|
Packit |
c4476c |
=pod
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=head1 NAME
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
TLSv1_2_method, TLSv1_2_server_method, TLSv1_2_client_method,
|
|
Packit |
c4476c |
SSL_CTX_new, SSL_CTX_up_ref, SSLv3_method, SSLv3_server_method,
|
|
Packit |
c4476c |
SSLv3_client_method, TLSv1_method, TLSv1_server_method, TLSv1_client_method,
|
|
Packit |
c4476c |
TLSv1_1_method, TLSv1_1_server_method, TLSv1_1_client_method, TLS_method,
|
|
Packit |
c4476c |
TLS_server_method, TLS_client_method, SSLv23_method, SSLv23_server_method,
|
|
Packit |
c4476c |
SSLv23_client_method, DTLS_method, DTLS_server_method, DTLS_client_method,
|
|
Packit |
c4476c |
DTLSv1_method, DTLSv1_server_method, DTLSv1_client_method,
|
|
Packit |
c4476c |
DTLSv1_2_method, DTLSv1_2_server_method, DTLSv1_2_client_method
|
|
Packit |
c4476c |
- create a new SSL_CTX object as framework for TLS/SSL or DTLS enabled
|
|
Packit |
c4476c |
functions
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=head1 SYNOPSIS
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
#include <openssl/ssl.h>
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
SSL_CTX *SSL_CTX_new(const SSL_METHOD *method);
|
|
Packit |
c4476c |
int SSL_CTX_up_ref(SSL_CTX *ctx);
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
const SSL_METHOD *TLS_method(void);
|
|
Packit |
c4476c |
const SSL_METHOD *TLS_server_method(void);
|
|
Packit |
c4476c |
const SSL_METHOD *TLS_client_method(void);
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
const SSL_METHOD *SSLv23_method(void);
|
|
Packit |
c4476c |
const SSL_METHOD *SSLv23_server_method(void);
|
|
Packit |
c4476c |
const SSL_METHOD *SSLv23_client_method(void);
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
#ifndef OPENSSL_NO_SSL3_METHOD
|
|
Packit |
c4476c |
const SSL_METHOD *SSLv3_method(void);
|
|
Packit |
c4476c |
const SSL_METHOD *SSLv3_server_method(void);
|
|
Packit |
c4476c |
const SSL_METHOD *SSLv3_client_method(void);
|
|
Packit |
c4476c |
#endif
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
#ifndef OPENSSL_NO_TLS1_METHOD
|
|
Packit |
c4476c |
const SSL_METHOD *TLSv1_method(void);
|
|
Packit |
c4476c |
const SSL_METHOD *TLSv1_server_method(void);
|
|
Packit |
c4476c |
const SSL_METHOD *TLSv1_client_method(void);
|
|
Packit |
c4476c |
#endif
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
#ifndef OPENSSL_NO_TLS1_1_METHOD
|
|
Packit |
c4476c |
const SSL_METHOD *TLSv1_1_method(void);
|
|
Packit |
c4476c |
const SSL_METHOD *TLSv1_1_server_method(void);
|
|
Packit |
c4476c |
const SSL_METHOD *TLSv1_1_client_method(void);
|
|
Packit |
c4476c |
#endif
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
#ifndef OPENSSL_NO_TLS1_2_METHOD
|
|
Packit |
c4476c |
const SSL_METHOD *TLSv1_2_method(void);
|
|
Packit |
c4476c |
const SSL_METHOD *TLSv1_2_server_method(void);
|
|
Packit |
c4476c |
const SSL_METHOD *TLSv1_2_client_method(void);
|
|
Packit |
c4476c |
#endif
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
const SSL_METHOD *DTLS_method(void);
|
|
Packit |
c4476c |
const SSL_METHOD *DTLS_server_method(void);
|
|
Packit |
c4476c |
const SSL_METHOD *DTLS_client_method(void);
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
#ifndef OPENSSL_NO_DTLS1_METHOD
|
|
Packit |
c4476c |
const SSL_METHOD *DTLSv1_method(void);
|
|
Packit |
c4476c |
const SSL_METHOD *DTLSv1_server_method(void);
|
|
Packit |
c4476c |
const SSL_METHOD *DTLSv1_client_method(void);
|
|
Packit |
c4476c |
#endif
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
#ifndef OPENSSL_NO_DTLS1_2_METHOD
|
|
Packit |
c4476c |
const SSL_METHOD *DTLSv1_2_method(void);
|
|
Packit |
c4476c |
const SSL_METHOD *DTLSv1_2_server_method(void);
|
|
Packit |
c4476c |
const SSL_METHOD *DTLSv1_2_client_method(void);
|
|
Packit |
c4476c |
#endif
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=head1 DESCRIPTION
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
SSL_CTX_new() creates a new B<SSL_CTX> object as framework to
|
|
Packit |
c4476c |
establish TLS/SSL or DTLS enabled connections. An B<SSL_CTX> object is
|
|
Packit |
c4476c |
reference counted. Creating an B<SSL_CTX> object for the first time increments
|
|
Packit |
c4476c |
the reference count. Freeing it (using SSL_CTX_free) decrements it. When the
|
|
Packit |
c4476c |
reference count drops to zero, any memory or resources allocated to the
|
|
Packit |
c4476c |
B<SSL_CTX> object are freed. SSL_CTX_up_ref() increments the reference count for
|
|
Packit |
c4476c |
an existing B<SSL_CTX> structure.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=head1 NOTES
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
The SSL_CTX object uses B<method> as connection method.
