ssl

v11.7.1

SSL Application

The ssl application provides secure communication over sockets.

Description

The ssl application is an implementation of the TLS (previously known as SSL) and DTLS protocols in Erlang.

For current statement of standards compliance see the User's Guide.

Dependencies

The SSL application uses the Public_Key, Asn1 and Crypto application to handle public keys and encryption, hence these applications must be loaded for the SSL application to work. In an embedded environment this means they must be started with application:start/1,2 before the SSL application is started.

Configuration

The application environment configuration parameters in this section are defined for the SSL application. For more information about configuration parameters, see the application manual page in Kernel.

Note

All parameters including the wording 'session_ticket' are TLS-1.3 only configuration and other session parameters are prior to TLS-1.3 only configuration. DTLS versions are based on TLS versions see standard compliance for mapping.

The environment parameters can be set on the command line, for example:

erl -ssl protocol_version "['tlsv1.2', 'tlsv1.1']"

protocol_version = ssl:tls_version/0 | [ssl:tls_version/0] <optional> - Protocol supported by started clients and servers. If this option is not set, it defaults to all TLS protocols currently supported, more might be configurable, by the SSL application. This option can be overridden by the version option to ssl:connect/2,3 and ssl:listen/2.

dtls_protocol_version = ssl:dtls_version/0 | [ssl:dtls_version/0] <optional> - Protocol supported by started clients and servers. If this option is not set, it defaults to all DTLS protocols currently supported, more might be configurable, by the SSL application. This option can be overridden by the version option to ssl:connect/2,3 and ssl:listen/2.

session_lifetime = integer() <optional> - Maximum lifetime of the session data in seconds. Defaults to 24 hours which is the maximum recommended lifetime by RFC 5246. However sessions may be invalidated earlier due to the maximum limitation of the session cache table.

session_cb = atom() <optional> - Deprecated Since OTP-23.3 replaced by client_session_cb and server_session_cb

client_session_cb = atom() <optional> - Since OTP-23.3 Name client of the session cache callback module that implements the ssl_session_cache_api behavior. Defaults to ssl_client_session_cache_db.

server_session_cb = atom() <optional> - Since OTP-23.3 Name of the server session cache callback module that implements the ssl_session_cache_api behavior. Defaults to ssl_server_session_cache_db.

session_cb_init_args = proplist:proplist() <optional> - Deprecated Since OTP-23.3 replaced by client_session_cb_init_args and server_session_cb_init_args

client_session_cb_init_args = proplist:proplist() <optional> - List of extra user-defined arguments to the init function in the session cache callback module. Defaults to [].

server_session_cb_init_args = proplist:proplist() <optional> - List of extra user-defined arguments to the init function in the session cache callback module. Defaults to [].

session_cache_client_max = integer() <optional>
Limits the growth of the clients session cache, that is how many sessions towards servers that are cached to be used by new client connections. If the maximum number of sessions is reached, the current cache entries will be invalidated regardless of their remaining lifetime. Defaults to 1000. Recommended ssl-8.2.1 or later for this option to work as intended.

session_cache_server_max = integer() <optional> - Limits the growth of the servers session cache, that is how many client sessions are cached by the server. If the maximum number of sessions is reached, the current cache entries will be invalidated regardless of their remaining lifetime. Defaults to 1000. Recommended ssl-8.2.1 or later for this option to work as intended.

ssl_pem_cache_clean = integer() <optional> - Number of milliseconds between PEM cache validations. Defaults to 2 minutes.

Note: The cache can be reloaded by calling ssl:clear_pem_cache/0.

bypass_pem_cache = boolean() <optional> - Introduced in ssl-8.0.2. Disables the PEM-cache. Can be used as a workaround for the PEM-cache bottleneck before ssl-8.1.1. Defaults to false.

alert_timeout = integer() <optional> - Number of milliseconds between sending of a fatal alert and closing the connection. Waiting a little while improves the peers chances to properly receiving the alert so it may shutdown gracefully. Defaults to 5000 milliseconds.

internal_active_n = integer() <optional> - For TLS connections this value is used to handle the internal socket. As the implementation was changed from an active once to an active N behavior (N = 100), for performance reasons, this option exist for possible tweaking or restoring of the old behavior (internal_active_n = 1) in unforeseen scenarios. The option will not affect erlang distribution over TLS that will always run in active N mode. Added in ssl-9.1 (OTP-21.2).

server_session_tickets_amount = integer() <optional> - Number of session tickets sent by the server. It must be greater than 0. Defaults to 3.

server_session_ticket_lifetime = integer() <optional> - Lifetime of session tickets sent by the server. Servers must not use any value greater than 604800 seconds (7 days). Expired tickets are automatically removed. Defaults to 7200 seconds (2 hours).

server_session_ticket_store_size = integer() <optional> - Sets the maximum size of the server session ticket store (stateful tickets). Defaults to 1000. Size limit is enforced by dropping old tickets.

server_session_ticket_max_early_data = integer() <optional> - Sets the maximum size of the early data that the server accepts and also configures its NewSessionTicket messages to include this same size limit in their early_data_indication extension. Defaults to 16384. Size limit is enforced by both client and server.

client_session_ticket_lifetime = integer() <optional> - Lifetime of session tickets in the client ticket store. Expired tickets are automatically removed. Defaults to 7200 seconds (2 hours).

client_session_ticket_store_size = integer() <optional> - Sets the maximum size of the client session ticket store. Defaults to 1000. Size limit is enforced by dropping old tickets.

Error Logger and Event Handlers

The SSL application uses OTP logger. TLS/DTLS alerts are logged on notice level. Unexpected errors are logged on error level. These log entries will by default end up in the default Erlang log. The option log_level may be used to in run-time to set the log level of a specific TLS connection, which is handy when you want to use level debug to inspect the TLS handshake setup.

See Also

application

SSL Release Notes

This document describes the changes made to the SSL application.

SSL 11.7.1

Fixed Bugs and Malfunctions

'public_key', Adhere to RFC 9525, and remove support for legacy fallback to check hostname against subject common name. Also improve error handling creating two separate errors for name constraint check for subject names and subject alternative names.

'ssl'. Error handling is slightly changed to better reflect public_key behaviour.

POTENTIAL INCOMPATIBILITY

Own Id: OTP-20130 Aux Id: CVE-2026-42790, PR-11124

Could cause server to terminate a connection without an alert towards a bad client.

Own Id: OTP-20141 Aux Id: PR-11125

SSL 11.7

Fixed Bugs and Malfunctions

Add missing clauses to ssl_handshake:extension_value/1. If an hello extension, missing a handling clause was present in a paused handshake, the handshake would fail.

Own Id: OTP-20116 Aux Id: GH-11030, PR-11062

Improvements and New Features

The legacy and and or operators have been replaced with other language constructs.

Own Id: OTP-19744 Aux Id: PR-10114, PR-10554, PR-10568, PR-10579, PR-10585, PR-10598, PR-10710, PR-10718, PR-10580, PR-10730

Added support for -unsafe attributes, which is used to mark functions as unsafe to use.

This is similar to but separate from deprecation, and the compiler will by default now generate warnings for calls to functions in Erlang/OTP that are known to be always unsafe.

Furthermore, xref can now be used to find calls to functions in another application that lack a -doc attribute (undocumented_function_calls), calls to functions in another application marked -doc false. (private_function_calls), as well as calls to unsafe functions (unsafe_function_calls).

