# MODBUS/TCP Security (over TLS) **URL:** \ **Category:** General Discussion\ **Created:** [August 14, 2020, 5:07pm UTC](https://forum.inductiveautomation.com/t/modbus-tcp-security-over-tls/37738 "2020-08-14T17:07:32Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Herbie](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/herbie/32/65288_2.png) [@Herbie](https://forum.inductiveautomation.com/u/Herbie)\ **Post date:** [August 14, 2020, 5:07pm UTC](https://forum.inductiveautomation.com/t/modbus-tcp-security-over-tls/37738/1 "2020-08-14T17:07:32Z")
It looks like there is some movement from some of the vendors I am working with to migrate toward securing Modbus TCP. I was wondering if there is any work being done on IA’s side in regards to developing or updating the current driver to start implementing this. It looks like the full specification has been out since about 2018 (and I was surprised to see our vendors mention it). [Modbus TCP Security Protocol](https://modbus.org/docs/MB-TCP-Security-v21_2018-07-24.pdf) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 14, 2020, 5:10pm UTC](https://forum.inductiveautomation.com/t/modbus-tcp-security-over-tls/37738/2 "2020-08-14T17:10:13Z")
Nothing planned, never seen this in the wild. ---
**Author:** ![Herbie](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/herbie/32/65288_2.png) [@Herbie](https://forum.inductiveautomation.com/u/Herbie)\ **Post date:** [August 14, 2020, 5:13pm UTC](https://forum.inductiveautomation.com/t/modbus-tcp-security-over-tls/37738/3 "2020-08-14T17:13:57Z")
It was a surprise to me too! Apparently Schneider Electric is planning to migrate to enabling the ability in their Modicon line to use Modbus TLS (as they stated) early next year. I’m sure the old unsecure version will still be viable, but with several initiatives focused on cyber security improvements, it’s likely not the only company migrating this way. Maybe this is an early notification! Honestly, however, we might just migrate to OPC UA instead since it already has security built in and it will magically integrate well with Ignition 😉 ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 14, 2020, 5:15pm UTC](https://forum.inductiveautomation.com/t/modbus-tcp-security-over-tls/37738/4 "2020-08-14T17:15:13Z")
I’ll keep it in mind if the Modbus driver rewrite ever bubbles its way to the top of the priority pile… what a PITA though. You’ll need to manage an X509 certificate per Modbus TLS connection. ---
**Author:** ![Herbie](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/herbie/32/65288_2.png) [@Herbie](https://forum.inductiveautomation.com/u/Herbie)\ **Post date:** [August 14, 2020, 5:17pm UTC](https://forum.inductiveautomation.com/t/modbus-tcp-security-over-tls/37738/5 "2020-08-14T17:17:00Z")
Not really much different with OPA UA. I think it’s just the new normal! I guess we’ll just have to get better at managing certificates. Maybe a new feature potential in EAM? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 14, 2020, 5:20pm UTC](https://forum.inductiveautomation.com/t/modbus-tcp-security-over-tls/37738/6 "2020-08-14T17:20:04Z")
It’s a little different, because there’s only 1 certificate for all the outgoing OPC UA connections. The Modbus TLS spec embeds a client-specified (!!) operator role in each client certificate, which means not only do you need one per connection, you can’t sensibly use self-signed certificates, you have to deal with having a CA-signed and issued certificate per connection from a CA that the Modbus TLS server trusts. ---
**Author:** ![Herbie](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/herbie/32/65288_2.png) [@Herbie](https://forum.inductiveautomation.com/u/Herbie)\ **Post date:** [August 14, 2020, 5:23pm UTC](https://forum.inductiveautomation.com/t/modbus-tcp-security-over-tls/37738/7 "2020-08-14T17:23:28Z")
Oh, I see what you’re saying now. Well, I know we’ve been pushing using certificates from a CA anyway for all our LDAPS and gateway communications, but yeah, one for each outbound connection, now that sounds depressing. Maybe you need to develop a self-signed CA and do it that way (we are using internal CA’s). Anyway, still several years before we know what all that looks like. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [December 28, 2024, 8:08pm UTC](https://forum.inductiveautomation.com/t/modbus-tcp-security-over-tls/37738/8 "2024-12-28T20:08:34Z")
Hey-o, I just added Modbus TCP Security support to [my open source Modbus library](https://github.com/digitalpetri/modbus), so if/when a new Modbus driver happens it will probably include Modbus TCP Security (Modbus TCP over TLS) support. @pturmel if you get around to adding it to your implementation, I put together a CLI app and Docker image that can be used for interoperability testing: [GitHub - kevinherron/modbus-security-cli: CLI app and Docker image for Modbus Security interoperability testing.](https://github.com/kevinherron/modbus-security-cli) ---
**Author:** ![bmusson](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bmusson/32/87530_2.png) [@bmusson](https://forum.inductiveautomation.com/u/bmusson)\ **Post date:** [December 29, 2024, 1:06am UTC](https://forum.inductiveautomation.com/t/modbus-tcp-security-over-tls/37738/9 "2024-12-29T01:06:51Z")
Neat. We deal with a lot of Modbus devices, but I've never even _seen_ any devices that support this. What's the use case? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [December 29, 2024, 1:15am UTC](https://forum.inductiveautomation.com/t/modbus-tcp-security-over-tls/37738/10 "2024-12-29T01:15:00Z")
> [@bmusson](#): > > What's the use case? Theoretical AFAIK, except that apparently some newer Schneider devices support it, and it's been asked about by maybe one other customer. It never really saw adoption. But... I was bored and it was fun to implement. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [December 29, 2024, 1:23am UTC](https://forum.inductiveautomation.com/t/modbus-tcp-security-over-tls/37738/11 "2024-12-29T01:23:48Z")
I definitely plan to implement this for both client and server in my module. Possibly not until I'm done porting modules to 8.3. (and the similar functionality in EtherNet/IP) ---
**Author:** ![bmusson](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bmusson/32/87530_2.png) [@bmusson](https://forum.inductiveautomation.com/u/bmusson)\ **Post date:** [December 29, 2024, 1:27am UTC](https://forum.inductiveautomation.com/t/modbus-tcp-security-over-tls/37738/12 "2024-12-29T01:27:33Z")
> [@Kevin.Herron](#): > > But... I was bored and it was fun to implement. “For the hell of it” is always the best reason to do anything 🙂.