
Transport Layer Security (TLS)
Cipher suites
Digi XBee3 Cellular LTE-M/NB-IoT Global Smart Modem User Guide
154
Note
For NB-IoT, TCP support is dependent on the network. Contact your network provider for
details.
The implications of this are:
n
For client certificate files (for example when client authentication is required):
l
Self-signed certificates will work.
l
Certificates signed by the root CA will work, because the root CA can be omitted per RFC
5246. The root certificate authority may be omitted from the chain, under the assumption
that the remote end must already possess it in order to validate it in any case.
l
Certificate chains that include a intermediate CA are problematic. To work around this the
client's certificate chain has to be supplied to the server outside of the connection.
n
For server certificate files (when server authentication is required) this is not a problem unless
the client is expected to connect to multiple servers that are using different self signed
certificates or are using certificate chains that are signed by different root CA certificates. To
work around this you have to change the certificates before making the connection, or in the
case of API mode specify a different authentication profile.
Cipher suites
Note
For NB-IoT, TCP support is dependent on the network. Contact your network provider for
details.
The only documented shared suites between the XBee3 Cellular LTE Cat 1 Smart Modem and the
XBee3 Cellular LTE-M Global Smart Modem are:
n
TLS_RSA_WITH_AES_128_CBC_SHA
n
TLS_RSA_WITH_AES_256_CBC_SHA
For the u-blox SARA-R410 and SARA-U201 cellular components:
n
TLS_RSA_WITH_AES_128_CBC_SHA
n
TLS_RSA_WITH_AES_128_CBC_SHA256
n
TLS_RSA_WITH_AES_256_CBC_SHA
n
TLS_RSA_WITH_AES_256_CBC_SHA256
n
TLS_RSA_WITH_3DES_EDE_CBC_SHA
Server Name Indication (SNI)
We do not currently support SNI. Therefore servers which use SNI to present certificates based on
client provided host data may be unable to establish the expected connections.
Secure the connection between an XBee and Remote Manager
with server authentication
The XBee devices that have the x11 or later version of the firmware installed are by default able to
secure the TLS connection to Digi Remote Manager. The default configuration provides confidentiality
of the communication but is not able to authenticate the server without a certificate being provided.