Own Id: OTP-20066 Aux Id: PR-10839

The post-quantum hybrid algorithm x25519mlkem768 is now the most preferred key exchange group in the default configuration.

Post-quantum hybrid algorithms secp384r1mlkem1024 and secp256r1mlkem768 are supported but have to be configured. The same goes for the plain post-quantum algorithms mlkem1024, mlkem768, and mlkem512.

The most preferred signature algorithms is now post-quantum algorithms ML-DSA followed by the fastest SLH-DSA (slh_dsa_sha2_256f) algorithm, if such a certificate is available in the configuration. Other SLH-DSA variants are also supported but are added to the end of the preferred list.

All these algorithms were available in OTP-28.4 but none of them were preferred and some of them changed default status.

POTENTIAL INCOMPATIBILITY

Own Id: OTP-20070 Aux Id: PR-10949

Secure renegotiation for TLS-1.2 specified in RFC 5746 from 2010 is now always used. The interoperability fallback option {secure_renegotiate,SecureRenegotiate} is no longer needed.

POTENTIAL INCOMPATIBILITY

Own Id: OTP-20080 Aux Id: PR-10979

There is a new Hardening guide giving guidelines on how to strengthen the security for the ssl application.

Own Id: OTP-20087 Aux Id: PR-11019

SSL 11.6.0.1

Fixed Bugs and Malfunctions

Add missing clauses to ssl_handshake:extension_value/1. If an hello extension, missing a handling clause was present in a paused handshake, the handshake would fail.

Own Id: OTP-20116 Aux Id: GH-11030, PR-11062

'public_key', Adhere to RFC 9525, and remove support for legacy fallback to check hostname against subject common name. Also improve error handling creating two separate errors for name constraint check for subject names and subject alternative names.

'ssl'. Error handling is slightly changed to better reflect public_key behaviour.

POTENTIAL INCOMPATIBILITY

Own Id: OTP-20130 Aux Id: CVE-2026-42790, PR-11124

Could cause server to terminate a connection without an alert towards a bad client.

Own Id: OTP-20141 Aux Id: PR-11125

SSL 11.6

Fixed Bugs and Malfunctions

Preserve inet option order, as inet_backend option must be first option. Will make inet_backend option work for ssl independently of number of inet supplied options.

Own Id: OTP-19162 Aux Id: PR-10908

Missing conformance check for signature algorithms in TLS-1.3 could cause selection of incompatible certificate when a server is configured with more than one possible certificate.

Own Id: OTP-20082 Aux Id: PR-10924, GH-10915

Improvements and New Features

Avoid unnecessary memory consumption for temporary processes in a supervision tree.

Own Id: OTP-19967 Aux Id: PR-10957

SSL 11.5.4

Fixed Bugs and Malfunctions

Server supporting TLS-1.3 and TLS-1.2, with SLH-DSA algorithms for TLS-1.3, now correctly filter out those algorithms if client is TLS-1.2 only, instead of failing with internal error.

Own Id: OTP-20046 Aux Id: PR-10874, ERIERL-1311

When OCSP stapling is enabled via the {stapling, staple} or {stapling, #{...}} options, the handshake now fails if the server does not provide an OCSP stapled response.

Previously, a missing OCSP staple was silently accepted (soft-fail). Since Erlang/OTP only supports OCSP via stapling with no fallback to direct OCSP queries or CRL checking, soft-fail meant no revocation check at all.

Applications that need the previous soft-fail behavior can use a custom verify_fun that accepts {bad_cert, missing_ocsp_staple}.

POTENTIAL INCOMPATIBILITY

Own Id: OTP-20064 Aux Id: PR-10941, CVE-2026-32144

SSL 11.5.3

Fixed Bugs and Malfunctions

TLS-1.3 certificate request now preserves the order of signature algorithms in certificate request extension to be in the servers preferred order, which might affect the choice made by some TLS clients.

Own Id: OTP-20022 Aux Id: GH-10694, PR-10707, ERIERL-1305

Improvements and New Features

Document that setting transport protocol specific socket options is not generally expected to work for TLS and if it happens to work it comes with consequences that should be understood an accepted by the user. Also retain some backwards compatibility with such an option that happened to work to buy time for people to come up with better solutions.

Own Id: OTP-20018 Aux Id: PR-10809, ERIERL-1303

SSL 11.5.2

Fixed Bugs and Malfunctions

TLS servers that have early_data disabled will no longer include the early_data extension in its session tickets.

Own Id: OTP-19940 Aux Id: PR-10583, GH-10567

ssl:connection_information/2 will now return correct information for TLS-1.2 session resumption.

Own Id: OTP-19941 Aux Id: PR-10586, GH-10470

When performing renegotiation, in TLS-1.2 or earlier, `max_frag_length` will no longer be renegotiated. Instead, the connection will adhere to its originally negotiated value, and if a value was not negotiated it will not be negotiated.

Own Id: OTP-19948 Aux Id: PR-10599

The NSS Keylogging refactoring mixed up of Read and Write connection states, could cause wrong NSS keylog labels, or {error, closed} returned without keylog.

Own Id: OTP-19990 Aux Id: PR-10723, GH-10698

Improvements and New Features

Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

make release_docs places the documentation in the released code under the doc folder.

make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, enteringtest_server` and running the emulator.

Improves the source Software-Bill-of-Materials

The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.

The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.

All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

Own Id: OTP-19886 Aux Id: PR-10434

SSL 11.5.1

Fixed Bugs and Malfunctions

Correct TLS-1.3 alert handling so server will always send the alert with the encryption keys that the client is expecting, that is if for instance if client certification fails the alert will be sent using application traffic encryption keys.

Own Id: OTP-19795 Aux Id: PR-10465

Correct TLS-1.3 session tickets documentation.

Own Id: OTP-19891 Aux Id: PR-10481

Corrected app environment handling for session callback that was broken In OTP-23.

Own Id: OTP-19893 Aux Id: PR-10480

SSL 11.5

Fixed Bugs and Malfunctions

Setting the internal process links between TLS distribution processes has been reviewed. In the TLS distribution test framework there were issues fixed, but probably not in the TLS distribution module.

Own Id: OTP-19805 Aux Id: PR-10232

Correct documentation for fail_if_no_peer_cert option.

Own Id: OTP-19828 Aux Id: PR-10333

Improvements and New Features

Add support for MLKEM hybrid algorithms x25519mlkem768, secp384r1mlkem1024, secp256r1mlkem768 in TLS-1.3

Own Id: OTP-19767 Aux Id: PR-10262

Property based test needed to compare raw handshakes, that is some utility decoding needs to be converted back.

Own Id: OTP-19829 Aux Id: PR-10335

Add support in public_key and ssl for post quantum algorithm SLH-DSA.

Own Id: OTP-19867 Aux Id: PR-10398

SSL 11.4.2

Fixed Bugs and Malfunctions

Graceful error handling added in negative test scenario.

Own Id: OTP-19813 Aux Id: PR-10284

Handle duplicate change_cipher_spec message with an unexpected message alert instead of failing later in corrupted state.

Own Id: OTP-19818 Aux Id: PR-10296

Make sure TLS-1.3 protocol spec is followed, that is psk-hello extension is guaranteed to be included as the last extension in the list of client hello extensions and internal hello message truncation in handshake history is handled correctly, the previous handling could cause interoperability issues.