|
|
Packit |
c4476c |
The methods exist in a generic type (for client and server use), a server only
|
|
Packit |
c4476c |
type, and a client only type.
|
|
Packit |
c4476c |
B<method> can be of the following types:
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=over 4
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=item TLS_method(), TLS_server_method(), TLS_client_method()
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
These are the general-purpose I<version-flexible> SSL/TLS methods.
|
|
Packit |
c4476c |
The actual protocol version used will be negotiated to the highest version
|
|
Packit |
c4476c |
mutually supported by the client and the server.
|
|
Packit |
c4476c |
The supported protocols are SSLv3, TLSv1, TLSv1.1, TLSv1.2 and TLSv1.3.
|
|
Packit |
c4476c |
Applications should use these methods, and avoid the version-specific
|
|
Packit |
c4476c |
methods described below, which are deprecated.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=item SSLv23_method(), SSLv23_server_method(), SSLv23_client_method()
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
These functions do not exist anymore, they have been renamed to
|
|
Packit |
c4476c |
TLS_method(), TLS_server_method() and TLS_client_method() respectively.
|
|
Packit |
c4476c |
Currently, the old function calls are renamed to the corresponding new
|
|
Packit |
c4476c |
ones by preprocessor macros, to ensure that existing code which uses the
|
|
Packit |
c4476c |
old function names still compiles. However, using the old function names
|
|
Packit |
c4476c |
is deprecated and new code should call the new functions instead.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=item TLSv1_2_method(), TLSv1_2_server_method(), TLSv1_2_client_method()
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
A TLS/SSL connection established with these methods will only understand the
|
|
Packit |
c4476c |
TLSv1.2 protocol. These methods are deprecated.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=item TLSv1_1_method(), TLSv1_1_server_method(), TLSv1_1_client_method()
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
A TLS/SSL connection established with these methods will only understand the
|
|
Packit |
c4476c |
TLSv1.1 protocol. These methods are deprecated.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=item TLSv1_method(), TLSv1_server_method(), TLSv1_client_method()
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
A TLS/SSL connection established with these methods will only understand the
|
|
Packit |
c4476c |
TLSv1 protocol. These methods are deprecated.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=item SSLv3_method(), SSLv3_server_method(), SSLv3_client_method()
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
A TLS/SSL connection established with these methods will only understand the
|
|
Packit |
c4476c |
SSLv3 protocol.
|
|
Packit |
c4476c |
The SSLv3 protocol is deprecated and should not be used.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=item DTLS_method(), DTLS_server_method(), DTLS_client_method()
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
These are the version-flexible DTLS methods.
|
|
Packit |
c4476c |
Currently supported protocols are DTLS 1.0 and DTLS 1.2.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=item DTLSv1_2_method(), DTLSv1_2_server_method(), DTLSv1_2_client_method()
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
These are the version-specific methods for DTLSv1.2.
|
|
Packit |
c4476c |
These methods are deprecated.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=item DTLSv1_method(), DTLSv1_server_method(), DTLSv1_client_method()
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
These are the version-specific methods for DTLSv1.
