Building Automation Knowledge Base

Issue In the field it can be advantageous to flash an i2 to a b3 or a b3 to an i2 Product Line Andover Continuum, EcoStruxure Building Operation Environment Infinet controllers BACnet controllers i2xx/i28xx-V b3xx/b28xx-V Cause Flashing controllers in the field can save time Resolution If the controllers are i28xx-V or b38xx-V then these can be flashed back and forth in the field.  Please refer to Update b3 or i2 OS which also contains information on converting a bCX4040 to/from bCX9640 Refer to Conversion of Continuum devices from i2 to b3 and vice-versa in the field for non -V models If the i2/b3 controller is NOT included in the above (any other type of controller) then it cannot be flashed in the field, it will need to be sent to repair to change from an Infinet to BACnet or BACnet to Infinet.  If you attempt to flash this way in the field it can cause the controller to become a non-functioning controller.

Issue System was running fine with EBO version 3.2.3 and Active Directory (AD) integration. But after upgrading to EBO version 2022 no AD user could login to the ES. The Workstation Error when trying to login is: User_Not_Associated_With_A_Group And the error message seen in the ES trace log is: WinES\server\nsp_servers\csc\accountaccess\source\AccountAccess.cpp(486) Workstation Error: User_Not_Associated_With_A_Group (0xc002a) in module Account_Access(28).  Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Server Cause The Windows AD integration performance in EBO was improved in version 2022 by storing and comparing the SID for the AD-groups. During the upgrade from version 3.2.3 to EBO 2022 all EBO groups should have been updated with an AD-connected group SID. This was not done as the AD server was offline when doing the upgrade of the ES. Resolution If turning on the below property in the properties the old way used in EBO version 3.2.3 of matching groups during logon will be used: In the "ES.properties" file usually placed in C:\Program Files (x86)\Schneider Electric EcoStruxure\Building Operation 4.0\Enterprise Server\etc\config add and save: NspServer.Windows.Group.MatchByName = true   To utilize the AD performance improvement in EBO 2022 re-connect the AD group to their respective EBO group. This is done by changing the "Windows group name" property in the EBO group to anything else or an empty string and then change it back to its proper value, i.e. the AD group name. Doing so should correctly populate the hidden "External SID" property for the EBO groups that is missing as the upgrade was done with no connection to the AD server.  

Issue How can I streamline badge creation in Security Expert? Product Line EcoExpert Security Expert Environment Security Expert Server Security Expert Client   Cause There is no "Import/Export badge" feature available in Security Expert (unlike in Episuite/Continuum) Resolution This video demonstrates how to streamline badge creation in Security Expert.     Badge templates are normally provided by the customer.  They should be provided in bitmap (.bmp) or portable graphics format (.png) format. JPEG image format does not work well for resizing.     A new template can also be drawn though this is time-consuming.      Blank template from client 1. In Security Expert Client menu, go to Users--> Card Template Editor   Add and name new template, 2. Add blank template as image, go to right side Properties-->Images   Add blank template Adjust image to fit blue outline   3. Add dynamic user fields, go to right side Properties-->User Fields   Add and name fields ONE AT A TIME by dragging out items on to plan (drag one at a time to avoid confusion)     4. Name and place dynamic user fields over-top of blank template layout (Photo, Name, Dept, etc.)   Stretch, Align and Center Fields for uniform finish         5. Save template   6. Preview badge In Security Expert, go to Users--> Users-->Photo tab   Select a user:   Photo ID: Card template(drop-down menu)--> Choose your newly created template Hit the preview button Note: Do not choose Print & Read if no USB card reader is attached; this will cause an error and shut down Security Expert   Print Preview:

Issue How can the reports list sort order be changed and saved so that reports are always displayed in a specific order.  Product Line EcoStruxure Security Expert Environment Security Expert Server Cause Reports are printed in order of Database ID by default. There is a need to have this changed to a custom sorting order.  Resolution This video demonstrates how to create, configure and save report layouts in Security Expert.         1. Create your report      In Security Expert Client menu, go to Reports --> Setup--> User Add and name the new report Choose a Report Type and give your Report a Title (this will appear at the header of your report) Skip sorting properties Save your report 2. Add Columns to your report With your new report highlighted, go to the "Columns" tab Click Add to add desired columns for your report Save your report 3. Configure your report: Return to the "General" tab and click "Edit in report view" as seen below   Filtering: right-click the column you want to filter and select filter editor  Add your desired filters   Apply to view changes and OK to close the editor Sorting: right-click the column(s) you want to sort Click Save Report Filter to save your changes   Note: 1. You can clear custom sorting of the report table by:: Right-click tab and hit clear sorting Click Save Report Filter 2. You can also filter multiple columns: Right-click the columns Sort primary column (Dept, Access Level, Region) Sort secondary columns Click Save Report Filter