Own Id: OTP-19825 Aux Id: PR-10296

If two certificate massages are sent to the server generate an unexpected message alert for the second one.

Own Id: OTP-19830 Aux Id: PR-10339

SSL 11.4.1

Fixed Bugs and Malfunctions

Fixed so that sending of application data will adhere to max_fragment_length. This was broken in OTP-27 release by an optimization.

Own Id: OTP-19774 Aux Id: GH-10191, PR-10201

PR-10046 put to hard requirements on key file content. Make sure same file can be used as keyfile and certfile

Own Id: OTP-19780 Aux Id: GH-10217, GH-10212, PR-10221

Assert that hello extensions are unique and send an illegal parameter alert if they are not.

Own Id: OTP-19791 Aux Id: PR-10245

Avoid sending an internal message to the user process in conjunction with handling a key update.

Own Id: OTP-19806 Aux Id: PR-10274

SSL 11.4

Fixed Bugs and Malfunctions

The sender side is now closed if an error occurs on the socket.

Own Id: OTP-19694 Aux Id: PR-10011

The PEM cache process no longer crashes when a configured file has been deleted before it could be read.

Own Id: OTP-19698 Aux Id: GH-9638, PR-10019

Corrected handling of ssl:sockname/1 for DTLS, so that it now will return the correct result in all situations.

Own Id: OTP-19736 Aux Id: PR-10108, GH-10097

Rendering of some tables in the documentation has been improved.

Own Id: OTP-19752 Aux Id: PR-10142

Improvements and New Features

Added support for quantum crypto signature algorithm ML-DSA (ssl and public_key) and key exchange algorithm ML-KEM (ssl).

Own Id: OTP-19552 Aux Id: PR-10004

Now allowingsend/2to buffer data when using sockets backend. Use 'high_watermark' and 'low_watermark' to steer buffering as gen_tcp does.

Own Id: OTP-19651 Aux Id: PR-9879

Now allowing the PSK identity to be the empty string in TLS-1.2 for compatibility reasons. It is allowed according to the spec, although providing a proper value makes more sense.

Own Id: OTP-19688 Aux Id: PR-9843

TLS server now fails early for supplied PEM file issues, such as the file not being found.

Own Id: OTP-19706 Aux Id: PR-10046, GH-9631

SSL 11.3.2

Fixed Bugs and Malfunctions

Improve error message for bad arguments to underlying connect.

Own Id: OTP-19697 Aux Id: GH-10007, PR-10016

SSL 11.3.1

Fixed Bugs and Malfunctions

hs_keylog callback properly handle alert in initial states, where encryption is not yet used. Also add keylog callback invocation for corner-case where server alert is encrypted with application secrets as client is already in connection state.

Own Id: OTP-19635 Aux Id: ERIERL-1235, PR-9849

Improvements and New Features

The documentation for SSL option verify_fun has been improved.

Own Id: OTP-19676 Aux Id: PR-9691

SSL 11.3

Improvements and New Features

Refactoring, minor optimizations and improved log printouts.

Own Id: OTP-19367 Aux Id: PR-9019

supervisor:which_child/2 is now used to make start-up code for TLS-connections simpler and more straight forward, and to increase stability and maintainability of the ssl application.

Own Id: OTP-19406 Aux Id: PR-9231

The data handling for tls-v1.3 has been optimized.

Own Id: OTP-19430 Aux Id: PR-9305

Added experimental socket support.

Own Id: OTP-19463 Aux Id: PR-9398

Improve code health by removing dead code.

Own Id: OTP-19531 Aux Id: PR-9563

A test module for TLS distribution over socket has been implemented.

Own Id: OTP-19539 Aux Id: PR-9511

The license and copyright header has changed format to include an SPDX-License-Identifier. At the same time, most files have been updated to follow a uniform standard for license headers.

Own Id: OTP-19575 Aux Id: PR-9670

SSL 11.2.12.8

Fixed Bugs and Malfunctions

'public_key', Adhere to RFC 9525, and remove support for legacy fallback to check hostname against subject common name. Also improve error handling creating two separate errors for name constraint check for subject names and subject alternative names.

'ssl'. Error handling is slightly changed to better reflect public_key behaviour.

POTENTIAL INCOMPATIBILITY

Own Id: OTP-20130 Aux Id: CVE-2026-42790, PR-11124

Could cause server to terminate a connection without an alert towards a bad client.

Own Id: OTP-20141 Aux Id: PR-11125

SSL 11.2.12.7

Fixed Bugs and Malfunctions

When OCSP stapling is enabled via the {stapling, staple} or {stapling, #{...}} options, the handshake now fails if the server does not provide an OCSP stapled response.

Previously, a missing OCSP staple was silently accepted (soft-fail). Since Erlang/OTP only supports OCSP via stapling with no fallback to direct OCSP queries or CRL checking, soft-fail meant no revocation check at all.

Applications that need the previous soft-fail behavior can use a custom verify_fun that accepts {bad_cert, missing_ocsp_staple}.

POTENTIAL INCOMPATIBILITY

Own Id: OTP-20064 Aux Id: PR-10941, CVE-2026-32144

SSL 11.2.12.6

Fixed Bugs and Malfunctions

The NSS Keylogging refactoring mixed up of Read and Write connection states, could cause wrong NSS keylog labels, or {error, closed} returned without keylog.

Own Id: OTP-19990 Aux Id: PR-10723, GH-10698

TLS-1.3 certificate request now preserves the order of signature algorithms in certificate request extension to be in the servers preferred order, which might affect the choice made by some TLS clients.

Own Id: OTP-20022 Aux Id: GH-10694, PR-10707, ERIERL-1305

SSL 11.2.12.5

Fixed Bugs and Malfunctions

Correct TLS-1.3 alert handling so server will always send the alert with the encryption keys that the client is expecting, that is if for instance if client certification fails the alert will be sent using application traffic encryption keys.

Own Id: OTP-19795 Aux Id: PR-10465

If two certificate massages are sent to the server generate an unexpected message alert for the second one.

Own Id: OTP-19830 Aux Id: PR-10339

Corrected app environment handling for session callback that was broken In OTP-23.

Own Id: OTP-19893 Aux Id: PR-10480

When preforming renegotiation, in TLS-1.2 or previous TLS versions, max_frag_length should not be renegotiated the connection should adhere to originally negotiated value, and if a value was not negotiated it shall not be negotiated now either.

Own Id: OTP-19948 Aux Id: PR-10599

SSL 11.2.12.4

Fixed Bugs and Malfunctions

Correct documentation for fail_if_no_peer_cert option.

Own Id: OTP-19828 Aux Id: PR-10333

SSL 11.2.12.3

Fixed Bugs and Malfunctions

Fixed so that sending of application data will adhere to max_fragment_length. This was broken in OTP-27 release by an optimization.

Own Id: OTP-19774 Aux Id: GH-10191, PR-10201

Assert that hello extensions are unique and send an illegal parameter alert if they are not.

Own Id: OTP-19791 Aux Id: PR-10245

Avoid sending an internal message to the user process in conjunction with handling a key update.

Own Id: OTP-19806 Aux Id: PR-10274

Graceful error handling added in negative test scenario.

Own Id: OTP-19813 Aux Id: PR-10284

Handle duplicate change_cipher_spec message with an unexpected message alert instead of failing later in corrupted state.

