TsgcWebSocketLoadBalancerServer › Properties › SSLOptions
Holds certificate paths, TLS version selection and OpenSSL tuning for the load balancer's TLS listener.
property SSLOptions: TsgcWSSSL_Options read FSSLOptions write SetSSLOptions;Version=tlsUndefined, VerifyCertificate=False
Supply the certificate material before activating the load balancer when SSL is True: RootCertFile, CertFile and KeyFile point to PEM files (use the same path for all three when the file contains the full chain), and Password is required only if the private key is encrypted. Set VerifyCertificate to True to request and validate client certificates (sub-options FailIfNoCertificate and VerifyClientOnce refine the check) with VerifyDepth controlling chain length; this is useful when the registering backends must present a client certificate for mutual TLS. Version picks a specific TLS version (tls1_0, tls1_1, tls1_2, tls1_3) or leaves negotiation open (tlsUndefined). With iohNativeTLS it is the lowest version allowed instead, see below. OpenSSL_Options exposes low-level knobs: APIVersion (oslAPI_1_0/oslAPI_1_1/oslAPI_3_0), LibPath/LibPathCustom, UnixSymLinks, ECDHE, CipherList, CurveList, VersionMin and X509Checks.
IOHandler selects the TLS engine. iohOpenSSL is the default and iohSChannel uses the Windows provider. iohNativeTLS selects the pure Object Pascal TLS engine of the sgcCrypto pack, which speaks TLS 1.3 and TLS 1.2: no OpenSSL library is loaded, and on TLS 1.3 the hybrid post-quantum key exchange groups of RFC 10024 are offered with X25519MLKEM768 first. Its two preference lists are NativeTLS_Options.Groups and NativeTLS_Options.CipherSuites, colon separated in the OpenSSL style, and an empty list keeps the engine defaults. The engine runs on the classic thread per connection engine and on the IOCP and EPOLL engines alike. iohAppleTLS and iohAndroidTLS are client only handlers: a server with one of them raises an exception when Active is set to True, unless OnSSLGetHandler supplies its own handler. Use iohNativeTLS, iohOpenSSL or, on Windows, iohSChannel instead.
For the native engine Version is the lowest version allowed, not an exact version as with iohOpenSSL. tlsUndefined (the default) and tls1_2 accept TLS 1.3 and TLS 1.2, tls1_3 accepts TLS 1.3 only, and tls1_0 or tls1_1 raise a configuration error when the server starts, because the engine supports TLS 1.2 and TLS 1.3 only. To accept TLS 1.2 only, name only TLS 1.2 suites, such as TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, in NativeTLS_Options.CipherSuites. The engine validates client certificates against the roots in RootCertFile, plus the roots the operating system trusts when NativeTLS_Options.UseSystemRoots is True (False by default). With iohNativeTLS, CertFile may also be a .pfx or .p12 file holding the certificate, the chain and the key, opened with Password. The engine resumes sessions with TLS 1.3 and TLS 1.2 session tickets: NativeTLS_Options.SessionTickets (True by default) turns them on and NativeTLS_Options.TicketLifetime (7200 seconds by default) sets how long a ticket can be used. TLS 1.2 resumption requires the client to support the extended master secret. It does not accept 0-RTT and it does not raise the OnSSLVerifyPeer event, which belongs to the OpenSSL handler. VerifyCertificate asks the client for a certificate and validates it, VerifyCertificate_Options.FailIfNoCertificate refuses a client that sends none, and VerifyClientOnce has no effect because the engine never renegotiates. See Native TLS.
oServer := TsgcWebSocketLoadBalancerServer.Create(nil);
oServer.SSL := true;
oServer.SSLOptions.CertFile := 'c:\certificates\mycert.pem';
oServer.SSLOptions.KeyFile := 'c:\certificates\mycert.pem';
oServer.SSLOptions.RootCertFile := 'c:\certificates\mycert.pem';
oServer.SSLOptions.Version := tls1_3;
oServer.SSLOptions.OpenSSL_Options.VersionMin := tls1_2;
oServer.SSLOptions.Port := 443;
oServer.Active := true;