Initialize an SSL configuration context Just makes the context ready for mbedtls_ssl_config_defaults() or mbedtls_ssl_config_free().
Load reasonnable default SSL configuration values. (You need to call mbedtls_ssl_config_init() first.)
Free an SSL configuration context
Set the data required to verify peer certificate
Set up an SSL context for use \warning The conf structure will be accessed during the session. It must not be modified or freed as long as the session is active. \warning This function must be called exactly once per context. Calling mbedtls_ssl_setup again is not supported, even if no session is active.
Set the random number generator callback
Set own certificate chain and private key
Set the certificate verification mode Default: NONE on server, REQUIRED on client MBEDTLS_SSL_VERIFY_NONE: peer certificate is not checked (default on server) (insecure on client) MBEDTLS_SSL_VERIFY_OPTIONAL: peer certificate is checked, however the handshake continues even if verification failed; mbedtls_ssl_get_verify_result() can be called after the handshake is complete. MBEDTLS_SSL_VERIFY_REQUIRED: peer *must* present a valid certificate, handshake is aborted if verification failed. (default on client)
Set the current endpoint type
Set the transport type (TLS or DTLS). Default: TLS
Set the timeout period for mbedtls_ssl_read() (Default: no timeout.)
Set the list of allowed ciphersuites and the preference order. First in the list has the highest preference. (Overrides all version-specific lists) The ciphersuites array is not copied, and must remain valid for the lifetime of the ssl_config. Note: The server uses its own preferences over the preference of the client unless MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE is defined!
Set the list of allowed ciphersuites and the preference order for a specific version of the protocol. (Only useful on the server side) The ciphersuites array is not copied, and must remain valid for the lifetime of the ssl_config.
Set the X.509 security profile used for verification
Set the allowed curves in order of preference. (Default: all defined curves.) On server: this only affects selection of the ECDHE curve; the curves used for ECDH and ECDSA are determined by the list of available certificates instead. On client: this affects the list of curves offered for any use. The server can override our preference order. Both sides: limits the set of curves accepted for use in ECDHE and in the peer's end-entity certificate.
Set the allowed hashes for signatures during the handshake. (Default: all available hashes except MD5.)
Set the maximum supported version sent from the client side and/or accepted at the server side (Default: MBEDTLS_SSL_MAX_MAJOR_VERSION, MBEDTLS_SSL_MAX_MINOR_VERSION)
Set the minimum accepted SSL/TLS protocol version (Default: TLS 1.0)
Whether to send a list of acceptable CAs in CertificateRequest messages. (Default: do send)
Prevent or allow legacy renegotiation. (Default: MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION) MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION allows connections to be established even if the peer does not support secure renegotiation, but does not allow renegotiation to take place if not secure. (Interoperable and secure option) MBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION allows renegotiations with non-upgraded peers. Allowing legacy renegotiation makes the connection vulnerable to specific man in the middle attacks. (See RFC 5746) (Most interoperable and least secure option) MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE breaks off connections if peer does not support secure renegotiation. Results in interoperability issues with non-upgraded peers that do not support renegotiation altogether. (Most secure option, interoperability issues)
Set the verification callback (Optional). If set, the verify callback is called for each certificate in the chain. For implementation information, please see \c mbedtls_x509_crt_verify()
Set the debug callback The callback has the following argument: void * opaque context for the callback int debug level const char * file name int line number const char * message