Own Id: OTP-19818 Aux Id: PR-10296

Make sure TLS-1.3 protocol spec is followed, that is psk-hello extension is guaranteed to be included as the last extension in the list of client hello extensions and internal hello message truncation in handshake history is handled correctly, the previous handling could cause interoperability issues.

Own Id: OTP-19825 Aux Id: PR-10296

SSL 11.2.12.2

Fixed Bugs and Malfunctions

Improve error message for bad arguments to underlying connect.

Own Id: OTP-19697 Aux Id: GH-10007, PR-10016

Improvements and New Features

Allow the PSK identity to be the empty string in TLS-1.2 for compatibility reasons. It is allowed according to the spec although providing a proper value makes more sense.

Own Id: OTP-19688 Aux Id: PR-9843

SSL 11.2.12.1

Fixed Bugs and Malfunctions

hs_keylog callback properly handle alert in initial states, where encryption is not yet used. Also add keylog callback invocation for corner-case where server alert is encrypted with application secrets as client is already in connection state.

Own Id: OTP-19635 Aux Id: ERIERL-1235, PR-9849

Improvements and New Features

The documentation for SSL option verify_fun has been improved.

Own Id: OTP-19676 Aux Id: PR-9691

SSL 11.2.12

Improvements and New Features

Lower log level for user cancelation as this is not an error case. Also handle possible undecrypted close alert during TLS-1.3 handshake.

Own Id: OTP-19592 Aux Id: PR-9566

SSL 11.2.11

Fixed Bugs and Malfunctions

Correct the debug functionality for NSS keylogging for TLS-1.3 introduced in OTP-27.3.1 so that TLS-1.3 key updates items always get correct counter value and each item is logged as one single line.

Own Id: OTP-19569 Aux Id: PR-9661

SSL 11.2.10

Fixed Bugs and Malfunctions

Correct handling of unassigned signature algorithms to properly ignore them instead of failing the handshake.

Own Id: OTP-19529 Aux Id: GH-9483, PR-9486

Update key mechanism in CRL cache so that CRL DP with same URI path component becomes distinguishable from each other.

Own Id: OTP-19549 Aux Id: GH-8891, PR-9612

Improvements and New Features

Add callback for NSS keylogging so that it can work as expected for all scenarios.

Own Id: OTP-19391 Aux Id: PR-9221

SSL 11.2.9

Fixed Bugs and Malfunctions

The function for selecting the best server certificate and key pair has been enhanced when several options are available to ensure that the fallback will not always be chosen.

Own Id: OTP-19423 Aux Id: PR-9185

Avoided duplicating a few algorithms in default values caused by an interoperability workaround not needed in this case.

Own Id: OTP-19428 Aux Id: PR-9288

Fixed two alert bugs, which could result in a crash instead of an alert.

Own Id: OTP-19433 Aux Id: PR-9308

SSL 11.2.8

Fixed Bugs and Malfunctions

Setting protocol version to a lower value then supported by default in server API function called after ssl:listen/2 could result in wrong default values being used and connections failing with insufficient security.

Own Id: OTP-19457 Aux Id: PR-9418

Improve error handling of server name indication fun. This implies that if the sni_fun returns undefined we will attempt connection with original option values, if it returns unrecognized we end the connection with UNRECOGNIZED_NAME alert and if provided options fail option verification we will end the connection with a HANDSHAKE_FAILURE and an error log.

Own Id: OTP-19467 Aux Id: PR-9387, ERIERL-1189

SSL 11.2.7

Fixed Bugs and Malfunctions

An initiated handshake should always be closed with an alert, some corner cases have been fixed so that this should always be the case.

Own Id: OTP-19411 Aux Id: PR-9273, ERIERL-1174

Correct option handling to work properly for paused handshaking. Could result in unwanted alerts or or error messages.

Own Id: OTP-19445 Aux Id: GH-9177, PR-9322

SSL 11.2.6

Improvements and New Features

Enhanced return value spec for active messages from the TLS connection socket.

Own Id: OTP-19387 Aux Id: PR-9067

SSL 11.2.5

Fixed Bugs and Malfunctions

Avoid generating an internal alert for case that should have been an orderly shutdown by the supervisor.

Own Id: OTP-19311 Aux Id: PR-8980

If present, extended key-usage TLS (SSL) role check (pk-clientAuth, pk-serverAuth) should always be performed for peer-cert. An intermediate CA cert may relax the requirement if AnyExtendedKeyUsage purpose is present.

In OTP-25.3.2.8, OTP-26.2 and OTP-27.0 these requirements became too relaxed. There where two problems, firstly the peer cert extension was only checked if it was marked critical, and secondly the CA cert check did not assert the relaxed AnyExtendedKeyUsage purpose.

This could result in that certificates might be misused for purposes not intended by the certificate authority.

Thanks to Bryan Paxton for reporting the issue.

Own Id: OTP-19352 Aux Id: PR-9130, CVE-2024-53846, OTP-19240

Improvements and New Features

Back port certificate_authorities option for TLS-1.3 servers to pre TLS-1.3 servers to enable them to disable the sending of certificate authorities in their certificate request. This will have same affect as the the TLS-1.3 server option although it is handled by a different mechanism in these versions, where the functionality is described to be more of a guidance, although some pre TLS clients have proven to make it mandatory as in TLS-1.3 extension handling.

Own Id: OTP-19325 Aux Id: PR-9001, ERIERL-1147

SSL 11.2.4

Fixed Bugs and Malfunctions

Refactor trying to also make some optimizations introduced a bug in signature algorithms checks in OTP-26.2.1. This could manifest itself in not being able to negotiate connections using certificates needing to use some TLS-1.2 compatibility legacy signature schemes.

Own Id: OTP-19249 Aux Id: ERIERL-1137, PR-8866

Correct timeout handling for termination code run for own alerts, so that intended timeout is used instead of falling back to OS TCP-stack timeout that is unreasonably long on some platforms.

Own Id: OTP-19274 Aux Id: PR-8901

Fix assertion so that works as intended. This could result in that some TLS-1.2 clients would fail to connect to the the erlang server. Bug introduced in OTP-27.1.1

Own Id: OTP-19288 Aux Id: GH-8908, PR-8916

SSL 11.2.3

Fixed Bugs and Malfunctions

Starting from TLS-1.3 some server handshake alerts might arrive after ssl:connection/2,3,4 has returned. If the socket is in active mode the controlling process will get the alert message, but passive sockets would only get {error, closed} on next call to ssl:recv/2,3 or ssl/setopts/2. Passive sockets calls will now return {error, error_alert()} instead.

Own Id: OTP-19236 Aux Id: PR-8261

Servers configured to support only version (pre TLS-1.2) should ignore hello version extension, as it is an unknown extension to them, this will result in that new clients that do not support the old server version will get an insufficient security alert from the server and not a protocol version alert, this is consistent with how old servers not able to support higher protocol versions work.

Own Id: OTP-19257

SSL 11.2.2

Fixed Bugs and Malfunctions

A race in the kTLS flavour of SSL distribution has been fixed so that inet_drv.c doesn't read ahead too much data, which could cause the kTLS encryption to be activated too late when some encrypted data had already been read into the inet_drv.c buffer as unencrypted.

Own Id: OTP-19175 Aux Id: GH-8561, PR-8690

Improvements and New Features

All TLS-1.3 terminations are now graceful (previous TLS version terminations already were).

