Set the transport type (TLS or DTLS). Default: TLS
Set the current endpoint type
Set the certificate verification mode Default: NONE on server, REQUIRED on client MBEDTLS_SSL_VERIFY_NONE: peer certificate is not checked (default on server) (insecure on client) MBEDTLS_SSL_VERIFY_OPTIONAL: peer certificate is checked, however the handshake continues even if verification failed; mbedtls_ssl_get_verify_result() can be called after the handshake is complete. MBEDTLS_SSL_VERIFY_REQUIRED: peer *must* present a valid certificate, handshake is aborted if verification failed. (default on client)
Set the verification callback (Optional). If set, the provided verify callback is called for each certificate in the peer's CRT chain, including the trusted root. For more information, please see the documentation of \c mbedtls_x509_crt_verify().
Set the random number generator callback
Set up an SSL context for use \warning The conf structure will be accessed during the session. It must not be modified or freed as long as the session is active. \warning This function must be called exactly once per context. Calling mbedtls_ssl_setup again is not supported, even if no session is active.
Set the list of allowed ciphersuites and the preference order. First in the list has the highest preference. (Overrides all version-specific lists) The ciphersuites array is not copied, and must remain valid for the lifetime of the ssl_config. Note: The server uses its own preferences over the preference of the client unless MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE is defined!
Set the list of allowed ciphersuites and the preference order for a specific version of the protocol. (Only useful on the server side) The ciphersuites array is not copied, and must remain valid for the lifetime of the ssl_config.
Set the X.509 security profile used for verification
Set the data required to verify peer certificate
Set the debug callback The callback has the following argument: void * opaque context for the callback int debug level const char * file name int line number const char * message
Set the timeout period for mbedtls_ssl_read() (Default: no timeout.)
Set server side ServerName TLS extension callback (optional, server-side only). If set, the ServerName callback is called whenever the server receives a ServerName TLS extension from the client during a handshake. The ServerName callback has the following parameters: (void *parameter, mbedtls_ssl_context *ssl, const unsigned char *hostname, size_t len). If a suitable certificate is found, the callback must set the certificate(s) and key(s) to use with \c mbedtls_ssl_set_hs_own_cert() (can be called repeatedly), and may optionally adjust the CA and associated CRL with \c mbedtls_ssl_set_hs_ca_chain() as well as the client authentication mode with \c mbedtls_ssl_set_hs_authmode(), then must return 0. If no matching name is found, the callback must either set a default cert, or return non-zero to abort the handshake at this point.
Set the maximum supported version sent from the client side and/or accepted at the server side (Default: MBEDTLS_SSL_MAX_MAJOR_VERSION, MBEDTLS_SSL_MAX_MINOR_VERSION)
Set the minimum accepted SSL/TLS protocol version (Default: TLS 1.0)
Whether to send a list of acceptable CAs in CertificateRequest messages. (Default: do send)
Set own certificate chain and private key
Set the allowed curves in order of preference. (Default: all defined curves in order of decreasing size, except that Montgomery curves come last. This order is likely to change in a future version.) On server: this only affects selection of the ECDHE curve; the curves used for ECDH and ECDSA are determined by the list of available certificates instead. On client: this affects the list of curves offered for any use. The server can override our preference order. Both sides: limits the set of curves accepted for use in ECDHE and in the peer's end-entity certificate.
Set the allowed hashes for signatures during the handshake. (Default: all SHA-2 hashes, largest first. Also SHA-1 if the compile-time option `MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE` is enabled.)
Initialize an SSL configuration context Just makes the context ready for mbedtls_ssl_config_defaults() or mbedtls_ssl_config_free().
Load reasonable default SSL configuration values. (You need to call mbedtls_ssl_config_init() first.)
Free an SSL configuration context
Prevent or allow legacy renegotiation. (Default: MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION) MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION allows connections to be established even if the peer does not support secure renegotiation, but does not allow renegotiation to take place if not secure. (Interoperable and secure option) MBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION allows renegotiations with non-upgraded peers. Allowing legacy renegotiation makes the connection vulnerable to specific man in the middle attacks. (See RFC 5746) (Most interoperable and least secure option) MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE breaks off connections if peer does not support secure renegotiation. Results in interoperability issues with non-upgraded peers that do not support renegotiation altogether. (Most secure option, interoperability issues)