2003 2009 Ericsson AB. All Rights Reserved.
The contents of this file are subject to the Erlang Public License, Version 1.1, (the "License"); you may not use this file except in compliance with the License. You should have received a copy of the Erlang Public License along with this software. If not, it can be retrieved online at http://www.erlang.org/. Software distributed under the License is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License for the specific language governing rights and limitations under the License.

Using the SSL API

using_ssl.xml

## General information

To see relevant version information for ssl you can call ssl:versions/0

To see all supported cipher suites call ssl:cipher_suites/0. Note that available cipher suites for a connection will depend on your certificate. It is also possible to specify a specific cipher suite(s) that you want your connection to use. Default is to use the strongest available.

## Setting up connections

Here follows some small example of how to set up client/server connections using the erlang shell. The returned value of the sslsocket has been abbreviated with [...] as it can be fairly large and is opaque.

### Minmal example

The minimal setup is not the most secure setup of ssl.

Start server side

`1 server> ssl:start(). ok`

Create a ssl listen socket

`2 server> {ok, ListenSocket} = ssl:listen(9999, [{certfile, "cert.pem"}, {keyfile, "key.pem"},{reuseaddr, true}]). {ok,{sslsocket, [...]}}`

Do a transport accept on the ssl listen socket

`3 server> {ok, Socket} = ssl:transport_accept(ListenSocket). {ok,{sslsocket, [...]}}`

Start client side

`1 client> ssl:start(). ok` `2 client> {ok, Socket} = ssl:connect("localhost", 9999, [], infinity). {ok,{sslsocket, [...]}}`

Do the ssl handshake

`4 server> ok = ssl:ssl_accept(Socket). ok`

Send a messag over ssl

`5 server> ssl:send(Socket, "foo"). ok`

Flush the shell message queue to see that we got the message sent on the server side

`3 client> flush(). Shell got {ssl,{sslsocket,[...]},"foo"} ok`

### Upgrade example

To upgrade a TCP/IP connection to a ssl connection the client and server have to aggre to do so. Agreement may be accompliced by using a protocol such the one used by HTTP specified in RFC 2817.

Start server side

`1 server> ssl:start(). ok`

Create a normal tcp listen socket

`2 server> {ok, ListenSocket} = gen_tcp:listen(9999, [{reuseaddr, true}]). {ok, #Port<0.475>}`

Accept client connection

`3 server> {ok, Socket} = gen_tcp:accept(ListenSocket). {ok, #Port<0.476>}`

Start client side

`1 client> ssl:start(). ok` `2 client> {ok, Socket} = gen_tcp:connect("localhost", 9999, [], infinity).`

Make sure active is set to false before trying to upgrade a connection to a ssl connection, otherwhise ssl handshake messages may be deliverd to the wrong process.

`4 server> inet:setopts(Socket, [{active, false}]). ok`

Do the ssl handshake.

`5 server> {ok, SSLSocket} = ssl:ssl_accept(Socket, [{cacertfile, "cacerts.pem"}, {certfile, "cert.pem"}, {keyfile, "key.pem"}]). {ok,{sslsocket,[...]}}`

Upgrade to a ssl connection. Note that the client and server must agree upon the upgrade and the server must call ssl:accept/2 before the client calls ssl:connect/3.

`3 client>{ok, SSLSocket} = ssl:connect(Socket, [{cacertfile, "cacerts.pem"}, {certfile, "cert.pem"}, {keyfile, "key.pem"}], infinity). {ok,{sslsocket,[...]}}`

Send a messag over ssl

`4 client> ssl:send(SSLSocket, "foo"). ok`

Set active true on the ssl socket

`4 server> ssl:setopts(SSLSocket, [{active, true}]). ok`

Flush the shell message queue to see that we got the message sent on the client side

`5 server> flush(). Shell got {ssl,{sslsocket,[...]},"foo"} ok`