Own Id: OTP-17848

It is now possible to use a verification fun of arity 4, giving the user fun access to both encoded and decoded versions of the certificate. This is desirable as a workaround for encoding errors preventing re-encoding from being reliable. This also saves some work load if the encoded version is needed.

Note that calling public_key:pkix_path_validation/3 with only decoded certs is not recommended, due to the decoding workarounds, although it will work as long as the workarounds are not needed.

If the decoded version is needed before thecall to public_key it is recommend to use the combined_cert- type to avoid double decoding. Note that the path validation algorithm itself always needs both the encoded and decoded versions of the certs.

The ssl implementation will now benefit from using this function instead of emulating the verify_fun/4.

Own Id: OTP-19169

Compiler warnings for some removed functions have been corrected to point out the correct replacement functions.

Own Id: OTP-19186 Aux Id: PR-8709

Include more information in logging of SNI (Server Name Indication) mismatch error.

Own Id: OTP-19187

SSL 11.2.1

Fixed Bugs and Malfunctions

Check for TLS-1.3 support should check minimum requirements.

Own Id: OTP-19094 Aux Id: GH-8489

If both TLS-1.3 and TLS-1.2 is supported and TLS-1.2 negotiated convert TLS-1.3 ECDSA schemes to TLS-1.2 hash and signature pairs for increased interoperability.

Own Id: OTP-19107 Aux Id: GH-8376

TLS-1.3 negotiation now uses SNI based options correctly instead of ignoring them.

Own Id: OTP-19140

Improvements and New Features

Make it easier to distinguish between a invalid signature and unsupported signature.

Own Id: OTP-19091

Enhance ALERT logs to help understand what causes the alert.

Own Id: OTP-19092 Aux Id: GH-8482

When the default value for signature_algs is used, default the signature_algs_cert to the default value + rsa_pkcs1_sha1 to allow this algorithms for certificates but not for the TLS protocol. This is for better interoperability. If signature_algs is set explicitly signature_algs_cert must also be set explicitly if they should be different.

Own Id: OTP-19152 Aux Id: GH-8588

SSL 11.2

Fixed Bugs and Malfunctions

Starting a TLS server without sufficient credentials (certificate or anonymous cipher) would work, but it was impossible to connect to it.

This has been corrected to return an error instead of starting the server.

Own Id: OTP-18887 Aux Id: GH-7493, PR-7918

ASN.1 decoding errors are handled in more places to ensure that errors are returned instead of cause a crash.

Own Id: OTP-18969 Aux Id: GH-8058, PR-8256

Improved error checking on the API functions.

Own Id: OTP-18992 Aux Id: GH-8066, PR-8156

Improvements and New Features

The ssl client can negotiate and handle certificate status request (OCSP stapling support on the client side).

Thanks to voltone for interop testing and related discussions.

Own Id: OTP-18606 Aux Id: OTP-16875,OTP-16448

Memory consumption has been reduced and performance increased by refactoring internal data structures and their usage.

Own Id: OTP-18665 Aux Id: PR-7447

Added ssl_crl_cache_api:lookup/2 as an optional -callback attribute.

Own Id: OTP-18788 Aux Id: PR-7700

Key customization support has been extended to allow flexibility for implementers of for instance hardware security modules (HSM) or trusted platform modules (TPM).

Own Id: OTP-18876 Aux Id: PR-7898, PR-7475

The proc_lib:set_label/1 function is now used to increase observability of ssl processes.

Own Id: OTP-18879

Brainpool elliptic curves are now supported in TLS-1.3.

Own Id: OTP-18884 Aux Id: PR-8056

The documentation has been migrated to use Markdown and ExDoc.

Own Id: OTP-18955 Aux Id: PR-8026

For security reasons, the CBC ciphers are now longer included in the list of default ciphers for TLS-1.2.

POTENTIAL INCOMPATIBILITY

Own Id: OTP-19025 Aux Id: PR-8250

There is a new cert_policy_opts option to configure certificate policy options for the certificate path validation.

Own Id: OTP-19027 Aux Id: PR-8255

SSL 11.1.4.13

Fixed Bugs and Malfunctions

'public_key', Adhere to RFC 9525, and remove support for legacy fallback to check hostname against subject common name. Also improve error handling creating two separate errors for name constraint check for subject names and subject alternative names.

'ssl'. Error handling is slightly changed to better reflect public_key behaviour.

* POTENTIAL INCOMPATIBILITY *

Own Id: OTP-20130 Aux Id: CVE-2026-42790, PR-11124

SSL 11.1.4.12

Fixed Bugs and Malfunctions

Correct TLS-1.3 alert handling so server will always send the alert with the encryption keys that the client is expecting, that is if for instance if client certification fails the alert will be sent using application traffic encryption keys.

Own Id: OTP-19795 Aux Id: PR-10465

TLS-1.3 certificate request now preserves the order of signature algorithms in certificate request extension to be in the servers preferred order, which might affect the choice made by some TLS clients.

Own Id: OTP-20022 Aux Id: GH-10694, PR-10707, ERIERL-1305

SSL 11.1.4.11

Fixed Bugs and Malfunctions

If two certificate massages are sent to the server generate an unexpected message alert for the second one.

Own Id: OTP-19830 Aux Id: PR-10339

SSL 11.1.4.10

Fixed Bugs and Malfunctions

Assert that hello extensions are unique and send an illegal parameter alert if they are not.

Own Id: OTP-19791 Aux Id: PR-10245

Avoid sending an internal message to the user process in conjunction with handling a key update.

Own Id: OTP-19806 Aux Id: PR-10274

Make sure TLS-1.3 protocol spec is followed, that is psk-hello extension is guaranteed to be included as the last extension in the list of client hello extensions and internal hello message truncation in handshake history is handled correctly, the previous handling could cause interoperability issues.

Own Id: OTP-19825 Aux Id: PR-10296

Correct documentation for fail_if_no_peer_cert option.

Own Id: OTP-19828 Aux Id: PR-10333

SSL 11.1.4.9

Fixed Bugs and Malfunctions

Improve error message for bad arguments to underlying connect.

Own Id: OTP-19697 Aux Id: GH-10007, PR-10016

SSL 11.1.4.8

Fixed Bugs and Malfunctions

Correct handling of unassigned signature algorithms to properly ignore them instead of failing the handshake.

Own Id: OTP-19529 Aux Id: GH-9483, PR-9486

SSL 11.1.4.7

Fixed Bugs and Malfunctions

An initiated handshake should always be closed with an alert, some corner cases have been fixed so that this should always be the case.

Own Id: OTP-19411 Aux Id: PR-9273, ERIERL-1174

Correct option handling to work properly for paused handshaking. Could result in unwanted alerts or or error messages.

Own Id: OTP-19445 Aux Id: GH-9177, PR-9322

SSL 11.1.4.6

Fixed Bugs and Malfunctions

If present, extended key-usage TLS (SSL) role check (pk-clientAuth, pk-serverAuth) should always be performed for peer-cert. An intermediate CA cert may relax the requirement if AnyExtendedKeyUsage purpose is present.

In OTP-25.3.2.8, OTP-26.2 and OTP-27.0 these requirements became too relaxed. There where two problems, firstly the peer cert extension was only checked if it was marked critical, and secondly the CA cert check did not assert the relaxed AnyExtendedKeyUsage purpose.

