PlugFest BACnet/SC CA

Signs BACnet/SC operational certificates for PlugFest testing. Don't use it on a real site.

1Get your certificates signed

or drop them anywhere on this page

Use a CARI request zip, a CSR, a private key, a certificate, or a PFX. You get back signed operational certificates, ready to load onto the device.

No CSR yet? Generate keys in this browser

The page creates a P-256 key and CSR for each port, signs them, and gives you the files. The private keys exist only in what you download.

Device instance	Port id	Hub	Router

Output format PEM — separate key, certificate and CSR files. Works with most tools. DER — binary key (PKCS#8, never encrypted) and certificate. PFX / PKCS#12 — one file per port holding the key, certificate and CA. CARI zip — a signed Annex AA.2 response, plus the unsigned request for testing other CA tools.

Password
Encrypts PEM and CARI key files and protects PFX files. DER keys stay unencrypted.

2Install the issuer certificate

Load it on every device, into Issuer_Certificate_Files. Every file below holds the same certificate, so pick the format your tool accepts. A CARI response zip already includes it as issuer/iss-1.pem.

Format	File	Use when

Details

This CA

What is checked

Keys must be EC P-256 (secp256r1) and signatures must be ecdsa-with-SHA256, the only BACnet/SC cipher profile (135-2024 AB.7.4). Anything else is flagged and not signed.
The input must be well-formed PEM/DER, and a CSR's self-signature must verify.
CARI zips must follow the Annex AA.2.1.1 layout: cert1/device-<instance>/[router/]port-<id>/[hub/]csr-<string>.pem, plus the optional vendor-data (1 MB max) and request-notes.txt (10 KB max).
Issued certificates are valid from 2026-09-14 to 2026-10-05 (UTC) and carry bacnet://<instance>[?router|?hub|?router&hub] as a URI SAN (135-2024 17.3). Their key usage is digitalSignature and keyEncipherment, with extended key usage serverAuth and clientAuth.
Generated keys are EC P-256, created with WebCrypto in this browser. The page keeps no copy.
Everything runs in this browser. Nothing is uploaded anywhere.