TsgcTCPClient › Properties › TLSOptions
Configures certificates, TLS version, ALPN, IOHandler and other secure-connection details used when TLS is enabled.
property TLSOptions: TsgcWSTLS_Options read FTLSOptions write SetTLSOptions;—
Accessible only when TLS is True. Sub-properties include RootCertFile, CertFile, KeyFile, Password, VerifyCertificate, VerifyDepth, Version (from tlsUndefined through tls1_3), ALPNProtocols and IOHandler (iohOpenSSL, iohSChannel, iohAndroidTLS, iohAppleTLS or iohNativeTLS). On Android, iohAndroidTLS uses the platform native TLS (javax.net.ssl.SSLEngine) and on iOS and macOS, iohAppleTLS uses Apple native TLS, so no OpenSSL libraries need to be deployed; native platform TLS requires the Enterprise edition. OpenSSL-specific settings live under OpenSSL_Options and SChannel-specific settings under SChannel_Options.
VerifyCertificate controls certificate validation the same way for every IOHandler, including iohSChannel: it defaults to False, so a server presenting a self-signed, expired, or wrong-hostname certificate is accepted without any warning until it is set to True. With SChannel, validation is then performed against the Windows certificate store; OnSChannelVerifyPeer lets the application inspect the chain or accept a certificate that would otherwise be rejected.
VerifyCertificate says nothing about whether the certificate has been revoked since it was issued, so a stolen key whose certificate was revoked but has not yet expired still authenticates. With iohSChannel, the revocation status is checked only when SChannel_Options.Revocation.Check is set to something other than scrcDisabled (the default): scrcEndCertificate checks the server certificate alone, scrcChainExcludeRoot checks it together with the intermediates, and scrcChain includes the root. Revocation.Timeout bounds the whole CRL and OCSP retrieval (5000 ms by default) so an unreachable responder cannot stall the handshake, Revocation.CacheOnly uses only what Windows has already cached and never goes to the network, and Revocation.IgnoreRevocationOffline and Revocation.IgnoreNoRevocationCheck (both True) decide whether an unreachable responder or a certificate publishing no revocation information is accepted. A certificate confirmed revoked is always rejected. Setting Preset := tlspSecureDefaults enables the check as scrcChainExcludeRoot. See SChannel Certificate Revocation.
IOHandler also accepts iohNativeTLS, the pure Object Pascal TLS engine of the sgcCrypto pack, which speaks TLS 1.3 and TLS 1.2. It loads no OpenSSL library and on TLS 1.3 offers the hybrid post-quantum key exchange groups of RFC 10024, with X25519MLKEM768 first, so a client that selects it negotiates a post-quantum key exchange against any server that supports one. The two preference lists are NativeTLS_Options.Groups and NativeTLS_Options.CipherSuites, colon separated in the OpenSSL style, and an empty list keeps the engine defaults.
For the native engine Version is the lowest version allowed, not an exact version as with iohOpenSSL. tlsUndefined (the default) and tls1_2 negotiate TLS 1.3 or TLS 1.2, tls1_3 negotiates TLS 1.3 only, and tls1_0 or tls1_1 raise a configuration error on connect, because the engine supports TLS 1.2 and TLS 1.3 only. For TLS 1.2 only, name only TLS 1.2 suites, such as TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, in NativeTLS_Options.CipherSuites. The engine trusts the roots in RootCertFile, and NativeTLS_Options.UseSystemRoots (False by default) adds the roots the operating system trusts: the Windows ROOT certificate store, the Security.framework anchors on macOS (with /etc/ssl/cert.pem as the fallback), a Security.framework evaluation of the peer chain on iOS, the Conscrypt or /system/etc/security/cacerts folder on Android, and on Linux the first CA bundle file found among six standard locations, starting with /etc/ssl/certs/ca-certificates.crt. When no system root is found, VerifyCertificate := True needs a root file. CertFile may also be a .pfx or .p12 file, opened with Password. The engine resumes sessions with TLS 1.3 and TLS 1.2 session tickets, kept in a session cache of the component, so a reconnection skips the full handshake. NativeTLS_Options.SessionTickets (True by default) turns this on, and TLS 1.2 resumption requires the server to support the extended master secret. It does not send 0-RTT data and it does not raise OnSSLVerifyPeer, which belongs to the OpenSSL handler. To pin the name the certificate must carry, set OpenSSL_Options.X509Checks.HostName or IPAddress, which the native engine reads as well. See Native TLS.
oTCP := TsgcTCPClient.Create(nil);
oTCP.Host := 'www.esegece.com';
oTCP.Port := 2053;
oTCP.TLS := true;
oTCP.TLSOptions.Version := tls1_2;
oTCP.TLSOptions.VerifyCertificate := true;
oTCP.TLSOptions.RootCertFile := 'cacert.pem';
oTCP.Active := true;