This could result in that certificates might be misused for purposes not intended by the certificate authority.

Thanks to Bryan Paxton for reporting the issue.

Own Id: OTP-19352 Aux Id: PR-9130, CVE-2024-53846, OTP-19240

SSL 11.1.4.5

Fixed Bugs and Malfunctions

Avoid generating an internal alert for case that should have been an orderly shutdown by the supervisor.

Own Id: OTP-19311 Aux Id: PR-8980

Improvements and New Features

Back port certificate_authorities option for TLS-1.3 servers to pre TLS-1.3 servers to enable them to disable the sending of certificate authorities in their certificate request. This will have same affect as the the TLS-1.3 server option although it is handled by a different mechanism in these versions, where the functionality is described to be more of a guidance, although some pre TLS clients have proven to make it mandatory as in TLS-1.3 extension handling.

Own Id: OTP-19325 Aux Id: PR-9001, ERIERL-1147

SSL 11.1.4.4

Fixed Bugs and Malfunctions

Starting from TLS-1.3 some server handshake alerts might arrive after ssl:connection/2,3,4 has returned. If the socket is in active mode the controlling process will get the alert message, but passive sockets would only get {error, closed} on next call to ssl:recv/2,3 or ssl/setopts/2. Passive sockets calls will now return {error, error_alert()} instead.

Own Id: OTP-19236 Aux Id: PR-8261

Refactor trying to also make some optimizations introduced a bug in signature algorithms checks in OTP-26.2.1. This could manifest itself in not being able to negotiate connections using certificates needing to use some TLS-1.2 compatibility legacy signature schemes.

Own Id: OTP-19249 Aux Id: ERIERL-1137, PR-8866

Servers configured to support only version (pre TLS-1.2) should ignore hello version extension, as it is an unknown extension to them, this will result in that new clients that do not support the old server version will get an insufficient security alert from the server and not a protocol version alert, this is consistent with how old servers not able to support higher protocol versions work.

Own Id: OTP-19257 Aux Id: ERIERL-1131

Correct timeout handling for termination code run for own alerts, so that intended timeout is used instead of falling back to OS TCP-stack timeout that is unreasonably long on some platforms.

Own Id: OTP-19274 Aux Id: PR-8901

SSL 11.1.4.3

Fixed Bugs and Malfunctions

A race in the kTLS flavour of SSL distribution has been fixed so inet_drv.c doesn't read ahead too much data which could cause the kTLS encryption to be activated too late when some encrypted data had already been read into the inet_drv.c buffer as unencrypted.

Own Id: OTP-19175 Aux Id: GH-8561, PR-8690

Improvements and New Features

Make sure all TLS-1.3 terminations are graceful (previous TLS version terminations already are).

Own Id: OTP-17848

Include more information in logging of SNI (Server Name Indication) mismatch error.

Own Id: OTP-19187

SSL 11.1.4.2

Improvements and New Features

When the default value for signature_algs is used, default the signature_algs_cert to the default value + rsa_pkcs1_sha1 to allow this algorithms for certificates but not for the TLS protocol. This is for better interoperability. If signature_algs is set explicitly signature_algs_cert must also be set explicitly if they should be different.

Own Id: OTP-19152 Aux Id: GH-8588

SSL 11.1.4.1

Fixed Bugs and Malfunctions

Check for TLS-1.3 support should check minimum requirements.

Own Id: OTP-19094 Aux Id: GH-8489

If both TLS-1.3 and TLS-1.2 is supported and TLS-1.2 negotiated convert TLS-1.3 ECDSA schemes to TLS-1.2 hash and signature pairs for increased interoperability.

Own Id: OTP-19107 Aux Id: GH-8376

TLS-1.3 negotiation now uses SNI based options correctly instead of ignoring them.

Own Id: OTP-19140

Improvements and New Features

Make it easier to distinguish between a invalid signature and unsupported signature.

Own Id: OTP-19091

Enhance ALERT logs to help understand what causes the alert.

Own Id: OTP-19092 Aux Id: GH-8482

SSL 11.1.4

Fixed Bugs and Malfunctions

Fix certificate authorities check so that CA closest to peer is not lost. It could manifest itself in a failed connection as the client failed to realize it had a valid certificate chain to send to the server.

Own Id: OTP-19065 Aux Id: GH-8356, PR-8367

ssl:signature_algs/2 did not list some legacy algorithm schemes correctly when listing all algorithms available.

Own Id: OTP-19067 Aux Id: PR-8379

SSL 11.1.3

Fixed Bugs and Malfunctions

Cleanup and close all connections in DTLS when the listen socket owner dies.

Improved IPv6 handling in DTLS.

Own Id: OTP-19037 Aux Id: GH-7951 GH-7955

Fixed a crash in dtls accept.

Own Id: OTP-19059 Aux Id: GH-8338

SSL 11.1.2

Fixed Bugs and Malfunctions

ssl:prf/5, will start working instead of hanging in a TLS-1.3 context if called appropriately. Note that the implementation has changed and in OTP-27 a more adequate API will be documented.

Own Id: OTP-18890 Aux Id: GH-7911

Server name verification didn't work if a connection was made with IP-address as a string.

Own Id: OTP-18909 Aux Id: GH-7968

The fallback after "dh" ssl option was undefined was to get "dh" from ssl options again. This is clearly wrong and now changed to the documented fallback "dhfile" ssl option.

Own Id: OTP-18919 Aux Id: PR-7984

Correct default value selection for DTLS. Will only affect users linked with really old version of cryptolib library.

Own Id: OTP-18962 Aux Id: GH-8079

Adhere elliptic curves with RFC 8422 pre TLS-1.3, that is Edwards curves are added to curves that can be used for key exchange, and documentation and implementation of eccs/0,1 are aligned.

Own Id: OTP-18991

Improvements and New Features

Improve alert reason when ecdhe_rsa key_exchange does not have any common curves to use

Own Id: OTP-18985

SSL 11.1.1

Fixed Bugs and Malfunctions

Legacy name handling could cause interop problems between TLS-1.3/1.2 client and TLS-1.2 server.

Own Id: OTP-18917 Aux Id: GH-7978

SSL 11.1

Fixed Bugs and Malfunctions

ssl application will validate id-kp-serverAuth and id-kp-clientAuth extended key usage only in end entity certificates. public_key application will disallow "anyExtendedKeyUsage" for CA certificates that includes the extended key usage extension and marks it critical.

Own Id: OTP-18739

Replaced unintentional Erlang Public License 1.1 headers in some files with the intended Apache License 2.0 header.

Own Id: OTP-18815 Aux Id: PR-7780

Correct handling of TLS-1.3 legacy scheme names, could cause interop failures for TLS-1.2 clients.

Own Id: OTP-18817

Add missing export for connection_info() API type.

Own Id: OTP-18886

Improvements and New Features

Fixed server name indication which was not handled properly.

Own Id: OTP-18836 Aux Id: GH-7795

Align documentation and implementation

Own Id: OTP-18853 Aux Id: PR-7841

Improve connection setup by optimizing certificate lookup.

Own Id: OTP-18893 Aux Id: PR-7920 PR-7921

SSL 11.0.3

Fixed Bugs and Malfunctions

Avoid function clause error in ssl:getopts/2 by handling that inet:getopts may return an empty list during some circumstances, such as the socket being in a closing state.

