is always displayed in the last saved state.
By default, the firmware is set so that users can only install apps with a valid PLCnext Store Developer signature and a PLCnext Store signature.
The signature is always re‑checked when the system is restarted. If the corresponding toggle switch is enabled, the signature is re‑checked when the app is started.
Expiration of time-limited signatures
The app signature includes a signed timestamp, which is verified against the local system time and the certificate in the corresponding Trust Store. The signature is not checked against the app's installation date. Apps that are already running when the time limit expires are keeping their state regardless of the timestamp, but they cannot be started again. After rebooting, if a certificate has expired in the meantime this is also shown in the WBM.
If the signature verification stays enabled (see Configuration), then the signatures of already installed apps are checked at firmware startup. If the app signature is missing, or if its verification fails, then the regarding app is not started. The signature verification result for each app is shown in this page and notifications are generated.
Handling apps
The Admin, the SecurityEngineer and the Engineer user roles are allowed to install apps that have been downloaded from the PLCnext Store before.
- To install an app, click the button and navigate to the location of the regarding .app file on your computer. The following procedure is self-explanatory.
- To uninstall an app, click the trash bin symbol in the regarding facet and follow the instructions.
- To start or stop an app, click the Start or Stop button in the regarding app facet.
Note: If buttons in this page are inactive (gray) then a function is prohibited for reasons:
- If the button is inactive (gray) then the App Manager is busy checking, installing, or uninstalling apps; just wait until the button becomes active (bluegreen) again.
- If the Start button for an app is inactive (gray) then check the license and signature check results:
- If the license check says Missing (No function) then starting that app depends on an active license.
- If the signature check says Invalid or Not available then the signature check failed but only signed apps are allowed (see Configuration).
Configuration
On the Configuration tab, the signature verification of apps can be configured.
- This toggle switch is on by default, so only signed apps are allowed to be installed or started. Note: Phoenix Contact recommends to keep this function enabled. If enabled, then this restriction is also mentioned in the PLCnext Technology Apps tab of this page where users install or start an app.
If this toggle switch is disabled, then apps without signatures as well as apps with valid or invalid signatures can be installed and started.
Note: Disabling the app signature verification creates the risk that manipulated apps will not be detected. Phoenix Contact recommends to check the app's hash (SHA-256) against the hash provided from the PLCnext Store while downloading the app (see also Integrity check of downloaded software or firmware files). Before installing an app, you must verify that the app's hash matches the PLCnext Store's hash. - In addition, the continuous signature re-verification at app start can be enabled.
This toggle switch is off by default is disabled so developers can adapt their automation projects to an inevitable delay at app start.
If the signature check is disabled at 1 then the status of the re-verification toogle switch at 2 is just ignored (the switch turns gray). In that case, at app start a saved signature verification result from a previous verification on app installation or at system start is used instead.
Note: If this toggle switch is off, manipulated apps will not be detected when the app is started. Depending on the security context and the risk analysis of the controller being used, it is advisable to enable the re-verification. If you leave the re-verification disabled, perform a risk analysis. If re-verification is enabled, the signature verification process may cause delays when starting apps.
If the mandatory signature validation is enabled at 1, the checkboxes at 3, 4, and 5 specify which signature types will be included:
- The PLCnext Store Developer signature type is generated by the app developer before uploading to the PLCnext Store.
- The PLCnext Store signature type is generated automatically during the developers' upload process to the PLCnext Store.
In order to validate those signature types, certificates must be present in the corresponding Trust Stores (see the Certificate Management page). The PLCnext Runtime System is equipped with the PLCnext Store Developer and PLCnext Store Trust Stores that already contain the necessary Phoenix Contact root certificates to perform the signature verification for these types.
- The Operator signature type is an option for plant operators who want to allow only apps signed with their own signature (or certificate hierarchy).
In contrast to the aforementioned signature types, the Operator Trust Store to use for validating Operator signatures must be specified by the user by means of the drop-down list 6. Available Trust Stores are suggested, additional Trust Stores can be created in the Certificate Management page.
However, there are inherent dependencies between the signature types, so not all constellations are possible. Allowed constellations are:
- PLCnext Store Developer + PLCnext Store + Operator
- PLCnext Store Developer + PLCnext Store (this is the default)
- PLCnext Store Developer + Operator
- PLCnext Store Developer
- Operator
To keep the handling simple for user, this page automatically corrects entries when ticking/unticking checkboxes to match an allowed constellation.
Legacy app handling
If an app without signature was installed and started before updating to firmware 2026.0 LTS or newer, then that legacy app is started anyhow. As long as the Allow only signed apps toggle switch is active, that app can be stopped and uninstalled but not started again via WBM.
If there are apps without signature on your device, you must uninstall those apps and reinstall them with signature.