TsgcWebSocketServer › Properties › SSLOptions
Holds certificate paths, TLS version selection and OpenSSL tuning for the TLS listener.
property SSLOptions: TsgcWSSSL_Options read FSSLOptions write SetSSLOptions;Version=tlsUndefined, VerifyCertificate=False
Supply the certificate material before activating the server when SSL is True: RootCertFile, CertFile and KeyFile point to PEM files (use the same path for all three when the file contains the full chain), and Password is required only if the private key is encrypted. Set VerifyCertificate to True to request and validate client certificates (sub-options FailIfNoCertificate and VerifyClientOnce refine the check) with VerifyDepth controlling chain length. Version picks a specific TLS version (tls1_0, tls1_1, tls1_2, tls1_3) or leaves negotiation open (tlsUndefined). OpenSSL_Options exposes low-level knobs: APIVersion (oslAPI_1_0/oslAPI_1_1/oslAPI_3_0), LibPath/LibPathCustom for locating the OpenSSL binaries, UnixSymLinks, ECDHE, CipherList, CurveList, MinVersion and X509Checks for hostname/IP validation.
VerifyCertificate says nothing about whether the client certificate has been revoked since it was issued, so a certificate whose key was stolen and whose serial has since been revoked still opens a session until it expires. With IOHandler=iohSChannel, the revocation status of the client certificate is looked up only when SChannel_Options.Revocation.Check is set to something other than scrcDisabled (the default): scrcEndCertificate checks the client certificate alone, scrcChainExcludeRoot checks it together with the intermediates, and scrcChain includes the root. Revocation.Timeout bounds the whole CRL and OCSP retrieval (5000 ms by default) so an unreachable responder cannot stall the handshake, Revocation.CacheOnly uses only what Windows has already cached and never goes to the network, and Revocation.IgnoreRevocationOffline and Revocation.IgnoreNoRevocationCheck (both True) decide whether an unreachable responder or a client certificate publishing no revocation information is accepted. A certificate confirmed revoked is always rejected. Setting Preset := tlspSecureDefaults enables the check as scrcChainExcludeRoot and keeps both soft-fail settings, so a client that used to be admitted is still admitted. See Server SSL | SChannel Client Certificate Revocation.
oServer := TsgcWebSocketServer.Create(nil);
oServer.SSL := true;
oServer.SSLOptions.CertFile := 'c:\certificates\mycert.pem';
oServer.SSLOptions.KeyFile := 'c:\certificates\mycert.pem';
oServer.SSLOptions.RootCertFile := 'c:\certificates\mycert.pem';
oServer.SSLOptions.Version := tls1_3;
oServer.SSLOptions.OpenSSL_Options.MinVersion := tls1_2;
oServer.SSLOptions.Port := 443;
oServer.Active := true;