Machine Schema
Connect MCP

Modbus.org Modbus/TCP Security

Modbus/TCP Security, abbreviated mbaps in the specification, is a variant of Modbus/TCP that carries the Modbus application data unit inside TLS on TCP port 802. It uses x.509v3 certificates for mutual client/server authentication and can use role information in certificate extensions for authorization. The Modbus application data unit and standard Modbus function codes are unchanged.

Source checked6/6 values · 2026-10-25

Specification

2 sources
Transportstcp
Architectureclient server
Encodingbinary
Standard bodyModbus Organization, Inc.

Default ports

IANA assignments
802TCPModbus/TCP Security (mbaps)

Study notes

  • mbaps is the short name used in the specification for Modbus/TCP Security; mbap is used for Modbus/TCP.
  • The Modbus application data unit (ADU) is encapsulated unchanged in a TLS Application Protocol message.
  • TLS Handshake provides mutual client/server authentication using x.509v3 certificate chains down to the root CA.
  • The client role is carried in an x.509v3 certificate extension using Modbus.org OID 1.3.6.1.4.1.50316.802.1 and ASN1 UTF8String encoding.
  • Role-based authorization returns Modbus exception code 01 - Illegal function code when a request is not authorized.
  • TLS 1.2 is required; negotiation down to TLS 1.1, TLS 1.0, SSL 3.0, SSL 2.0, or SSL 1.0 is prohibited.
  • The required RSA cipher suite is TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256.
  • The required minimum ECC cipher suite is TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256.
  • TLS CompressionMethod is set to NULL.
  • The Maximum Fragment Length Negotiation Extension must support 2^9 (512) bytes.
  • Session resumption may use session IDs or session tickets; session IDs are preferred.

Safety

  • mbaps devices MUST NOT negotiate down to TLS v1.1, TLS v1.0, or SSL v3.0.
  • mbaps devices MUST NOT negotiate SSL v2.0 or SSL v1.0 in conformance with RFC 6176.
  • mbaps devices MUST NOT negotiate the cipher suite TLS_NULL_WITH_NULL_NULL.
  • mbaps devices MUST NOT use the HMAC-MD5 hash algorithm.
  • mbaps devices MUST NOT use the HMAC-SHA-1 hash algorithm.
  • mbaps devices MUST NOT use a NULL HMAC hash algorithm.
  • A TLS connection MUST NOT be resumed after a fatal alert.
  • Servers MUST reject a TLS handshake where the client has not responded to a Client Certificate request with a certificate.
↑↓ navigate↵ openesc close