|
|
Packit |
c4476c |
These methods are deprecated.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=back
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
SSL_CTX_new() initializes the list of ciphers, the session cache setting, the
|
|
Packit |
c4476c |
callbacks, the keys and certificates and the options to their default values.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
TLS_method(), TLS_server_method(), TLS_client_method(), DTLS_method(),
|
|
Packit |
c4476c |
DTLS_server_method() and DTLS_client_method() are the I<version-flexible>
|
|
Packit |
c4476c |
methods.
|
|
Packit |
c4476c |
All other methods only support one specific protocol version.
|
|
Packit |
c4476c |
Use the I<version-flexible> methods instead of the version specific methods.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
If you want to limit the supported protocols for the version flexible
|
|
Packit |
c4476c |
methods you can use L<SSL_CTX_set_min_proto_version(3)>,
|
|
Packit |
c4476c |
L<SSL_set_min_proto_version(3)>, L<SSL_CTX_set_max_proto_version(3)> and
|
|
Packit |
c4476c |
L<SSL_set_max_proto_version(3)> functions.
|
|
Packit |
c4476c |
Using these functions it is possible to choose e.g. TLS_server_method()
|
|
Packit |
c4476c |
and be able to negotiate with all possible clients, but to only
|
|
Packit |
c4476c |
allow newer protocols like TLS 1.0, TLS 1.1, TLS 1.2 or TLS 1.3.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
The list of protocols available can also be limited using the
|
|
Packit |
c4476c |
B<SSL_OP_NO_SSLv3>, B<SSL_OP_NO_TLSv1>, B<SSL_OP_NO_TLSv1_1>,
|
|
Packit |
c4476c |
B<SSL_OP_NO_TLSv1_3>, B<SSL_OP_NO_TLSv1_2> and B<SSL_OP_NO_TLSv1_3>
|
|
Packit |
c4476c |
options of the
|
|
Packit |
c4476c |
L<SSL_CTX_set_options(3)> or L<SSL_set_options(3)> functions, but this approach
|
|
Packit |
c4476c |
is not recommended. Clients should avoid creating "holes" in the set of
|
|
Packit |
c4476c |
protocols they support. When disabling a protocol, make sure that you also
|
|
Packit |
c4476c |
disable either all previous or all subsequent protocol versions.
|
|
Packit |
c4476c |
In clients, when a protocol version is disabled without disabling I<all>
|
|
Packit |
c4476c |
previous protocol versions, the effect is to also disable all subsequent
|
|
Packit |
c4476c |
protocol versions.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
The SSLv3 protocol is deprecated and should generally not be used.
|
|
Packit |
c4476c |
Applications should typically use L<SSL_CTX_set_min_proto_version(3)> to set
|
|
Packit |
c4476c |
the minimum protocol to at least B<TLS1_VERSION>.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=head1 RETURN VALUES
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
The following return values can occur:
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=over 4
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=item NULL
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
The creation of a new SSL_CTX object failed. Check the error stack to find out
|
|
Packit |
c4476c |
the reason.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=item Pointer to an SSL_CTX object
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
The return value points to an allocated SSL_CTX object.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
SSL_CTX_up_ref() returns 1 for success and 0 for failure.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=back
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=head1 SEE ALSO
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
L<SSL_CTX_set_options(3)>, L<SSL_CTX_free(3)>, L<SSL_accept(3)>,
|
|
Packit |
c4476c |
L<SSL_CTX_set_min_proto_version(3)>, L<ssl(7)>, L<SSL_set_connect_state(3)>
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=head1 HISTORY
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
Support for SSLv2 and the corresponding SSLv2_method(),
|
|
Packit |
c4476c |
SSLv2_server_method() and SSLv2_client_method() functions where
|
|
Packit |
c4476c |
removed in OpenSSL 1.1.0.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
SSLv23_method(), SSLv23_server_method() and SSLv23_client_method()
|
|
Packit |
c4476c |
were deprecated and the preferred TLS_method(), TLS_server_method()
|
|
Packit |
c4476c |
and TLS_client_method() functions were added in OpenSSL 1.1.0.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
All version-specific methods were deprecated in OpenSSL 1.1.0.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=head1 COPYRIGHT
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
Licensed under the OpenSSL license (the "License"). You may not use
|
|
Packit |
c4476c |
this file except in compliance with the License. You can obtain a copy
|
|
Packit |
c4476c |
in the file LICENSE in the source distribution or at
|
|
Packit |
c4476c |
L<https://www.openssl.org/source/license.html>.
|
|
Packit |
c4476c |
|
|
Packit |
c4476c |
=cut
|