User Manual

SARA-R4 series-AT commands manual
UBX-17003787 - R16

20Device and data security
Page 237 of 401
o Level 1: certificate validation against a specific or a list of imported trusted root certificates.
o Level 2: certificate validation with an additional URL integrity check (the server certificate common
name must match the server hostname).
o Level 3: certificate validation with an additional check on the certificate validity date.
CA certificates should be imported with the +USECMNG AT command
• Minimum SSL/TLS/DTLS version to be used:
o Any
o TLS 1.0
o TLS 1.1
o TLS 1.2
o DTLS 1.2
• Cipher suite to be used using the following methods:
o Exact cipher suite to be used. See Syntax description and Table 22 for the applicability of cipher suite
depending on the module series.
o Additional cipher suite to be used with IANA enumeration set command. See Syntax description and
Table 23
• Certificate to be used for server and mutual authentication:
o The trusted root certificate. The CA certificate should be imported with the AT+USECMNG command.
o The client certificate that should be imported with the AT+USECMNG command.
o The client private key that should be imported with the AT+USECMNG command.
• Expected server hostname, when using certificate validation level 2 or 3.
• Password for the client private key, if it is password protected.
• Pre-shared key used for connection. Defines a pre-shared key and key-name (PSK), when a TLS_PSK_*
cipher suite is used.
• SNI (Server Name Indication). SNI is a feature of SSL/TLS which uses an additional SSL/TLS extension
header to specify the server name to which the client is connecting to. The extension was introduced to
support the certificate handling used with virtual hosting provided by the various SSL/TLS enabled servers
mostly in cloud based infrastructures. With the SNI a server has the opportunity to present a different
server certificate (or/and whole SSL/TLS configuration) based on the host indicated by the SNI extension.
• TLS session resumption. The session resumption feature allows to reuse the secure session data in order to
reestablish a SSL/TLS secure session. Since the secure session data are available, the SSL/TLS handshake
is not performed during the session resumption. Once the session resumption feature is enabled, the
session resumption type (provided by the server) and the secure session data (negotiated during the SSL/
TLS handshake) are displayed via +USECPRF URC message. The session resumption feature configuration
and secure session data are not stored in the NVM, hence the session resumption may be performed until
power cycle.
Table 21 provides the list the applicability of SSL connection properties depending on the module series.
<op_code>
Certificate validation level Minimum SSL/TLS/DTLS version Cipher suite Trusted root certificate internal name Expected server hostname Password for the client private key Pre-shared key used for connection SNI PSK key and PSK key identity generated by RoT Server certificate pinning TLS session resumption
0 1 2 3 4 7 8, 9 10 11 12 13
SARA-R410M-63B / SARA-R410M-73B /
SARA-R410M-83B
* * * * * * * * * *