TsgcHTTP3Client › Properties › TLSOptions
TLS 1.3 parameters used by the QUIC connection.
property TLSOptions: TsgcHTTP3SSLOptions read FTLSOptions write SetTLSOptions;TsgcHTTP3SSLOptions
See the individual parameters below.
QUIC always encrypts, and it always uses TLS 1.3, so there is no option to turn security off or to select an older protocol version. TLSOptions configures the certificates and the verification policy of that mandatory handshake, and must be set before connecting.
The parameters are:
CertFile (String, default empty): client certificate file, only needed when the server requests mutual TLS.
KeyFile (String, default empty): private key matching CertFile.
Password (String, default empty): password protecting the private key.
RootCertFile (String, default empty): CA bundle used to verify the server certificate. Leave it empty to use the default trust store.
VerifyCertificate (Boolean, default True): verifies the server certificate. The result is enforced, so a chain that does not validate aborts the connection. Verification also binds the certificate to the host being contacted. A DNS name is matched against the host names in the certificate, and an IP literal is matched against the IP entries, so a certificate that has a valid chain but was issued for a different name is rejected. The binding is taken automatically from the connection target, there is nothing extra to configure. When RootCertFile is empty the operating system default trust store is used. Disabling verification makes the connection vulnerable to interception, so keep it enabled outside controlled test environments.
VerifyDepth (Integer, default 2): maximum length of the certificate chain accepted during verification.
OpenSSL_Options (TsgcOpenSSLClient_Options): where the OpenSSL library is loaded from and which API version is used. It defaults to API version oslAPI_3_0, and OpenSSL 3.5 or later is required because that is the first release providing native QUIC.
IOHandler (TwsTLSIOHandler, default iohOpenSSL): TLS engine of the QUIC handshake. iohOpenSSL keeps the OpenSSL path and the automatic engine selection. iohNativeTLS runs the TLS 1.3 handshake on the native TLS engine of the sgcCrypto pack and always uses the sgc QUIC engine, with the server certificate verified against RootCertFile or the system roots, host name included. Session tickets, resumption and 0-RTT work as on OpenSSL. The QUIC packet protection is native too, so OpenSSL is not loaded at all. See SSL without OpenSSL.
If you are upgrading, note that earlier versions computed the verification result and then discarded it, so with VerifyCertificate enabled the client accepted any certificate, including one signed by an untrusted authority and one issued to a different host. The check is now applied. A deployment that connected successfully before can start failing, because certificates that were silently accepted are now verified. Install the issuing authority in the trust store, or point RootCertFile at a bundle that contains it.
oClient.TLSOptions.VerifyCertificate := True;
oClient.TLSOptions.RootCertFile := 'ca-bundle.pem';