Issue What are the recommendations/limitations around using RDM2 and mRDM2 Reader Expander Modules on SP-ACX and SP-AC1 controllers? Product Line Security Expert Environment SP-ACX SP-AC1 RDM Expander Modules Cause The number of RDM2 and mRDM2 modules which can/should be used on an SP-C/SP-C-Web is well documented, but it is not so clear what limitations exist when using these modules on other SP Controllers. Resolution While SP-ACXs and SP-AC1s have not historically supported SP_RDM2 modules in the past, it is now supported going forward, as detailed in Architectural Guide Lines Security Expert - 4.3.322 available on The Exchange.    This will also receive an official 'new feature' announcement for Security Expert 2023 when it is released later this year.  (Assume controller firmware of 2.08.1320 minimum)   Legacy Continuum AC1 Modules and Security Expert RDM modules have to be used on separate ports and care must be taken when adding new RDM modules as this runs the risk of overtasking the controller, especially when approaching maximum door limits.  SP-ACXs and SP-AC1s are primarily designed as transitional controllers to allow Continuum ACXs and Continuum NetControllers to be transitioned smoothly into a new Security Expert system.   

Issue As per RFC 4510 The Lightweight Directory Access Protocol (LDAP) is an Internet protocol for accessing distributed directory services that act in accordance with X.500 data and service models. Do EBO servers support LDAP protocol? Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Server Building Operation Enterprise Central Building Operation Automation Server Premium Building Operation Automation Server Bundled Building Operation Edge Server - Standard Cause Need to know if EBO supports LDAP protocol. Resolution EBO doesn't support LDAP protocol. EcoStruxure Windows based BMS servers (Enterprise Server/ Enterprise Central) support integerationto Windows Active directory. The Active Directory integration is not using LDAP directly, but the NetLogon service on the Windows OS that ES/EC is running on.  This connection enables inherited user account groups from the Windows Active Directory to EcoStruxure Building Operation software, and allows users to log on to WorkStation with their Windows user accounts. Refer to: Windows Active Directory User Groups and Integrating Windows Active Directory user accounts with EcoStruxure - Communities For EBO 2022 or higher, Authentication using SAML 2.0 is also supported (Edge Server, AS-P, AS-B, ES and EC) . This enables configuring WebStation to use single sign on (SSO) using Federated Authentication, refer to: Federated Authentication. SAML Authentication feature requires license.

Issue SLP Sensor Modbus RTU issue when used with RPC or AS Communication errors are seen during normal Values are updated very slowly, can take up to two minutes to populate/update the 15 objects within the SLP.   Product Line EcoStruxure Building Operation Environment Modbus RTU RPC Modbus Automation Server + Premium  SLP SpaceLogic Sensors LSA_APP_REV2.03.19 and REV2.05.21 Cause Once the Modbus communication is set up between RPC (or AS) and the SLP,  although the values updates fairly regularly, multiple communication errors are also seen The SLP read speed needs to regulated to prevent overwhelming it The SLP Modbus transmission voltage is less than the AS Resolution Use with RP-C SLP struggles to respond to every request from the RP-C, changing the baud rate to 9600/19200 and increasing the "Silence characters" in the interface to 255 (maximum possible) should stabilize the communications.  The character spacing cannot be adjusted enough in the RP-C to allow communication at 38400 or 76800 Use with AS/AS-P  Adjust the “Poll point delay” in the Modbus Interface to 80ms The Silence characters and Transmit guard bits may also need to be increased Baud rate up to 38400 has been tested.  

