Modbus/TCP Security (TLS) client for Windows

What Modbus/TCP Security is

Modbus/TCP Security carries the ordinary Modbus TCP protocol inside a TLS connection. That adds encryption and, optionally, authentication of both sides with certificates. The assigned TCP port is 802, and the TLS handshake uses the ALPN identifier mbap-tls.

Switch it on in Connection Setup

Choose Modbus TCP/IP and tick Modbus/TCP Security (TLS). If the port is still 502, Busscope changes it to 802 for you, and back again when you untick the box. Three file fields appear: the certificate file and the private key file of your client, and the CA certificate file. All files are in PEM format. Busscope offers TLS 1.2 or newer and announces mbap-tls during the handshake.

What the certificate fields do

• Certificate and private key: give them when the device wants to authenticate the client (mutual authentication). Leave them empty when it does not.
• CA certificate: when you give a CA file, Busscope checks that the certificate of the device was issued by that authority and refuses the connection otherwise. Without a CA file the connection is encrypted, but the identity of the device is not checked.
• Host names: devices are usually addressed by IP address, so Busscope does not compare the host name with the name in the certificate.

If a file cannot be read, Busscope reports that loading the certificate file failed. A failed handshake is reported as a TLS connection error with the reason from the TLS library.

Then work as usual

Once connected, nothing changes in daily work. Poll windows read coils, discrete inputs, holding registers and input registers, the 12 display formats and four byte and word orders decode the values, and the live chart, logging to CSV or Excel, diagnostics (functions 07, 08, 11, 17 and 43/14) and the Request Runner all use the secured connection. Writes are confirmed before they are sent.

If the connection fails

Check that the device really listens for TLS on the port you entered (802 is the assigned port, but some devices use another one), that it accepts TLS 1.2 or newer, that the certificate and key files are in PEM format and that the private key belongs to the certificate. A clear message from Busscope tells you whether the files could not be loaded or the handshake itself failed.

What Busscope does not do

Busscope is the client side (the master). It does not create certificates and it is not a server, so have your certificate files ready from your device vendor or your own certificate authority. If you only need an unsecured connection, see the Modbus TCP tester page.