This extension provides TCL script access to secure socket communications using the Transport Layer Security (TLS) protocol. It provides a generic binding to OpenSSL, utilizing the -Tcl_StackChannel API in TCL 8.4 and higher. +Tcl_StackChannel API in TCL 8.4 or later. These sockets behave exactly the same as channels created using the built-in socket command, but provide additional options for controlling the SSL/TLS session.
Optional function to set the default options used by tls::socket. If you call tls::import directly, the values set by this command have no effect. This command supports all of the same options as the tls::socket command, -though you should limit your options to only TLS related ones.
This is a helper function that utilizes the underlying commands socket and tls::import to create the connection. It behaves the same as the -native TCL socket command, but also supports the tls:import +native TCL socket command, but also supports the tls::import command options with one additional option. It returns the channel handle id for the new socket.
Specifies the private key to use as a DER encoded string (PKCS#1 DER).
Force this channel to share the same SSL_CTX structure as the specified channel, and therefore share config, callbacks, etc.
Allow post-handshake session ticket updates. This option is new for TclTLS 1.8.
Request a certificate from the peer during the SSL handshake. This is needed to do Certificate Validation. Starting in TclTLS 1.8, the default is -true. Starting in TclTLS 2.0, If set to false and +true. Starting in TclTLS 2.0, if set to false and -require is true, then this will be overridden to true. See Certificate Validation for more details.
Require a valid certificate from the peer during the SSL handshake. If this is set to true, then -request must also be set to true and a either @@ -307,15 +307,15 @@ use of SSL v3 if only available via a compile time option. See the tls::protocols command for supported protocols.
Enable use of TLS v1. Starting in TclTLS 2.0, the default is false. Note: TLS 1.0 needs SHA1 to operate, which is only available in security level -0 for Open SSL 3.0+. See the -security_level option.
Enable use of TLS v1.1. Starting in TclTLS 2.0, the default is false. Note: TLS 1.1 needs SHA1 to operate, which is only available in security level -0 for Open SSL 3.0+. See the -security_level option.
Enable use of TLS v1.2. The default is true.
Enable use of TLS v1.3. The default is true. This is only available starting with OpenSSL 1.1.1 and TclTLS 1.7.
Typically when visiting web sites, only the client needs to check the server's @@ -591,19 +591,18 @@
Specifies the Uniform Resource Identifier (URI) for the Certificate Authority (CA) store, which may be a single container or a catalog of containers. Starting with OpenSSL 3.2 on MS Windows, set to "org.openssl.winstore://" to use the built-in MS Windows Certificate Store. Starting in TclTLS 2.0, this is the default if -cadir, -cadir, and -castore are -not specified. This store only supports root certificate stores. See -Certificate Validation for more details.
Request a certificate from the peer during the SSL handshake. This is needed to do Certificate Validation. Starting in TclTLS 1.8, the default is -true. Starting in TclTLS 2.0, If set to false and +true. Starting in TclTLS 2.0, if set to false and -require is true, then this will be overridden to true. In addition, the client can manually inspect and accept or reject -each certificate using the -validatecommand option.
Require a valid certificate from the peer during the SSL handshake. If this is set to true, then -request must also be set to true and a either -cadir, -cafile, -castore, or a platform default must be provided in order to validate against. The default in TclTLS 1.8 and @@ -750,23 +749,23 @@
For servers, this form of callback is invoked when the client ALPN extension is received. If match is true, then protocol is the first -alpn protocol option in common to both the client and server. If not, the first client specified protocol is used. This callback is called -after the Hello and ALPN callbacks.
For servers, this form of callback is invoked during client hello message processing. The purpose is so the server can select the appropriate certificate to present to the client, and to make other configuration adjustments relevant to that server name and its configuration. It is called before the SNI and ALPN callbacks.
For servers, this form of callback is invoked when the Server Name Indication (SNI) extension is received. The servername argument is the client -provided server name specified in the -servername</b> option. The +provided server name specified in the -servername option. The purpose is so when a server supports multiple names, the right certificate -can be used. It is called after the hello callback but before the ALPN +can be used. It is called after the Hello callback but before the ALPN callback.
This form of callback is invoked by OpenSSL when a new certificate is received from the peer. It allows the client to check the certificate verification results and choose whether to continue or not. It is called for each @@ -870,11 +869,11 @@
The capabilities of this package can vary enormously based upon how the linked to OpenSSL library was configured and built. New versions may obsolete older protocol versions, add or remove ciphers, change default values, etc. -Use the tls::protocols commands to obtain the supported +Use the tls::protocols command to obtain the supported protocol versions.