Issue Are there any redundancy options for Security Expert? Product Line EcoStruxure Security Expert Environment Security Expert Stratus everRun Cause Need to provide redundancy for the Security Expert Server. Resolution There are a couple of options for providing server redundancy that can be used with Security Expert. The first option would be to use a downtime prevention product such as Stratus everRun as a hot standby solution. The second option is having a secondary Security Expert server as a cold standby server, if the primary server fails/needs to be taken offline the Security Expert services on the cold standby server can be started to take over. This option is largely manual, there is no automatic switching between two servers with this configuration. There are also a number of considerations to take into account with this option: In this scenario the controllers would be programmed with 2 x event server IP addresses for the primary and cold standby server as a result only 1 server/set of Security Expert services must be running at a time, having both running and therefore the controller having 2 x valid paths back to 2 x different servers concurrently will cause issues with the upload of events, online status and downloads A suitable system/process would need to be put in place to ensure the databases are restored from the primary to the cold standby server There will be 2 different Security Expert servers running which will require 2 separate Security Expert Server license with the same feature set enabled on both Considerations will need to be made with regards to the name of the machine to ensure the Download and Event servers can run, either the machines must have the same name or the name of the server needs to be renamed when required to the name of the cold stand by server An operator would need to verify the state of programmable functions and services. If the primary server failed during the middle of the download when the cold standby server is up and completes a full download some functions/services may require manual starting.

Issue Can Enterprise Servers inherit licenses from a parent Enterprise Central? Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Server Building Operation Enterprise Central Cause Need to know if Enterprise Central Licenses can be inherited by an Enterprise Server, and then, in turn by Automation Servers. Resolution An Enterprise Server cannot inherit its licenses from a parent Enterprise Central. Licenses can only be inherited from an Enterprise Server by the attached automation servers. Refer to WebHelp article Inherited Licenses and Knowledge Base article SmartX Server License Inheritance in EBO 3.x.

Warning This article describes a feature that is not standard functionality within the Product Line.  It has been provided to allow customers the option to use this requirement.  Pay particular attention to the Prerequisites of the required programming. Issue Customer requires the functionality for Individuals  to double badge (present their credentials twice) to gain access. Product Line TAC INET Environment Access Control Cause Customer application requirement Resolution Prerequisites: LIMITATIONS: As this is not a standard access control feature within I/NET, it uses custom programming, which therefore reduces/limits the standard features within I/NET The description provided below must be set for ALL individuals with access to the door that requires double badging.  It does NOT cater to custom individual use.  It may be possible to provide additional programming to achieve this, but this is not detailed in this article. Door Automatic Time Schedules (ATS), if applied, can be overridden if the door reader is badged during the scheduled operation.  The functionality of this feature uses event-driven programming, which in its nature is single-shot programming and therefore relies on the following:  Requires reliable communication between SLI/MCI (779x) and the SCU (Door Controller).  The door reads from the SCU must be received by the SLI/MCI to activate the badge/read occurrence. Requires SLI/MCI (779x) CPU loading below 65%. LAN Load of this controller should be below 2%; anything above this can cause the operation to fail/be inconsistent.  Removes the standalone capability of the Door controller (SCU) POINTS The points required for each door that requires this functionality are Door Reader (Internal DO door point as required in I/NET)  Door Strike (External DO Point) must be programmed within the controller Door Intermediate (Internal DO Point). :: Scan Rate 1 second Door Read Count (Internal AO Point). :: Scan Rate 1 second I/NET Controller Summary Note: The address order, as shown in the screenshot above, is important for the overall operation.   That is Read Count must be at a lower address than all other points.  Next the Intermediate point.  The Strike and Reader addresses are fixed by I/NET but must be at a HIGHER address than the Read count and Intermediate points.    DOOR Intercard Interval (sec) should be set as low as possible.  This allows the card to be present within this time setting (minimum is 1 second) Door strike: Configuration of the door/reader must have this set to either. None: When a valid read is received, no action is sent to the strike Exit: Only when an Exit read to Request to exit (REX) is received by the door does it activate the strike.  Strike duration (sec): Should be set 1 second above the scan rate of the Intermediate / Read Count points above.  In this case, it is set to 2 seconds.  Note: this does not have any bearing on how long the strike remains "unlocked" Door editor Programming DOOR No additional programming is required for the door apart from the details provided in the above prerequisites.  ACCESS INITIATED CONTROL (AIC) Add an AIC that will trigger the Intermediate point on a "valid" reader entry for the nominated door. Select the Target point (DR1 Intermediate) Select either Use all individuals in the range which will trigger this action for all individuals.  Note: If selected Individuals are needed to activate this feature, then additional programming is required and not detailed in this article.    Select Reader entry to START the target point  Select which Doors are to trigger this action Access Initiated Control editor POINTS From the screenshots below, it can be seen that: Point DR1 Read Count has two extensions: Calculation (C)  Operation: The result of this calculation is displayed on the DR1 Read Count point.  The calculation adds the value of itself (P0) DR1 Read Count and point (P1) DR1 Intermediate point (where 0=OFF 1=ON), the result of which is then multiplied by the NOT (~) the value of (P2) Door Strike (where sec = 0 Unlk = 1). Result: DR1 Read Count is incremented by one on each valid read.  The counter is reset (zeroed) when the Door Strike is energized.        Event Definition (EV)   Operation: When the point DR1 Read Count crosses the value 1 (the value of 2 represents the double (2) badge), Sequence/Action #1 is triggered.  From the above Event Definition (EV), this runs Sequence/Action Num 1, which is shown below:  Operation: When triggered by the (EV) above, the Door Strike is immediately "Stop"  (Unlocked); after a 5-second delay, the Door Strike is "Start" (secured). Note: The delay of 5 seconds on line #2 determines how long the strike remains in the unlocked state.  Modifying this value will shorten or extend the unlocked state.     Point DR1 Intermediate has only one extension: Calculation (C)  SUMMARY OPERATION A valid card read is presented to the reader; this triggers AIC to turn point DR1 Intermediate to ON. This increments DR1 Read Count by 1 to the value of 1 via its Calculation (C) extension The additional card read repeats Steps 1 and 2 above;  DR1 Read Count value increments to a value of 2. Event Defintin (EV) high-value crossing (>1) triggers Event Sequence #1 Event Sequence #1 unlocks Door Strike 1 and, after a 5-second delay, relocks (secures) Door Strike 1 point. This relock (secure) of Door Strike 1 zeros the DR1 Read Count value via its Calculation (C) extension.  ATTACHMENTS - for reference showing the above details  I/NET Controller SAV file (DCU0201.zip) Backup InetDb (SQL.bak).  (InetDb_DoubleBadge.zip)  

