trantor::TLSPolicy Struct Reference

Collaboration diagram for trantor::TLSPolicy:

Public Member Functions
TLSPolicy &	setConfCmds (const std::vector< std::pair< std::string, std::string > > &sslConfCmds)
	set the ssl configuration commands. The commands will be passed to the ssl library. The commands are in the form of {{key, value}}. for example, {"SSL_OP_NO_SSLv2", "1"}. Not all TLS providers support this feature AND the meaning of the commands may vary between TLS providers.
TLSPolicy &	setHostname (const std::string &hostname)
	set the hostname to be used for SNI and certificate validation.
TLSPolicy &	setCertPath (const std::string &certPath)
	set the path to the certificate file. The file must be in PEM format.
TLSPolicy &	setKeyPath (const std::string &keyPath)
	set the path to the private key file. The file must be in PEM format.
TLSPolicy &	setCaPath (const std::string &caPath)
	set the path to the CA file or directory. The file must be in PEM format.
TLSPolicy &	setUseOldTLS (bool useOldTLS)
	enables the use of the old TLS protocol (old meaning < TLS 1.2). TLS providers may not support old protocols even if this option is set
TLSPolicy &	setAlpnProtocols (const std::vector< std::string > &alpnProtocols)
	set the list of protocols to be used for ALPN.
TLSPolicy &	setAlpnProtocols (std::vector< std::string > &&alpnProtocols)
TLSPolicy &	setUseSystemCertStore (bool useSystemCertStore)
	Weather to use the system's certificate store.
TLSPolicy &	setValidate (bool enable)
	Enable certificate validation.
TLSPolicy &	setAllowBrokenChain (bool allow)
	Allow broken chain (self-signed certificate, root CA not in allowed list, etc..) but still validate the domain name and date. This option has no effect if validate is false.
const std::vector< std::pair< std::string, std::string > > &	getConfCmds () const
const std::string &	getHostname () const
const std::string &	getCertPath () const
const std::string &	getKeyPath () const
const std::string &	getCaPath () const
bool	getUseOldTLS () const
bool	getValidate () const
bool	getAllowBrokenChain () const
const std::vector< std::string > &	getAlpnProtocols () const
const std::vector< std::string > &	getAlpnProtocols ()
bool	getUseSystemCertStore () const

Static Public Member Functions
static std::shared_ptr< TLSPolicy >	defaultServerPolicy (const std::string &certPath, const std::string &keyPath)
static std::shared_ptr< TLSPolicy >	defaultClientPolicy (const std::string &hostname="")

Protected Attributes
std::vector< std::pair< std::string, std::string > >	sslConfCmds_ = {}
std::string	hostname_ = ""
std::string	certPath_ = ""
std::string	keyPath_ = ""
std::string	caPath_ = ""
std::vector< std::string >	alpnProtocols_ = {}
bool	useOldTLS_ = false
bool	validate_ = true
bool	allowBrokenChain_ = false
bool	useSystemCertStore_ = true

Member Function Documentation

setAllowBrokenChain()

TLSPolicy & trantor::TLSPolicy::setAllowBrokenChain ( bool allow )

inline

Allow broken chain (self-signed certificate, root CA not in allowed list, etc..) but still validate the domain name and date. This option has no effect if validate is false.

Note

IMPORTANT: This option makes more then self signed certificates valid. It also allows certificates that are not signed by a trusted CA, the CA gets revoked. But the underlying implementation may still check for the type of certificate, date and hostname, etc.. To disable all certificate validation, use setValidate(false).

setAlpnProtocols()

TLSPolicy & trantor::TLSPolicy::setAlpnProtocols ( const std::vector< std::string > & alpnProtocols )

inline

set the list of protocols to be used for ALPN.

Note

for servers, it selects matching protocol against the client's list. And the first matching protocol supplied in the parameter will be selected. If no matching protocol is found, the connection will be closed.

for clients, it sends the list of protocols to the server.

setConfCmds()

TLSPolicy & trantor::TLSPolicy::setConfCmds ( const std::vector< std::pair< std::string, std::string > > & sslConfCmds )

inline

set the ssl configuration commands. The commands will be passed to the ssl library. The commands are in the form of {{key, value}}. for example, {"SSL_OP_NO_SSLv2", "1"}. Not all TLS providers support this feature AND the meaning of the commands may vary between TLS providers.

As of 2023-03 Only OpenSSL supports this feature. LibreSSL does not nor Botan.

setUseSystemCertStore()

TLSPolicy & trantor::TLSPolicy::setUseSystemCertStore ( bool useSystemCertStore )

inline

Weather to use the system's certificate store.

Note

setting both not to use the system's certificate store and to supply a CA path WILL LEAD TO NO CERTIFICATE VALIDATION AT ALL.

---

The documentation for this struct was generated from the following file:

• trantor/net/TLSPolicy.h