+31 85 333 4015WhatsAppDocumentationSupportContactLog in
View demoOrder
SunSpec SunSpec Model 9 — Set Operator Security Certificate Modbus TCP template

SunSpec Model 9 — Set Operator Security Certificate

SunSpec Model 9 is a protocol-level model defined by the SunSpec Alliance for provisioning operator security certificates over Modbus TCP. It is used by DER devices, such as inverters and energy storage systems, that implement the Secure SunSpec Modbus specification. The template exposes the certificate identifier, role, format, type, total and fragment lengths, 80 fragment payload registers, a write timestamp, sequence number, operator user ID, role, cryptographic algorithm, and fragment count. It allows a Modbus client to deliver X.509v3 certificates in-band, enabling role-based access control on the DER device.

Protocol
Modbus TCP
Connection
Ethernet, Modbus TCP
Registers
93, read and write
Brand
SunSpec
Last updated

Registers (93)

93 read, 91 write

NameUnitAccessAddress (Hidden until you enter your email)Function (hidden)Type (hidden)
idRead
lRead
certuidRead and write
certroleRead and write
fmtRead and write
typRead and write
totlnRead and write
frglnRead and write
frg1Read and write
frg2Read and write
frg3Read and write
frg4Read and write
frg5Read and write
frg6Read and write
frg7Read and write
frg8Read and write
frg9Read and write
frg10Read and write
frg11Read and write
frg12Read and write
frg13Read and write
frg14Read and write
frg15Read and write
frg16Read and write
frg17Read and write
frg18Read and write
frg19Read and write
frg20Read and write
frg21Read and write
frg22Read and write
frg23Read and write
frg24Read and write
frg25Read and write
frg26Read and write
frg27Read and write
frg28Read and write
frg29Read and write
frg30Read and write
frg31Read and write
frg32Read and write
frg33Read and write
frg34Read and write
frg35Read and write
frg36Read and write
frg37Read and write
frg38Read and write
frg39Read and write
frg40Read and write
frg41Read and write
frg42Read and write
frg43Read and write
frg44Read and write
frg45Read and write
frg46Read and write
frg47Read and write
frg48Read and write
frg49Read and write
frg50Read and write
frg51Read and write
frg52Read and write
frg53Read and write
frg54Read and write
frg55Read and write
frg56Read and write
frg57Read and write
frg58Read and write
frg59Read and write
frg60Read and write
frg61Read and write
frg62Read and write
frg63Read and write
frg64Read and write
frg65Read and write
frg66Read and write
frg67Read and write
frg68Read and write
frg69Read and write
frg70Read and write
frg71Read and write
frg72Read and write
frg73Read and write
frg74Read and write
frg75Read and write
frg78Read and write
frg79Read and write
frg80Read and write
tsRead and write
msRead and write
seqRead and write
uidRead and write
roleRead and write
algRead and write
nRead and write

Loading registers…

Send your device list

If a device is not in the library yet, we build the template for free as soon as we have the register data.

Use cases

  • Verify that a DER device has received and stored the correct operator security certificate after provisioning.
  • Track the certificate sequence number to confirm all fragments arrived in the correct order.
  • Monitor the write timestamp to detect stale or replayed certificate provisioning attempts on the device.
  • Audit the operator role register to confirm the intended access level was applied to the DER device.
  • Alert when the cryptographic algorithm register holds an unexpected value, flagging a misconfigured certificate upload.

Installation

  1. Enable Modbus TCP on the target DER device and confirm it implements the Secure SunSpec Modbus specification, including Model 9 support, under the communication or security configuration section.

  2. Connect the DER device and the ModbusCloud Gateway to the same IP network; note the device IP address and confirm port 502 is reachable from the Gateway.

  3. In the ModbusCloud portal, add the Gateway, import the SunSpec Model 9 template, and assign the correct Modbus unit ID matching the DER device configuration.

  4. Read back registers id and l to confirm the model ID equals 9 and the block length is as expected; then verify certuid and n show the values written during your certificate provisioning.

Things to watch for

Why do all fragment registers read zero after provisioning?

Many DER devices clear or mask the fragment payload registers after a successful certificate commit. A read of zero on frg1 through frg80 after a completed write sequence is normal. Confirm the operation succeeded by checking certuid, role, and seq rather than the raw fragment data.

The gateway connects but certuid always returns zero. What now?

The device may not yet have Model 9 active in its Modbus register map. Confirm the Secure SunSpec Modbus option is enabled in the device communication settings. Also verify the Modbus unit ID is correct; a mismatch causes all registers to return zero or no response.

What happens if I write fragment registers in the wrong sequence?

Writing fragment registers out of order or with an incorrect seq value will typically cause the device to reject the entire certificate transfer and may leave the certificate store unchanged. Always write seq before the fragment registers and set totln and frgln accurately. Re-start the transfer from fragment 1 if an error occurs.

Is it safe to write the RW registers on a live production device?

Writing to certuid, certrole, fmt, typ, totln, frgln, the fragment registers, uid, role, or alg pushes a new certificate to the DER device's secure store. An incorrect certificate or role value can lock out legitimate operator access or invalidate the device's authorization state. Always test certificate provisioning on a non-production device first and keep a backup of the previous certificate.

More SunSpec templates

All SunSpec templatesBrowse the library

Knowledge base articles for this device

Want to see how it works?

View demoOrder your first gateway
Electrician working in an open distribution board