Issue When WebReports is installed, two users called "appuser" are created. One is a local Windows user, and one is a SQL user. Product Line EcoStruxure Building Operation Environment WebReports User accounts Cause These users are or have been needed by WebReports Resolution EBO version 2.0 and above: the Windows user account "appuser" is no longer required to operate WebReports.  It is only a requirement during installation. SBO/EBO version 1.8 and above:  In SQL, the "appuser" user account has been removed as it's not essential for the Web Reports to operate correctly. In these versions, if an upgrade from an earlier version is performed and this user account is still present, it can be safely deleted /disabled.     In all other versions: The local Windows user account ([PC_NAME]\appuser) is used for importing report packs (RDL files) and synchronizing between WebReports and Microsoft Reporting Services.   For more information about this account, refer to SmartStruxure WebReports Installation Errors (1001 while importing report pack). To change the password for this Windows user, refer to Changing Report Server "appuser" password.    

Issue Moving from Webreports going to Postgres/TimescaleDB instead, leaves us without a reporting engine. SSRS can supposedly utilise a PostgreSQL database, but SSRS is a licensed part of MSSQL. Product Line EcoStruxure Building Operation Environment Building Operation Timescale Database Cause From EcoStruxure Building Operation version 4.0 (2022) the Building Operation Report Server is no longer supported. Instead, we support PostgreSQL/TimescaleDB, using Dashboards and Excel from within EBO, to make reports, using Notification reports to start Excel and reports. Resolution EBO 3.2 introduced Enhanced Reporting, based on the current feature Notifications in combination with Notification Report Template, which also supports report data such as Alarms, Groups, Multi Log list, Relative events and Users. The Notification result can also be presented in XLSX format and converted to PDF with signing capabilities. If External Log Storage is configured and connected (PostgreSQL/TimescaleDB), then historical report data can be fetched from there.   EBO 2023 introduced External Log Storage support for Microsoft SQL Server in addition to PostgreSQL/TimescaleDB   Information  and examples of Enhanced Reporting and Dashboards can be found in EBO Webhelp, My LearningLink and the Automation Experts Community.   NOTIFICATION REPORTS : EBO Webhelp: Notification Reports  Community: Reporting in EcoStruxure Building Operation 3.2 Community: Reports showcase - share your reports! Community: Get more data out of the system with Notifications! EcoXpert Extranet Video: Community Video : Fusion Fridays - Session 20 Community: Change Control and Enhanced Reporting Lab Guides Community: Example Report Templates  Community: Forced Values Report Example My LearningLink: EcoStruxure Building: Enhanced Reporting and Dashboards 3.2 My Learning Link: EBO 2022: Enhanced Reporting and Dashboards   DASHBOARDS : EBO Webhelp: How Dashboards Work EcoXpert Extranet Video: Dashboards EcoStruxure Building Operation 3.0 - Informational Video Community: What Custom Types have to do with Dashboards Community: Public vs Personal Dashboards Community: Graphics in Dashboards [Advanced] Community: Dashboards: Share your screenshots! EcoXpert Extranet: PA-00701 EcoStruxure™ Building Operation 3.0 Captures the Spotlight

