{"id":"modbus-security","model_id":"Modbus/TCP Security","name":"Modbus.org Modbus/TCP Security","summary":"Modbus/TCP Security, abbreviated mbaps in the specification, is a variant of Modbus/TCP that carries the Modbus application data unit inside TLS on TCP port 802. It uses x.509v3 certificates for mutual client/server authentication and can use role information in certificate extensions for authorization. The Modbus application data unit and standard Modbus function codes are unchanged.","study_notes":["mbaps is the short name used in the specification for Modbus/TCP Security; mbap is used for Modbus/TCP.","The Modbus application data unit (ADU) is encapsulated unchanged in a TLS Application Protocol message.","TLS Handshake provides mutual client/server authentication using x.509v3 certificate chains down to the root CA.","The client role is carried in an x.509v3 certificate extension using Modbus.org OID 1.3.6.1.4.1.50316.802.1 and ASN1 UTF8String encoding.","Role-based authorization returns Modbus exception code 01 - Illegal function code when a request is not authorized.","TLS 1.2 is required; negotiation down to TLS 1.1, TLS 1.0, SSL 3.0, SSL 2.0, or SSL 1.0 is prohibited.","The required RSA cipher suite is TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256.","The required minimum ECC cipher suite is TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256.","TLS CompressionMethod is set to NULL.","The Maximum Fragment Length Negotiation Extension must support 2^9 (512) bytes.","Session resumption may use session IDs or session tickets; session IDs are preferred."],"safety_notes":["mbaps devices MUST NOT negotiate down to TLS v1.1, TLS v1.0, or SSL v3.0.","mbaps devices MUST NOT negotiate SSL v2.0 or SSL v1.0 in conformance with RFC 6176.","mbaps devices MUST NOT negotiate the cipher suite TLS_NULL_WITH_NULL_NULL.","mbaps devices MUST NOT use the HMAC-MD5 hash algorithm.","mbaps devices MUST NOT use the HMAC-SHA-1 hash algorithm.","mbaps devices MUST NOT use a NULL HMAC hash algorithm.","A TLS connection MUST NOT be resumed after a fatal alert.","Servers MUST reject a TLS handshake where the client has not responded to a Client Certificate request with a certificate."],"sources":[{"url":"https://www.modbus.org/file/secure/modbussecurityprotocol.pdf","title":"modbussecurityprotocol","accessed":"2026-10-25"},{"url":"https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml","title":"Service Name and Transport Protocol Port Number Registry","accessed":"2026-10-25"}],"verification":{"status":"source_checked","checked_at":"2026-10-25","values":6,"method":"llm_source_check"},"updated_at":"2026-10-25","type":"protocol","spec":{"transports":["tcp"],"architecture":"client_server","encoding":"binary","default_ports":[{"port":802,"transport":"tcp","secure":true,"purpose":"Modbus/TCP Security (mbaps)"}],"data_types":[],"standard_body":"Modbus Organization, Inc.","related":["modbus-tcp"]},"url":"https://machineschema.com/protocol/modbus-security","license":"https://creativecommons.org/licenses/by/4.0/"}