Modbus TLS uses mutual certificate authentication. The heat pump only accepts connections from clients holding a certificate it trusts, and it proves its own identity in return. Before you can connect, you therefore need to pair with the heat pump once to obtain a client certificate.
Overview
At a high level it works as follows:
- Enable pairing mode in My Triple Solar. This starts a single-use CSR (certificate signing request) signing service on the heat pump, advertised over mDNS-SD as
_ts-csr._tcp. It runs for at most one minute or until a CSR arrives.
- Your client discovers this service via mDNS-SD, generates a private key and CSR, and posts the CSR to the heat pump.
- The heat pump signs the CSR with its root CA and returns the signed client certificate along with the root CA.
- Your client stores the private key, client certificate, and root CA. These are what you'll use for all future Modbus TLS connections.
Schematic
Below a schematic overview of the same steps:
Demo repository
To make this process easier, we have prepared a demo here. More technical details are available there too.