Issue When using the Modbus RTU X Driver to communicate to multiple Socomec Diris A20 electric meters it has been found only 2 or 3 devices can be networked together, even using a b-Link to boost the signal does not resolve the issue. Product Line Andover Continuum Environment Modbus RTU X Driver on bCX1 or Netcontroller II B-Link repeaters Cause The Socomec Diris A20 meters require a minimum of 4V RS-485 signal to communicate reliably, but the EIA RS-485 standard only calls for a +/- 1.5 volts signal and the Receiver Input sensitivity should be +/- 200mV. When using a bCX1 with the X Driver on Comm1 you will require a b-Link to provide the RS-232 to RS-485 conversion, although the B-Link fully conforms to the EIA RS-485 standard it does not have the drive levels required by the Socomec products. Resolution To resolve the non standard electrical requirement of the Socomec Diris meters use a Socomec RS-422/ RS-485 Repeater this will output the required electrical levels required by the Diris meters, the Socomec  part reference is 48990120.  Please refer to SOCOMEC Communication accessories or RS-422/485 Repeater Operating Instructions   If a B-Link is to be used each RS-485 output that is used will require a separate Socomec repeater.  

Issue When binding Output points in the script editor to the desired outputs, the bindings are not working. Product Line EcoStruxure Building Operation Environment EcoStruxure Building Operation All Versions Automation Server Central I/O Modules Cause When bindings to the output points the incorrect attribute is being used. Resolution Open binding editor for the desired program. In the right hand pane, choose the desired output to be bound. Expand the point and select Requested Value. Drag the Requested Value to the desired output in the program. Save settings.

Issue Sometimes the availability count for license features are displayed as double the actual available count for Entitlements. The problem has no functional effect on the system other than that the visual indication of the feature count is wrong. Issue seen in Entitlement View - Features inside a License Product are doubled. Issue seen in Server View. -The issue can be seen temporarily during activation on the server line. -The number of features inside the License Products available for activation under the server are doubled permanently. Server line view after activation. - After the license product has been activated the features on the server are shown correctly. Product Line EcoStruxure Building Operation Environment Building Operation Automation Server Premium (AS-P) Secure Boot Building Operation Automation Server Bundled (AS-B) Scalable Cause AS-P Classic and AS-B Classic licenses are NOT affected. None of the Windows licenses are affected.   EBO releases affected: All EBO versions up to and including 4.0.3. The EBO systems that are already running licenses are Not affected. Customers that for any reason reinstall an Entitlement in DA will be affected by the issue. EBO 5.0.1 Resolution This issue is planed to be resolved in the following EBO versions: EBO 4.0.4 EBO 5.0.2

Issue Is it possible to use a TAC Xenta 1.8 kOhm thermistor on an RTD-16 Central I/O module? Product Line EcoStruxure Building Operation. Environment Building Operation I/O Module 16 Ch RTD Cause Wants to use existing modules instead of adding new modules. Resolution The RTD-16 module is designed to interface with linear resistive inputs such as PT100, PT1000. Thermistors generally have logarithmic scales, therefore it will be hard to program a correct curve function to get an acceptable sensor accuracy. Using a universal input that is made for thermistor readings will give a more accurate reading without additional programming.

