TsgcWebSocketServer › Properties › SSLOptions
Holds certificate paths, TLS version selection and OpenSSL tuning for the TLS listener.
property SSLOptions: TsgcWSSSL_Options read FSSLOptions write SetSSLOptions;Version=tlsUndefined, VerifyCertificate=False
Supply the certificate material before activating the server when SSL is True: RootCertFile, CertFile and KeyFile point to PEM files (use the same path for all three when the file contains the full chain), and Password is required only if the private key is encrypted. Set VerifyCertificate to True to request and validate client certificates (sub-options FailIfNoCertificate and VerifyClientOnce refine the check) with VerifyDepth controlling chain length. Version picks a specific TLS version (tls1_0, tls1_1, tls1_2, tls1_3) or leaves negotiation open (tlsUndefined). With iohNativeTLS it is the lowest version allowed instead, see below. OpenSSL_Options exposes low-level knobs: APIVersion (oslAPI_1_0/oslAPI_1_1/oslAPI_3_0), LibPath/LibPathCustom for locating the OpenSSL binaries, UnixSymLinks, ECDHE, CipherList, CurveList, VersionMin and X509Checks for hostname/IP validation.
VerifyCertificate says nothing about whether the client certificate has been revoked since it was issued, so a certificate whose key was stolen and whose serial has since been revoked still opens a session until it expires. With IOHandler=iohSChannel, the revocation status of the client certificate is looked up only when SChannel_Options.Revocation.Check is set to something other than scrcDisabled (the default): scrcEndCertificate checks the client certificate alone, scrcChainExcludeRoot checks it together with the intermediates, and scrcChain includes the root. Revocation.Timeout bounds the whole CRL and OCSP retrieval (5000 ms by default) so an unreachable responder cannot stall the handshake, Revocation.CacheOnly uses only what Windows has already cached and never goes to the network, and Revocation.IgnoreRevocationOffline and Revocation.IgnoreNoRevocationCheck (both True) decide whether an unreachable responder or a client certificate publishing no revocation information is accepted. A certificate confirmed revoked is always rejected. Setting Preset := tlspSecureDefaults enables the check as scrcChainExcludeRoot and keeps both soft-fail settings, so a client that used to be admitted is still admitted. See Server SSL | SChannel Client Certificate Revocation.
IOHandler selects the TLS engine. iohOpenSSL is the default and iohSChannel uses the Windows provider. iohNativeTLS selects the pure Object Pascal TLS engine of the sgcCrypto pack, which speaks TLS 1.3 and TLS 1.2: no OpenSSL library is loaded, and on TLS 1.3 the hybrid post-quantum key exchange groups of RFC 10024 are offered with X25519MLKEM768 first. Its two preference lists are NativeTLS_Options.Groups and NativeTLS_Options.CipherSuites, colon separated in the OpenSSL style, and an empty list keeps the engine defaults. The engine runs on the classic thread per connection engine and on the IOCP and EPOLL engines alike. iohAppleTLS and iohAndroidTLS are client only handlers: a server with one of them raises an exception when Active is set to True, unless OnSSLGetHandler supplies its own handler. Use iohNativeTLS, iohOpenSSL or, on Windows, iohSChannel instead.
For the native engine Version is the lowest version allowed, not an exact version as with iohOpenSSL. tlsUndefined (the default) and tls1_2 accept TLS 1.3 and TLS 1.2, tls1_3 accepts TLS 1.3 only, and tls1_0 or tls1_1 raise a configuration error when the server starts, because the engine supports TLS 1.2 and TLS 1.3 only. To accept TLS 1.2 only, name only TLS 1.2 suites, such as TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, in NativeTLS_Options.CipherSuites. The engine validates client certificates against the roots in RootCertFile, plus the roots the operating system trusts when NativeTLS_Options.UseSystemRoots is True (False by default). With iohNativeTLS, CertFile may also be a .pfx or .p12 file holding the certificate, the chain and the key, opened with Password. The engine resumes sessions with TLS 1.3 and TLS 1.2 session tickets: NativeTLS_Options.SessionTickets (True by default) turns them on and NativeTLS_Options.TicketLifetime (7200 seconds by default) sets how long a ticket can be used. TLS 1.2 resumption requires the client to support the extended master secret. It does not accept 0-RTT and it does not raise OnSSLVerifyPeer, which belongs to the OpenSSL handler. VerifyCertificate asks the client for a certificate and validates it, VerifyCertificate_Options.FailIfNoCertificate refuses a client that sends none, and VerifyClientOnce has no effect because the engine never renegotiates. See Native TLS.
AllowPlainText (False by default) lets the TLS listener also accept plain HTTP and WebSocket connections on the same port. The server peeks at the first byte of every new connection: $16 (TLS handshake record) means TLS, anything else is handled as plain text, and when no byte arrives within PlainTextTimeout (milliseconds, 5000 by default) the connection is treated as TLS. PlainTextPolicy decides what happens to a plain connection: ptpServe (the default) serves the request normally, ptpRedirect answers 308 Permanent Redirect to https://<Host><path>, keeping the method and the body (400 Bad Request when the request has no Host header), and ptpReject answers 400 Bad Request and closes the connection. The connection property TLS of TsgcWSConnectionServer tells whether a connection uses TLS. These options work with the default Indy IOHandler and with the IOCP and EPOLL IOHandlers. Inside OnCommandGet, the server method IsTLS(AContext) tells whether the request uses TLS. See TLS and plain HTTP on the same port.
oServer := TsgcWebSocketServer.Create(nil);
oServer.SSL := true;
oServer.SSLOptions.CertFile := 'c:\certificates\mycert.pem';
oServer.SSLOptions.KeyFile := 'c:\certificates\mycert.pem';
oServer.SSLOptions.RootCertFile := 'c:\certificates\mycert.pem';
oServer.SSLOptions.Version := tls1_3;
oServer.SSLOptions.OpenSSL_Options.VersionMin := tls1_2;
oServer.SSLOptions.Port := 443;
oServer.Active := true;