TsgcHTTPServer › Properties › SSLOptions
Holds certificate paths, TLS version selection and OpenSSL tuning for the TLS listener.
property SSLOptions: TsgcWSSSL_Options read FSSLOptions write SetSSLOptions;Version=tlsUndefined, VerifyCertificate=False
Supply the certificate material before activating the server when SSL is True: RootCertFile, CertFile and KeyFile point to PEM files (use the same path for all three when the file contains the full chain), and Password is required only if the private key is encrypted. Password is also read by the HTTP/3 listener enabled through HTTP3Options, so the same encrypted key file serves both listeners. Set VerifyCertificate to True to request and validate client certificates (sub-options FailIfNoCertificate and VerifyClientOnce refine the check) with VerifyDepth controlling chain length. Version picks a specific TLS version (tls1_0, tls1_1, tls1_2, tls1_3) or leaves negotiation open (tlsUndefined). With iohNativeTLS it is the lowest version allowed instead, see below. OpenSSL_Options exposes low-level knobs: APIVersion (oslAPI_1_0/oslAPI_1_1/oslAPI_3_0), LibPath/LibPathCustom for locating the OpenSSL binaries, UnixSymLinks, ECDHE, CipherList, CurveList, VersionMin and X509Checks for hostname/IP validation.
IOHandler selects the TLS engine. iohOpenSSL is the default and iohSChannel uses the Windows provider. iohNativeTLS selects the pure Object Pascal TLS engine of the sgcCrypto pack, which speaks TLS 1.3 and TLS 1.2: no OpenSSL library is loaded, and on TLS 1.3 the hybrid post-quantum key exchange groups of RFC 10024 are offered with X25519MLKEM768 first. Its two preference lists are NativeTLS_Options.Groups and NativeTLS_Options.CipherSuites, colon separated in the OpenSSL style, and an empty list keeps the engine defaults. The engine runs on the classic thread per connection engine and on the IOCP and EPOLL engines alike. iohAppleTLS and iohAndroidTLS are client only handlers: a server with one of them raises an exception when Active is set to True, unless OnSSLGetHandler supplies its own handler. Use iohNativeTLS, iohOpenSSL or, on Windows, iohSChannel instead.
For the native engine Version is the lowest version allowed, not an exact version as with iohOpenSSL. tlsUndefined (the default) and tls1_2 accept TLS 1.3 and TLS 1.2, tls1_3 accepts TLS 1.3 only, and tls1_0 or tls1_1 raise a configuration error when the server starts, because the engine supports TLS 1.2 and TLS 1.3 only. To accept TLS 1.2 only, name only TLS 1.2 suites, such as TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, in NativeTLS_Options.CipherSuites. The engine validates client certificates against the roots in RootCertFile, plus the roots the operating system trusts when NativeTLS_Options.UseSystemRoots is True (False by default). With iohNativeTLS, CertFile may also be a .pfx or .p12 file holding the certificate, the chain and the key, opened with Password. The engine resumes sessions with TLS 1.3 and TLS 1.2 session tickets: NativeTLS_Options.SessionTickets (True by default) turns them on and NativeTLS_Options.TicketLifetime (7200 seconds by default) sets how long a ticket can be used. TLS 1.2 resumption requires the client to support the extended master secret. It does not accept 0-RTT and it does not raise OnSSLVerifyPeer, which belongs to the OpenSSL handler. VerifyCertificate asks the client for a certificate and validates it, VerifyCertificate_Options.FailIfNoCertificate refuses a client that sends none, and VerifyClientOnce has no effect because the engine never renegotiates. See Native TLS.
AllowPlainText (False by default) lets the TLS listener also accept plain HTTP and WebSocket connections on the same port. The server peeks at the first byte of every new connection: $16 (TLS handshake record) means TLS, anything else is handled as plain text, and when no byte arrives within PlainTextTimeout (milliseconds, 5000 by default) the connection is treated as TLS. PlainTextPolicy decides what happens to a plain connection: ptpServe (the default) serves the request normally, ptpRedirect answers 308 Permanent Redirect to https://<Host><path>, keeping the method and the body (400 Bad Request when the request has no Host header), and ptpReject answers 400 Bad Request and closes the connection. The connection property TLS of TsgcWSConnectionServer tells whether a connection uses TLS. These options work with the default Indy IOHandler and with the IOCP and EPOLL IOHandlers. Inside OnCommandGet, the server method IsTLS(AContext) tells whether the request uses TLS. See TLS and plain HTTP on the same port.
oServer := TsgcHTTPServer.Create(nil);
oServer.SSL := true;
oServer.SSLOptions.CertFile := 'c:\certificates\mycert.pem';
oServer.SSLOptions.KeyFile := 'c:\certificates\mycert.pem';
oServer.SSLOptions.RootCertFile := 'c:\certificates\mycert.pem';
oServer.SSLOptions.Version := tls1_3;
oServer.SSLOptions.OpenSSL_Options.VersionMin := tls1_2;
oServer.SSLOptions.Port := 443;
oServer.Active := true;