TLS client

Creating a TLS client is exactly the same process as a TCP client, except that an extra TlsClientConfig is required. For more details about TLS support and the configuration options, check the TLS general information page.

Certificate chain configuration

Rust

let tls_config = TlsClientConfig::full_pki(
    Some("test.com".to_string()),
    Path::new("./certs/ca_chain/ca_cert.pem"),
    Path::new("./certs/ca_chain/client_cert.pem"),
    Path::new("./certs/ca_chain/client_key.pem"),
    None, // no password
    MinTlsVersion::V1_2,
)?;

let channel = spawn_tls_client_task(
    HostAddr::ip(endpoint.ip(), endpoint.port()),
    MAX_QUEUED_REQUESTS,
    default_retry_strategy(),
    tls_config,
    DecodeLevel::new(
        AppDecodeLevel::DataHeaders,
        FrameDecodeLevel::Nothing,
        PhysDecodeLevel::Nothing,
    ),
    Some(Box::new(ClientStateListener)),
);

C

rodbus_tls_client_config_t tls_config = rodbus_tls_client_config_init(
    "test.com",                          // name expected in the server certificate
    "./certs/ca_chain/ca_cert.pem",      // CA certificate
    "./certs/ca_chain/client_cert.pem",  // client certificate
    "./certs/ca_chain/client_key.pem",   // client private key
    ""                                   // no password
);
tls_config.min_tls_version = RODBUS_MIN_TLS_VERSION_V12;

rodbus_client_channel_t *channel = NULL;
rodbus_decode_level_t decode_level = rodbus_decode_level_build(RODBUS_APP_DECODE_LEVEL_DATA_HEADERS, RODBUS_FRAME_DECODE_LEVEL_NOTHING, RODBUS_PHYS_DECODE_LEVEL_NOTHING);
rodbus_param_error_t err = rodbus_client_channel_create_tls(runtime,
    host,                         // host
    port,                         // port
    MAX_QUEUED_REQUESTS,          // max queued requests
    rodbus_retry_strategy_init(), // retry delays
    tls_config,                   // TLS configuration
    decode_level,                 // decode level
    get_client_state_listener(),  // listener
    &channel
);
if (err) {
    printf("unable to create channel: %s\n", rodbus_param_error_to_string(err));
    return NULL;
}

C++

auto tls_config = rodbus::TlsClientConfig(
    "test.com",                         // name expected in the server certificate
    "./certs/ca_chain/ca_cert.pem",     // CA certificate
    "./certs/ca_chain/client_cert.pem", // client certificate
    "./certs/ca_chain/client_key.pem",  // client private key
    ""                                  // no password
);
tls_config.min_tls_version = rodbus::MinTlsVersion::v12;

auto channel = rodbus::ClientChannel::create_tls(
    runtime,
    endpoint.host,
    endpoint.port,
    MAX_QUEUED_REQUESTS,
    rodbus::RetryStrategy(),
    tls_config,
    rodbus::DecodeLevel(rodbus::AppDecodeLevel::data_headers, rodbus::FrameDecodeLevel::nothing, rodbus::PhysDecodeLevel::nothing),
    create_client_state_listener()
);

Java

TlsClientConfig tlsConfig = new TlsClientConfig(
        "test.com",
        "./certs/ca_chain/ca_cert.pem",
        "./certs/ca_chain/client_cert.pem",
        "./certs/ca_chain/client_key.pem",
        "" // no password
).withMinTlsVersion(MinTlsVersion.V12);

ClientChannel channel = ClientChannel.createTls(
        runtime,
        host,
        port,
        ushort(MAX_QUEUED_REQUESTS),
        new RetryStrategy(),
        tlsConfig,
        new DecodeLevel(AppDecodeLevel.DATA_HEADERS, FrameDecodeLevel.NOTHING, PhysDecodeLevel.NOTHING),
        new PrintingClientStateListener()
);

C#

var tlsConfig = new TlsClientConfig(
    "test.com",
    "./certs/ca_chain/ca_cert.pem",
    "./certs/ca_chain/client_cert.pem",
    "./certs/ca_chain/client_key.pem",
    "" // no password
).WithMinTlsVersion(MinTlsVersion.V12);

var channel = ClientChannel.CreateTls(
    runtime,
    host,
    port,
    MaxQueuedRequests,
    new RetryStrategy(),
    tlsConfig,
    new DecodeLevel(AppDecodeLevel.DataHeaders, FrameDecodeLevel.Nothing, PhysDecodeLevel.Nothing),
    new ClientStateListener()
);