Own Id: OTP-18697 Aux Id: GH-7506

The API function `ssl:recv/3` has been tightened to disallow negative length, which has never been documented to work, but was passed through and caused strange errors.

Own Id: OTP-18700 Aux Id: GH-7507

When a client initiated renegotiation was rejected and the client socket was in active mode the expected error message to the controlling process was not sent.

Own Id: OTP-18712 Aux Id: GH-7431

Improvements and New Features

Add some guidance for signature algorithms configuration in ssl applications users guide.

Own Id: OTP-18631

SSL 11.0.2

Fixed Bugs and Malfunctions

Added keylog information to all protocol versions in ssl:connection_information/2.

Own Id: OTP-18643 Aux Id: ERIERL-932

Improvements and New Features

Add RFC-6083 considerations for DTLS to enable gen_sctp based callback for the transport.

Own Id: OTP-18618 Aux Id: ERIERL-932

SSL 11.0.1

Fixed Bugs and Malfunctions

Make sure that selection of client certificates handle both TLS-1.3 and TLS-1.2 names correctly. Could cause valid client certificate to not be selected, and an empty client certificate message to be sent to server.

Own Id: OTP-18588 Aux Id: GH-7264, PR-7277

Improved ssl:format_error/1 to handle more error tuples.

Own Id: OTP-18596 Aux Id: GH-7247

Fixed hanging ssl:connect when ssl application is not started.

Own Id: OTP-18603 Aux Id: GH-7297

Correct handling of retransmission timers, current behavior could cause unwanted delays.

Own Id: OTP-18632 Aux Id: PR-7300, GH-7301

SSL 11.0

Improvements and New Features

Remove less that 256 bit ECC from default supported ECC pre TLS-1.3

* POTENTIAL INCOMPATIBILITY *

Own Id: OTP-14771

Improved error checking and handling of ssl options.

Own Id: OTP-15903

With this change, stateless tickets generated by server with anti_replay option enabled can be used for creating ClientHello throughout ticket lifetime. Without this change, usability was limited to WindowSize number of seconds configured for anti_replay option.

* POTENTIAL INCOMPATIBILITY *

Own Id: OTP-18168 Aux Id: PR-6019, GH-6014

Support for Kernel TLS (kTLS), has been added to the SSL application, for TLS distribution (-proto_dist inet_tls), the SSL option {ktls, true}. Using this for general SSL sockets is uncomfortable, undocumented and not recommended since it requires very platform dependent raw options.

This, for now, only works for some not too old Linux distributions. Roughly, a kernel 5.2.0 or later with support for UserLand Protocols and the kernel module tls is required.

Own Id: OTP-18235 Aux Id: PR-6104, PR-5840

With this change, TLS 1.3 server can be configured to include client certificate in session ticket.

Own Id: OTP-18253

With this change, it is possible to configure encryption seed to be used with TLS1.3 stateless tickets. This enables using tickets on different server instances.

Own Id: OTP-18254 Aux Id: PR-5982

Debugging enhancements.

Own Id: OTP-18312

With this change, maybe keyword atom is not used as function name in ssl code.

Own Id: OTP-18335

Replace size/1 with either tuple_size/1 or byte_size/1

The size/1 BIF is not optimized by the JIT, and its use can result in worse types for Dialyzer.

When one knows that the value being tested must be a tuple, tuple_size/1 should always be preferred.

When one knows that the value being tested must be a binary, byte_size/1 should be preferred. However, byte_size/1 also accepts a bitstring (rounding up size to a whole number of bytes), so one must make sure that the call to byte_size/ is preceded by a call to is_binary/1 to ensure that bitstrings are rejected. Note that the compiler removes redundant calls to is_binary/1, so if one is not sure whether previous code had made sure that the argument is a binary, it does not harm to add an is_binary/1 test immediately before the call to byte_size/1.

Own Id: OTP-18405 Aux Id: GH-6672,PR-6702,PR-6768,PR-6700,PR-6769,PR-6812,PR-6814

For security reasons remove support for SHA1 and DSA algorithms from default values.

* POTENTIAL INCOMPATIBILITY *

Own Id: OTP-18438 Aux Id: GH-6679

Mitigate memory usage from large certificate chains by lowering the maximum handshake size. This should not effect the common cases, if needed it can be configured to a higher value.

Own Id: OTP-18453

Change the client default verify option to verify_peer. Note that this makes it mandatory to also supply trusted CA certificates or explicitly set verify to verify_none. This also applies when using the so called anonymous test cipher suites defined in TLS versions pre TLS-1.3.

* POTENTIAL INCOMPATIBILITY *

Own Id: OTP-18455 Aux Id: GH-5899

Erlang distribution code in Kernel and SSL has been refactored a bit to facilitate debugging and re-usability, which shouldn't have any noticeable effects on behaviour or performance.

Own Id: OTP-18456

Add encoding and decoding of use_srtp hello extension to facilitate for DTLS users to implement SRTP functionality.

Own Id: OTP-18459

Refactors the (ssl application to use macros for TLS and DTLS versions instead of hard-coded tuple numbers. This change improves the maintainability of ssl

Own Id: OTP-18465 Aux Id: GH-7065

If the function ssl:renegotiate/1 is called on connection that is running TLS-1.3 return an error instead of hanging or timing out.

Own Id: OTP-18507

If a user cancel alert with level warning is received during handshake make it be handled the same regardless of TLS version. If it is received in connection in TLS-1.3 regard it as an error as it is inappropriate.

In TLS-1.3 all error alerts are considered FATAL regardless of legacy alert type. But make sure legacy type is printed in logs to not confuse users that are expecting the same legacy type as sent by peer.

* POTENTIAL INCOMPATIBILITY *

Own Id: OTP-18531

Make fail_if_no_peer_cert default true if verify_peer is set on the server, otherwise the server will accept the connection if verify_peer is set and the user have forgot to set the fail_if_no_peer_cert and the client did not send a certificate.

Own Id: OTP-18567

To make it easier to configure signature algorithms with algorithms that are moved from the default add the API function signature_algs/2 that lists possible values. Also make sha224 a non default value.

Own Id: OTP-18572

SSL 10.9.1.7

Fixed Bugs and Malfunctions

Avoid generating an internal alert for case that should have been an orderly shutdown by the supervisor.

Own Id: OTP-19311 Aux Id: PR-8980

If present, extended key-usage TLS (SSL) role check (pk-clientAuth, pk-serverAuth) should always be performed for peer-cert. An intermediate CA cert may relax the requirement if AnyExtendedKeyUsage purpose is present.

In OTP-25.3.2.8, OTP-26.2 and OTP-27.0 these requirements became too relaxed. There where two problems, firstly the peer cert extension was only checked if it was marked critical, and secondly the CA cert check did not assert the relaxed AnyExtendedKeyUsage purpose.

This could result in that certificates might be misused for purposes not intended by the certificate authority.

Thanks to Bryan Paxton for reporting the issue.

Own Id: OTP-19352 Aux Id: PR-9130, CVE-2024-53846, OTP-19240

SSL 10.9.1.6

Fixed Bugs and Malfunctions

Starting from TLS-1.3 some server handshake alerts might arrive after ssl:connection/2,3,4 has returned. If the socket is in active mode the controlling process will get the alert message, but passive sockets would only get {error, closed} on next call to ssl:recv/2,3 or ssl/setopts/2. Passive sockets calls will now return {error, error_alert()} instead.

