SSL / TLS Backends — sgcWebSockets | eSeGeCe

SSL / TLS Backends

sgcWebSockets ships four interchangeable TLS transports behind a single property, TLSOptions.IOHandler. Choose OpenSSL for maximum portability, or a native platform backend (Windows SChannel, Android, iOS/macOS) that uses the operating system's own TLS stack with no OpenSSL libraries to deploy. On Windows, OpenSSL itself can also be linked statically into your executable, so you stay on OpenSSL with nothing to deploy either. Switching backend is one line of code, nothing else changes.

Overview

Four TLS Transports, One Property

Every backend plugs into the same TLSOptions API. Pick the one that fits your platform and deployment, then set TLSOptions.IOHandler.

OpenSSL

Cross-platform TLS via the OpenSSL libraries, or link statically on Windows to deploy nothing at all. The default, most portable backend, with the widest protocol and cipher coverage. Ships in every edition.

SChannel

Windows-native TLS (Microsoft Secure Channel). No libraries to deploy, uses the Windows certificate store. Windows only. Professional and Enterprise.

Android TLS

Android-native TLS via the platform SSLEngine. No OpenSSL .so to bundle. Android only. Enterprise edition.

Apple TLS

iOS/macOS-native TLS. No OpenSSL .dylib. Auto-selects Network.framework (TLS 1.3) on modern systems. Enterprise edition.
At a glance

Backend Comparison

Platforms, deployment footprint, TLS 1.3 support and edition for each transport.

Backend Platforms Library to deploy TLS 1.3 Edition
OpenSSL Windows, Linux, macOS, iOS, Android libssl/libcrypto, or none on Windows (static link) Yes All editions
SChannel Windows None (built into Windows) Yes (Windows 11/Server 2022+) Professional, Enterprise
Android TLS Android None (uses the OS) Yes Enterprise
Apple TLS iOS, macOS None (uses the OS) Yes (10.14+/iOS 12+) Enterprise
Dedicated guides

Pick a Backend

Each transport has its own page with the full setup, code for Delphi and C++Builder, deployment notes and edition details.

OpenSSL (iohOpenSSL)

Cross-platform TLS over Indy's socket, available on every platform sgcWebSockets targets and the default on most. Full TLS 1.0 to 1.3, the broadest cipher coverage, custom CA, client certificates and ALPN. You deploy the OpenSSL runtime libraries with your app. Included in every edition. On Windows, it can also be linked statically into the executable instead, with nothing to deploy.

Read the full guide →

SChannel (iohSChannel)

Microsoft's native TLS stack (Secure Channel / SSPI), built into Windows. Zero library deployment, no OpenSSL DLLs to ship or patch, and it uses the Windows certificate store. Windows-only. Included in the Professional and Enterprise editions.

Read the full guide →

Native Android TLS (iohAndroidTLS)

Android-native TLS using the platform's SSLEngine through JNI. No OpenSSL .so in your APK, validation against the Android system trust store, TLS 1.3, and ALPN on Android 10 (API 29) and later. Enterprise edition.

Read the full guide →

Native Apple TLS (iohAppleTLS)

Apple-native TLS for iOS and macOS, with no OpenSSL .dylib to deploy. It auto-selects Network.framework (TLS 1.3) on macOS 10.14+ / iOS 12+ and falls back to Secure Transport (TLS 1.2) on older systems, with system trust, SNI, custom CA, client cert / mTLS and ALPN. Enterprise edition.

Read the full guide →

Edition note

Native platform TLS, Android (iohAndroidTLS) and Apple (iohAppleTLS), requires the Enterprise edition. OpenSSL (iohOpenSSL) is included in every edition; SChannel (iohSChannel) is included in the Professional and Enterprise editions. Static linking OpenSSL on Windows also requires Enterprise or All-Access.

Same API

Switch With One Line

All four backends share the same TLSOptions API, so moving between them is a single property change. Nothing else in your code has to change.

TLS & VerifyCertificate

Enable TLS and toggle peer certificate verification the same way on every backend.

RootCertFile

Point at a custom CA root to trust a private or self-signed certificate authority.

CertFile & Password

Supply a client certificate and its password for mutual TLS (mTLS) authentication.

ALPNProtocols

Advertise application protocols (for example http/1.1) during the TLS handshake.

// Same TLSOptions, only the IOHandler line changes per platform.
WSClient.TLS := True;
WSClient.TLSOptions.IOHandler := iohOpenSSL;   // or iohSChannel / iohAndroidTLS / iohAppleTLS
WSClient.TLSOptions.VerifyCertificate := True;
WSClient.TLSOptions.RootCertFile := '';
WSClient.TLSOptions.CertFile := '';
WSClient.TLSOptions.Password := '';
WSClient.TLSOptions.ALPNProtocols.Add('http/1.1');
WSClient.Active := True;
// Same TLSOptions, only the IOHandler line changes per platform.
WSClient->TLS = true;
WSClient->TLSOptions->IOHandler = iohOpenSSL;   // or iohSChannel / iohAndroidTLS / iohAppleTLS
WSClient->TLSOptions->VerifyCertificate = true;
WSClient->TLSOptions->RootCertFile = "";
WSClient->TLSOptions->CertFile = "";
WSClient->TLSOptions->Password = "";
WSClient->TLSOptions->ALPNProtocols->Add("http/1.1");
WSClient->Active = true;
Best value: All-AccessEvery eSeGeCe product, Premium Support included, from €1,059/year.
See All-Access pricing

Native TLS, Zero OpenSSL to Deploy

Download the free trial and switch TLS backends with a single line of code.

Download Free Trial View Pricing