Self-signed certificate configuration

Rust

let tls_config = TlsClientConfig::self_signed(
    Path::new("./certs/self_signed/entity2_cert.pem"),
    Path::new("./certs/self_signed/entity1_cert.pem"),
    Path::new("./certs/self_signed/entity1_key.pem"),
    None, // no password
    MinTlsVersion::V1_2,
)?;

let channel = spawn_tls_client_task(
    HostAddr::ip(endpoint.ip(), endpoint.port()),
    MAX_QUEUED_REQUESTS,
    default_retry_strategy(),
    tls_config,
    DecodeLevel::new(
        AppDecodeLevel::DataHeaders,
        FrameDecodeLevel::Nothing,
        PhysDecodeLevel::Nothing,
    ),
    Some(Box::new(ClientStateListener)),
);

C

rodbus_tls_client_config_t tls_config = rodbus_tls_client_config_init(
    "test.com",                              // not checked in self-signed mode
    "./certs/self_signed/entity2_cert.pem",  // server certificate
    "./certs/self_signed/entity1_cert.pem",  // client certificate
    "./certs/self_signed/entity1_key.pem",   // client private key
    ""                                       // no password
);
tls_config.min_tls_version = RODBUS_MIN_TLS_VERSION_V12;
tls_config.certificate_mode = RODBUS_CERTIFICATE_MODE_SELF_SIGNED;

rodbus_client_channel_t *channel = NULL;
rodbus_decode_level_t decode_level = rodbus_decode_level_build(RODBUS_APP_DECODE_LEVEL_DATA_HEADERS, RODBUS_FRAME_DECODE_LEVEL_NOTHING, RODBUS_PHYS_DECODE_LEVEL_NOTHING);
rodbus_param_error_t err = rodbus_client_channel_create_tls(runtime,
    host,                         // host
    port,                         // port
    MAX_QUEUED_REQUESTS,          // max queued requests
    rodbus_retry_strategy_init(), // retry delays
    tls_config,                   // TLS configuration
    decode_level,                 // decode level
    get_client_state_listener(),  // listener
    &channel
);
if (err) {
    printf("unable to create channel: %s\n", rodbus_param_error_to_string(err));
    return NULL;
}

C++

auto tls_config = rodbus::TlsClientConfig(
    "test.com",                             // not checked in self-signed mode
    "./certs/self_signed/entity2_cert.pem", // server certificate
    "./certs/self_signed/entity1_cert.pem", // client certificate
    "./certs/self_signed/entity1_key.pem",  // client private key
    ""                                      // no password
);
tls_config.min_tls_version = rodbus::MinTlsVersion::v12;
tls_config.certificate_mode = rodbus::CertificateMode::self_signed;

auto channel = rodbus::ClientChannel::create_tls(
    runtime,
    endpoint.host,
    endpoint.port,
    MAX_QUEUED_REQUESTS,
    rodbus::RetryStrategy(),
    tls_config,
    rodbus::DecodeLevel(rodbus::AppDecodeLevel::data_headers, rodbus::FrameDecodeLevel::nothing, rodbus::PhysDecodeLevel::nothing),
    create_client_state_listener()
);

Java

TlsClientConfig tlsConfig = new TlsClientConfig(
        "test.com",
        "./certs/self_signed/entity2_cert.pem",
        "./certs/self_signed/entity1_cert.pem",
        "./certs/self_signed/entity1_key.pem",
        "" // no password
).withMinTlsVersion(MinTlsVersion.V12).withCertificateMode(CertificateMode.SELF_SIGNED);

ClientChannel channel = ClientChannel.createTls(
        runtime,
        host,
        port,
        ushort(MAX_QUEUED_REQUESTS),
        new RetryStrategy(),
        tlsConfig,
        new DecodeLevel(AppDecodeLevel.DATA_HEADERS, FrameDecodeLevel.NOTHING, PhysDecodeLevel.NOTHING),
        new PrintingClientStateListener()
);

C#

var tlsConfig = new TlsClientConfig(
    "test.com",
    "./certs/self_signed/entity2_cert.pem",
    "./certs/self_signed/entity1_cert.pem",
    "./certs/self_signed/entity1_key.pem",
    "" // no password
).WithMinTlsVersion(MinTlsVersion.V12).WithCertificateMode(CertificateMode.SelfSigned);

var channel = ClientChannel.CreateTls(
    runtime,
    host,
    port,
    MaxQueuedRequests,
    new RetryStrategy(),
    tlsConfig,
    new DecodeLevel(AppDecodeLevel.DataHeaders, FrameDecodeLevel.Nothing, PhysDecodeLevel.Nothing),
    new ClientStateListener()
);