TsgcWebSocketClient › Properties › TLSOptions
Configures certificates, TLS version, ALPN, IOHandler and other secure-connection details used when TLS is enabled.
property TLSOptions: TsgcWSTLS_Options read FTLSOptions write SetTLSOptions;Preset=tlspCustom
Accessible only when TLS is True. Sub-properties include RootCertFile, CertFile, KeyFile, Password, VerifyCertificate, VerifyDepth, Version (from tlsUndefined through tls1_3), ALPNProtocols and IOHandler (iohOpenSSL, iohSChannel, iohAndroidTLS or iohAppleTLS). On Android, iohAndroidTLS uses the platform native TLS (javax.net.ssl.SSLEngine) and on iOS and macOS, iohAppleTLS uses Apple native TLS, so no OpenSSL libraries need to be deployed; native platform TLS requires the Enterprise edition. OpenSSL-specific settings live under OpenSSL_Options and SChannel-specific settings under SChannel_Options.
VerifyCertificate controls certificate validation the same way for every IOHandler, including iohSChannel: it defaults to False, so a server presenting a self-signed, expired, or wrong-hostname certificate is accepted without any warning until it is set to True. With SChannel, validation is then performed against the Windows certificate store; OnSChannelVerifyPeer lets the application inspect the chain or accept a certificate that would otherwise be rejected.
VerifyCertificate says nothing about whether the certificate has been revoked since it was issued, so a stolen key whose certificate was revoked but has not yet expired still authenticates. With iohSChannel, the revocation status is checked only when SChannel_Options.Revocation.Check is set to something other than scrcDisabled (the default): scrcEndCertificate checks the server certificate alone, scrcChainExcludeRoot checks it together with the intermediates, and scrcChain includes the root. Revocation.Timeout bounds the whole CRL and OCSP retrieval (5000 ms by default) so an unreachable responder cannot stall the handshake, Revocation.CacheOnly uses only what Windows has already cached and never goes to the network, and Revocation.IgnoreRevocationOffline and Revocation.IgnoreNoRevocationCheck (both True) decide whether an unreachable responder or a certificate publishing no revocation information is accepted. A certificate confirmed revoked is always rejected. See SChannel Certificate Revocation.
Preset applies a set of secure defaults in a single assignment. With tlspCustom (default) every option keeps the value you configure manually, preserving the previous behaviour. Setting Preset := tlspSecureDefaults enables certificate verification (VerifyCertificate := True), raises Version to at least TLS 1.2 (when a lower or undefined version was configured), enables hostname checking of the server certificate (OpenSSL X509Checks hostname validation) and enables SChannel revocation checking as scrcChainExcludeRoot. Individual options can still be adjusted after applying the preset.
oClient := TsgcWebSocketClient.Create(nil);
oClient.URL := 'wss://www.esegece.com:2053';
oClient.TLSOptions.Version := tls1_2;
oClient.TLSOptions.VerifyCertificate := true;
oClient.TLSOptions.RootCertFile := 'cacert.pem';
oClient.Active := true;