WTE TReX-460, User Manual

Page: 243 / 302

TReX User Manual v15.30 Firmware
Transport Layer Security
The TReX has optional support for TLS 1.2 security connections using 128 bit AES encryption
and 2048 bit RSA.
Transport Layer Security (TLS) is a commonly used protocol for encrypting data sent over a
network connection. The main benefit of using TLS is protection against interception of
sensitive data either through a local network or over the internet.
The TReX supports TLS communication when configured as either a server or a client, with
the latter configuration supporting both standard TCP and MQTT encrypted communication.
Operating as a TLS server
Before encrypted data can be sent between a server and a client, a TLS handshake must take
place between the two. In this handshake, the client sends a request to the server, the server
sends back a certificate and the client generates session keys for both parties to encrypt and
decrypt message data.
For the TReX to operate as a server using a TLS connection, several files are required.
While default files are provided with the device, these should not be considered secure
and should only be used for testing and setup purposes. It is strongly recommended to
either purchase a certificate from a trusted certificate authority or generate a certificate
using the steps outlined below.
Certificate Generation
Certificate Authority (CA) Certificate
A CA Certificate (or Root Certificate) is a certificate issued by a Certificate Authority that is
used to verify the certificate used by the server. Generally, it is considered more secure to
purchase both a CA certificate and a server certificate from a trusted CA. However, it is
possible to locally generate a CA certificate using a free command-line software called
OpenSSL.
First, a private key for the CA certificate must be generated. OpenSSL will request a
passphrase for the private key. Remember this passphrase as it will be required to generate the
CA certificate.
> openssl genrsa -des3 -out cakey.pem 2048
Generating RSA private key, 2048 bit long modulus (2 primes)
...........+++++
..............................................+++++
e is 65537 (0x010001)
Enter pass phrase for cakey.pem:
Verifying - Enter pass phrase for cakey.pem:
© WTE Limited, 2022 – Christchurch New Zealand
Page 243 of 302