# Modbus.org Modbus/TCP Security

Protocols · `Modbus/TCP Security` · verification: source checked

Modbus/TCP Security, abbreviated mbaps in the specification, is a variant of Modbus/TCP that carries the Modbus application data unit inside TLS on TCP port 802. It uses x.509v3 certificates for mutual client/server authentication and can use role information in certificate extensions for authorization. The Modbus application data unit and standard Modbus function codes are unchanged.

## Specification

| Property | Value |
|---|---|
| Transports | tcp |
| Architecture | client server |
| Encoding | binary |
| Standard body | Modbus Organization, Inc. |

### Default ports

| Port | Transport | Secure | Purpose |
|---|---|---|---|
| 802 | tcp | true | Modbus/TCP Security (mbaps) |

## Connected

- Related: [Modbus TCP](https://machineschema.com/protocol/modbus-tcp.md)

## Safety

- mbaps devices MUST NOT negotiate down to TLS v1.1, TLS v1.0, or SSL v3.0.
- mbaps devices MUST NOT negotiate SSL v2.0 or SSL v1.0 in conformance with RFC 6176.
- mbaps devices MUST NOT negotiate the cipher suite TLS_NULL_WITH_NULL_NULL.
- mbaps devices MUST NOT use the HMAC-MD5 hash algorithm.
- mbaps devices MUST NOT use the HMAC-SHA-1 hash algorithm.
- mbaps devices MUST NOT use a NULL HMAC hash algorithm.
- A TLS connection MUST NOT be resumed after a fatal alert.
- Servers MUST reject a TLS handshake where the client has not responded to a Client Certificate request with a certificate.

## Study notes

- mbaps is the short name used in the specification for Modbus/TCP Security; mbap is used for Modbus/TCP.
- The Modbus application data unit (ADU) is encapsulated unchanged in a TLS Application Protocol message.
- TLS Handshake provides mutual client/server authentication using x.509v3 certificate chains down to the root CA.
- The client role is carried in an x.509v3 certificate extension using Modbus.org OID 1.3.6.1.4.1.50316.802.1 and ASN1 UTF8String encoding.
- Role-based authorization returns Modbus exception code 01 - Illegal function code when a request is not authorized.
- TLS 1.2 is required; negotiation down to TLS 1.1, TLS 1.0, SSL 3.0, SSL 2.0, or SSL 1.0 is prohibited.
- The required RSA cipher suite is TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256.
- The required minimum ECC cipher suite is TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256.
- TLS CompressionMethod is set to NULL.
- The Maximum Fragment Length Negotiation Extension must support 2^9 (512) bytes.
- Session resumption may use session IDs or session tickets; session IDs are preferred.

## Sources

1. [modbussecurityprotocol](https://www.modbus.org/file/secure/modbussecurityprotocol.pdf) (accessed 2026-10-25)
2. [Service Name and Transport Protocol Port Number Registry](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml) (accessed 2026-10-25)

---

Source page: https://machineschema.com/protocol/modbus-security  
JSON: https://machineschema.com/protocol/modbus-security.json  
License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Cite Machine Schema and the original sources.