TLS-PSK

TLS authenticated with a pre-shared key rather than certificates. Both sides are configured with the same identity and key, and no certificate infrastructure is involved - which is what makes it usable on devices too small to validate a certificate chain, and on plants with no PKI.

It ships in the same artifact as the TLS transport and is selected with its own transport code.

Transport syntax

{IP address or hostname}[:{port}]
Example
modbus-tcp:tls-psk://192.168.1.100:802?tls-psk.psk-identity=line-3&tls-psk.psk-key=00112233445566778899aabbccddeeff

Name

Type

Default Value

Required

Description

Name

TLS-PSK

Code

tls-psk

Maven Dependency

 
<dependency>
  <groupId>org.apache.plc4x</groupId>
  <artifactId>plc4j-transports-tls</artifactId>
  <version>1.1.0</version>
</dependency>

Config options:

tls-psk.psk-identity

STRING

PSK identity string for TLS-PSK authentication. Must be used together with psk-key.

tls-psk.psk-key

STRING

PSK key as hexadecimal string for TLS-PSK authentication. Must be used together with psk-identity.

tls-psk.log-session-keys

BOOLEAN

false

Log TLS session keys to the audit log in SSLKEYLOGFILE format for Wireshark decryption.

tls-psk.connect-timeout-ms

INT

5000

Connection timeout in milliseconds.

tls-psk.read-timeout-ms

INT

0

Socket read timeout in milliseconds. 0 means no timeout.

tls-psk.write-timeout-ms

INT

0

Socket write timeout in milliseconds. 0 means no timeout.

tls-psk.no-delay

BOOLEAN

true

Enable TCP_NODELAY (disable Nagle’s algorithm).

tls-psk.keep-alive

BOOLEAN

false

Enable SO_KEEPALIVE.

tls-psk.send-buffer-size

INT

81920

Send buffer size in bytes. 0 uses system default.

tls-psk.receive-buffer-size

INT

81920

Receive buffer size in bytes. 0 uses system default.

tls-psk.local-address

STRING

Local address to bind to (optional). If not set, uses default.

tls-psk.local-port

INT

0

Local port to bind to (optional). 0 uses ephemeral port.

tls-psk.psk-identity and tls-psk.psk-key belong together - the key is hex-encoded, and the connection fails if only one of the two is given. The remaining socket options are inherited from the TCP transport.

tls-psk.log-session-keys=true writes the session keys into the audit-log in SSLKEYLOGFILE format, so a Wireshark capture of the connection can be decrypted. That hands anyone holding the log the ability to read the traffic - use it on a test system.