Issue What is required to control command priorities in 3rd party controllers using Plain English? Product Line Andover Continuum Environment Continuum Cyberstation BACnet Controller (BCX, B4920, B3) BACnet command priority Plain English Cause Need to understand how to control command priorities and point values with Continuum workstation programs or controller infinity programs. Resolution Command Priority is a BACnet mechanism to decide the control hierarchy of a point, with 1 being the highest priority and 16 being the lowest.  Consider the following:   Default setting for a workstation program priority level is ManualOperator priority 8 Programs located in the workstation default command priorities can be controlled through Bacnet Preferences Controller InfinityPrograms will need to use the WriteProperty function to set a different priority other than priority 10 To relinquish a priority level use Relinquish(pointname, priority level)   The WriteProperty function is written in the format: WriteProperty (object_name, value, priority, index) object_name  Includes a full pathname, followed by a property name. The object identifier and property identifier are combined as one argument value   This actual value to which the property is set. This is optional.  If it is not present, then the next argument, priority, must be present to perform a Relinquish command.  (See the example in Relinquish.)  priority  The priority  number, ranging from 1 (highest) to 16 (lowest).This is optional.  It applies only to a set commandable property.  For controllers:  If it is not present, priority 10, if applicable, is used.  For CyberStation: The value, based on the priority in the BACnet Preferences dialog, is used.  index  This is optional.  It applies only to an array-type BACnet property.  The index is ignored whenever it is not applicable.   Infinity controller samples: This line will write the value of 22 to priority 10 BACnetDevices\BNet_4444\B3_885\B3Num1 = 22 This line will write the value of 33 to priority level 4 WriteProperty(BACnetDevices\BNet_4444\B3_885\B3Num1, 33 , 4 ) This line will relinquish the value for priority level 4 setting the value back to NULL Relinquish(BACnetDevices\BNet_4444\B3_885\B3Num1 , 4 )

Issue Is it possible to use both Modbus/IP and BACnet/IP on the same AS-P Ethernet Port 2? Product Line EcoStruxure Building Operation. Environment Building Operation Automation Server Premium Cause There is a need to have both Modbus TCP as well as BACnet/IP devices on the same AS-P secondary Ethernet port. Resolution This is not a common configuration so it has not been tested extensively. With regards to the architectural guidelines, consider the Modbus/IP as BACnet/IP devices. For example, where the maximum number of SpaceLogic BACnet/IP devices per private IP field-bus is 200, adjust this limit to 190 if you have 10 Modbus/IP devices on the secondary Ethernet port.

Issue When connecting MP-C controllers in a daisy chain, do they act as a repeater and boost the signal thus allowing total network distances of greater than 90 meters. Product Line EcoStruxure Building Operation. Environment Building Operation Multi-purpose Controller. Cause Each MP-C acts as a switch and decodes and generates a new fresh packet. Resolution Maximum 100 meters between each device when using daisy chain when connecting MP-C.

Issue After configuring SSL certificates manually, having an incompatible Host Certificate and Key file can cause the import to EBO to fail. Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Central Building Operation Enterprise Server Building Operation Automation Server Cause Host Certificate provides the public key for which the private key is paired. An unmatched Host Certificate and private key will cause the certificate import to fail. Resolution While managing certificates manually, it is recommended to check that the Host Certificate and Key files are a matching pair.   Using the provided Host Certificate (.pem) file and private key (.key or .prv) file Download OpenSSL v1.1.1 Light choosing the EXE file type and correct version (Win64 or Win32), as the latest version letter will be posted to Win32/Win64 OpenSSL Installer for Windows - Shining Light Productions (slproweb.com) or OpenSSL installed with EBO If using Shining Light installer, it is recommended to open command prompt from where certificates are stored on the desktop and substitute openssl with "C:\Program Files\OpenSSL-Win64\bin\openssl.exe". Working with certificate files on the Windows desktop ensures the user will have the correct permission to run the commands, unlike putting certificate files in the Program Files directory where openssl.exe resides. Open PowerShell or Command Prompt Obtain the host certificate md5 hash with this command: openssl x509 -noout -modulus -in filename.pem | openssl md5 Obtain the private key md5 hash using the command below. Use the correct command based on the key file file type openssl rsa -noout -modulus -in filename.prv | openssl md5 openssl rsa -noout -modulus -in filename.key | openssl md5   In this example, the Host Certificate is HostCert.pem and the private key is EcoStruxure.key. The private key was converted to EcoStructure.prv using Step 12 of Installing an SSL Certificate from an External CA - Communities (se.com) These commands make the hash more readable to human eye. We use openssl to inspect the x509 for Certificate and encryption type rsa for the key to produce the modulus (-modulus), which is a long string. You then use (-noout) to prevent the full modulus from printing to the screen. You then create a shorter md5 hash so the human eye can easily compare them. If the md5 hashes match, that indicates that the modulus is a match and proves that the certificate/key is a pair.