TsgcQUICServer › Properties › QUICOptions
Server configuration: the mandatory TLS certificate and private key, and the connection limit.
property QUICOptions: TsgcQUICServerOptions read FQUICOptions write SetQUICOptions;MaxConnections=0; SSLOptions.Password=''; SSLOptions.VerifyCertificate=False; SSLOptions.OpenSSL_Options.APIVersion=oslAPI_3_0
Groups everything applied to the QUIC listener when Start builds it. This is the only property TsgcQUICServer publishes besides its events, so it is where the whole server setup happens. Assigning the property copies the source values (Assign semantics) rather than replacing the object, so the usual pattern is to set the members in place.
A certificate and a private key are mandatory. QUIC always runs over TLS 1.3 (RFC 9001), there is no plaintext mode, so the server cannot start without them. Start raises an exception when either path is empty, when a file cannot be loaded, or when the key does not match the certificate.
| Name | Type | Default | Description |
|---|---|---|---|
SSLOptions | TsgcQUICServerSSLOptions | — | The TLS configuration, detailed in the next table. |
MaxConnections | Integer | 0 | Maximum number of simultaneous connections. 0 means unlimited. Once the limit is reached, further connections offered by the listener are dropped immediately, with no OnQUICConnect notification. |
| Name | Type | Default | Description |
|---|---|---|---|
CertFile | string | '' | Required. Path to the server certificate, PEM encoded. Loaded with SSL_CTX_use_certificate_file using SSL_FILETYPE_PEM, so the file must be PEM, not DER. If your CA issued an intermediate chain, concatenate the chain into this file, leaf certificate first. |
KeyFile | string | '' | Required. Path to the private key matching CertFile, PEM encoded. Loaded with SSL_CTX_use_PrivateKey_file. The pair is then verified with SSL_CTX_check_private_key, so a mismatched key fails at Start rather than at handshake time. An encrypted (passphrase-protected) key is supported, set the passphrase in Password. |
Password | string | '' | Passphrase for an encrypted private key. The server installs an OpenSSL password callback before it loads KeyFile, so a passphrase-protected PEM key loads without prompting on the console. Leave it empty for an unencrypted key. In .NET the same member is also used when loading a PFX. |
RootCertFile | string | '' | Path to the CA root certificate used to validate client certificates. Read when VerifyCertificate is True. When it is empty, the OpenSSL default verify paths are used instead. |
VerifyCertificate | Boolean | False | When True, request and verify the client certificate (mutual TLS). The CA anchors are loaded from RootCertFile first, then the context is set to SSL_VERIFY_PEER with SSL_VERIFY_FAIL_IF_NO_PEER_CERT, so a client that presents no certificate, or one that does not validate, is rejected. |
OpenSSL_Options | TsgcOpenSSLClient_Options | APIVersion=oslAPI_3_0 | Low-level OpenSSL settings, chiefly which library to load and from where: APIVersion, LibPath, LibPathCustom, UnixSymLinks, VersionMin, CurveList, LegacyProvider. APIVersion defaults to oslAPI_3_0 and must stay there, QUIC needs the OpenSSL 3.x API. Selecting oslAPI_1_0 or oslAPI_1_1 raises QUIC requires OpenSSL 3.x API. |
IOHandler | TwsTLSIOHandler | iohOpenSSL | TLS engine of the QUIC handshake. iohOpenSSL keeps the OpenSSL path, where the engine is chosen automatically (see QUICMode). iohNativeTLS runs the TLS 1.3 handshake on the native TLS engine of the sgcCrypto pack and always uses the sgc QUIC engine (QUICMode = qmCustom). The certificate is read from PEM or PFX, and client certificates are verified against RootCertFile or the system roots. Session tickets, resumption and 0-RTT work as on OpenSSL. The QUIC packet protection is native too, so OpenSSL is not loaded at all. |
MaxConnections, CertFile, KeyFile, Password and VerifyCertificate are honored in both implementations. In .NET VerifyCertificate is applied as ClientCertificateRequired, and Password is also used when loading a PFX rather than a PEM pair. The .NET certificate loader accepts .pem, .crt, .cer and .key files as PEM, and treats anything else as a PFX.
Any TLS 1.3 capable certificate and key pair works. For development a self-signed pair is enough, though clients must then be told to trust it (or to skip verification):
openssl req -x509 -newkey rsa:2048 -keyout server.key -out server.crt -days 365 -nodes -subj "/CN=localhost"-nodes writes the key unencrypted, which is the simplest option. An unencrypted key also works with the server, and so does an encrypted one, set its passphrase in SSLOptions.Password. For production, use the certificate and key issued by your CA, with the intermediate chain concatenated into the certificate file.
oServer := TsgcQUICServer.Create(nil);
oServer.Port := 4433;
// mandatory: QUIC always runs over TLS 1.3
oServer.QUICOptions.SSLOptions.CertFile := 'server.crt';
oServer.QUICOptions.SSLOptions.KeyFile := 'server.key';
// optional: which OpenSSL 3.5+ build to load, and from where
oServer.QUICOptions.SSLOptions.OpenSSL_Options.APIVersion := oslAPI_3_0;
oServer.QUICOptions.SSLOptions.OpenSSL_Options.LibPath := oslpCustomPath;
oServer.QUICOptions.SSLOptions.OpenSSL_Options.LibPathCustom := '.\openssl\';
// optional: connection limit
oServer.QUICOptions.MaxConnections := 1000;
oServer.OnQUICData := OnQUICDataEvent;
oServer.Start;