Secure SunSpec Modbus TLS test PKI (ECDSA P-256) + pymodbus 3.x update

[dersecure]

Summary

Regenerates the Modbus TLS test PKI under sunspec2/tests/tls_data/ so it is Secure SunSpec Modbus compliant, reorganises it into a structured layout, and updates the TLS test to a current pymodbus.

What changed

Secure SunSpec Modbus test PKI (ECDSA P-256)

The previous PKI used RSA-2048 keys, which can only negotiate the non-conformant ECDHE-RSA cipher suites. The mandatory Secure SunSpec Modbus suites are all ECDHE-ECDSA on the P-256 curve, so every key (root, intermediates, leaves) is now ECDSA P-256. Client certificates carry the SunSpec role extension at OID 1.3.6.1.4.1.50316.802.1 as an ASN.1 UTF8String holding exactly one role.

create_tls_certs.sh now generates the full certificate set the Secure SunSpec Modbus conformance tests need — valid and deliberately-invalid — in a structured tree:

tls_data/
  create_tls_certs.sh   openssl/   README.md
  ca/        root_ca, server_inter_ca, client_inter_ca, *_ca_chain
  server/
    tls1_2/  server_valid          tls1_3/  server_valid
    invalid/ server_expired, server_self_signed, server_foreign_ca, server_no_san
  client/
    tls1_2/  client_readonly, client_gridservice, client_netadmin, client_superadmin
    tls1_3/  (same four mandatory SunSpec roles)
    invalid/ client_no_role, client_malformed_role (IA5String), client_self_signed,
             client_foreign_ca, client_expired
  foreign_pki/  foreign_root_ca   (untrusted CA for multiple-PKI tests)

tls_data/README.md documents the layout and trust relationships. modbus.py (CAFILE / CLIENT_CERTFILE / CLIENT_KEYFILE) is updated to the new paths, and setup.py package_data now ships the full nested tree.

pymodbus update

pymodbus was pinned at 2.5.3, several major versions behind; its test-only API (pymodbus.server.sync) was removed upstream, so test_tls_client.py could not be collected. requirements.txt now requires pymodbus>=3.13.0,<4.0, and test_tls_client.py is rewritten for the pymodbus 3.x API. pymodbus is only used by that test, not the sunspec2 library.

Verification

• create_tls_certs.sh runs clean on OpenSSL 3.1.2 and produces the full tree; openssl verify confirms the valid leaves chain to the root.
• A mutual-TLS handshake with the regenerated certs negotiates the mandatory ECDHE-ECDSA-AES128-GCM-SHA256 at TLS 1.2.
• test_tls_client.py passes against pymodbus 3.13; the full test suite passes (234 tests).

This was developed and reviewed in the dersecure/pysunspec2 fork; it is offered upstream for the SunSpec Alliance repository.