Cipher Suites; Server Name Indication (Sni); Secure The Connection Between An Xbee And Remote Manager With Server Authentication - Digi XBee 3 Cellular LTE-M User Manual

Transport Layer Security (TLS)
Note For NB-IoT, TCP support is dependent on the network. Contact your network provider for
details.
The implications of this are:
For client certificate files (for example when client authentication is required):
n
Self-signed certificates will work.
l
Certificates signed by the root CA will work, because the root CA can be omitted per RFC
l
5246. The root certificate authority may be omitted from the chain, under the assumption
that the remote end must already possess it in order to validate it in any case.
Certificate chains that include a intermediate CA are problematic. To work around this the
l
client's certificate chain has to be supplied to the server outside of the connection.
For server certificate files (when server authentication is required) this is not a problem unless
n
the client is expected to connect to multiple servers that are using different self signed
certificates or are using certificate chains that are signed by different root CA certificates. To
work around this you have to change the certificates before making the connection, or in the
case of API mode specify a different authentication profile.

Cipher suites

Note For NB-IoT, TCP support is dependent on the network. Contact your network provider for
details.
The only documented shared suites between the XBee 3 Cellular LTE Cat 1 Smart Modem and the
XBee 3 Cellular LTE-M Global Smart Modem are:
TLS_RSA_WITH_AES_128_CBC_SHA
n
TLS_RSA_WITH_AES_256_CBC_SHA
n
For the u-blox SARA-R410 and SARA-U201 cellular components:
TLS_RSA_WITH_AES_128_CBC_SHA
n
TLS_RSA_WITH_AES_128_CBC_SHA256
n
TLS_RSA_WITH_AES_256_CBC_SHA
n
TLS_RSA_WITH_AES_256_CBC_SHA256
n
TLS_RSA_WITH_3DES_EDE_CBC_SHA
n

Server Name Indication (SNI)

We do not currently support SNI. Therefore servers which use SNI to present certificates based on
client provided host data may be unable to establish the expected connections.
Secure the connection between an XBee and Remote Manager
with server authentication
The XBee devices that have the *11 or later version of the firmware installed are by default able to
secure the TLS connection to Digi Remote Manager. The default configuration provides confidentiality
of the communication but is not able to authenticate the server without a certificate being provided.
Digi XBee® 3 Cellular LTE-M/NB-IoT Global Smart Modem User Guide
Cipher suites
180