Own Id: OTP-19236 Aux Id: PR-8261

Servers configured to support only version (pre TLS-1.2) should ignore hello version extension, as it is an unknown extension to them, this will result in that new clients that do not support the old server version will get an insufficient security alert from the server and not a protocol version alert, this is consistent with how old servers not able to support higher protocol versions work.

Own Id: OTP-19257 Aux Id: ERIERL-1131

Correct timeout handling for termination code run for own alerts, so that intended timeout is used instead of falling back to OS TCP-stack timeout that is unreasonably long on some platforms.

Own Id: OTP-19274 Aux Id: PR-8901

SSL 10.9.1.5

Fixed Bugs and Malfunctions

TLS-1.3 negotiation now uses SNI based options correctly instead of ignoring them.

Own Id: OTP-19140

SSL 10.9.1.4

Fixed Bugs and Malfunctions

Fix certificate authorities check so that CA closest to peer is not lost. It could manifest itself in a failed connection as the client failed to realize it had a valid certificate chain to send to the server.

Own Id: OTP-19065 Aux Id: GH-8356, PR-8367

SSL 10.9.1.3

Fixed Bugs and Malfunctions

ssl application will validate id-kp-serverAuth and id-kp-clientAuth extended key usage only in end entity certificates. public_key application will disallow "anyExtendedKeyUsage" for CA certificates that includes the extended key usage extension and marks it critical.

Own Id: OTP-18739

Add missing export for connection_info() API type.

Own Id: OTP-18886

SSL 10.9.1.2

Fixed Bugs and Malfunctions

The API function `ssl:recv/3` has been tightened to disallow negative length, which has never been documented to work, but was passed through and caused strange errors.

Own Id: OTP-18700 Aux Id: GH-7507

When a client initiated renegotiation was rejected and the client socket was in active mode the expected error message to the controlling process was not sent.

Own Id: OTP-18712 Aux Id: GH-7431

SSL 10.9.1.1

Fixed Bugs and Malfunctions

Added keylog information to all protocol versions in ssl:connection_information/2.

Own Id: OTP-18643 Aux Id: ERIERL-932

Improvements and New Features

Add RFC-6083 considerations for DTLS to enable gen_sctp based callback for the transport.

Own Id: OTP-18618 Aux Id: ERIERL-932

SSL 10.9.1

Fixed Bugs and Malfunctions

With this change, ssl:connection_information/2 returns correct keylog data after TLS1.3 key update.

Own Id: OTP-18489

Client signature algorithm list input order is now honored again , it was accidently reversed by a previous fix.

Own Id: OTP-18550

SSL 10.9

Fixed Bugs and Malfunctions

Fixed that new dtls connections from the same client ip port combination works. If there is a process waiting for accept the new connection will connect to that, otherwise it will try to re-connect to the old server connection.

Own Id: OTP-18371 Aux Id: GH-6160

When shutting down a node that uses SSL distribution (-proto_dist inet_tls), a confusing error message about an unexpected process exit was printed. This particular message is no longer generated.

Own Id: OTP-18443 Aux Id: PR-6810

Improvements and New Features

fixes the type spec for ssl:format_error/1

Own Id: OTP-18366 Aux Id: PR-6565, GH-6506

Replace size/1 with either tuple_size/1 or byte_size/1

The size/1 BIF is not optimized by the JIT, and its use can result in worse types for Dialyzer.

When one knows that the value being tested must be a tuple, tuple_size/1 should always be preferred.

When one knows that the value being tested must be a binary, byte_size/1 should be preferred. However, byte_size/1 also accepts a bitstring (rounding up size to a whole number of bytes), so one must make sure that the call to byte_size/ is preceded by a call to is_binary/1 to ensure that bitstrings are rejected. Note that the compiler removes redundant calls to is_binary/1, so if one is not sure whether previous code had made sure that the argument is a binary, it does not harm to add an is_binary/1 test immediately before the call to byte_size/1.

Own Id: OTP-18432 Aux Id: GH-6672,PR-6793,PR-6784,PR-6787,PR-6785,PR-6682,PR-6800,PR-6797,PR-6798,PR-6799,PR-6796,PR-6813,PR-6671,PR-6673,PR-6684,PR-6694,GH-6677,PR-6696,PR-6670,PR-6674

SSL 10.8.7

Improvements and New Features

Maximize compatibility by ignoring change_cipher_spec during handshake even if middle_box_mode is not negotiated (mandated by client)

Own Id: OTP-18433 Aux Id: GH-6772

Move assert of middlebox message after an hello_retry_request to maximize interoperability. Does not changes semantics of the protocol only allows unexpected message delay from server.

Own Id: OTP-18467 Aux Id: GH-6807

SSL 10.8.6

Fixed Bugs and Malfunctions

With this change, tls_sender process is hibernated after sufficient inactivity.

Own Id: OTP-18314 Aux Id: GH-6373

Correct handling of legacy schemes so that ECDSA certs using sha1 may be used for some TLS-1.3 configurations.

Own Id: OTP-18332 Aux Id: GH-6435, PR-6435, ERL-6435

With this change, tls_sender does not cause logger crash upon key update.

Own Id: OTP-18349

Improvements and New Features

Enhance warning message

Own Id: OTP-18257 Aux Id: GH-6307

Provide server option to make certificate_authorities extension in the TLS-1.3 servers certificate request optional. This will allow clients to send incomplete chains that may be reconstructable and thereby verifiable by the server, but that would not adhere to the certificate_authorities extension.

Own Id: OTP-18267 Aux Id: PR-6228, GH-6106

If the verify_fun handles four arguments the DER cert will be supplied as one of the arguments.

Own Id: OTP-18302 Aux Id: ERIERL-867

SSL 10.8.5

Fixed Bugs and Malfunctions

Fixes handling of symlinks in cacertfile option.

Own Id: OTP-18266 Aux Id: GH-6328

SSL 10.8.4

Fixed Bugs and Malfunctions

Reject unexpected application data in all relevant places for all TLS versions. Also, handle TLS-1.3 middlebox compatibility with more care. This will make malicious connections fail early and further, mitigate possible DoS attacks, that would be caught by the handshake timeout.

Thanks to Aina Toky Rasoamanana and Olivier Levillain from Télécom SudParis for alerting us of the issues in our implementation.

Own Id: OTP-18044

With this change, value of cacertfile option will be adjusted before loading certs from the file. Adjustments include converting relative paths to absolute and converting symlinks to actual file path.

Thanks to Marcus Johansson

Own Id: OTP-18099 Aux Id: PR-6287

In TLS-1.3, if chain certs are missing (so server auth domain adherence can not be determined) send peer cert and hope the server is able to recreate a chain in its auth domain.

Own Id: OTP-18191 Aux Id: GH-6105

Make sure periodical refresh of CA certificate files repopulates cache properly.

Own Id: OTP-18195

Correct internal CRL cache functions to use internal format consistently.

Own Id: OTP-18203 Aux Id: PR-5996

Incorrect handling of client middlebox negotiation for TLS-1.3 could result in that a TLS-1.3 server would not use middlebox mode although the client was expecting it too and failing the negotiation with unexpected message.

Own Id: OTP-18219 Aux Id: GH-6241, PR-6249

If the "User" process, the process starting the TLS connection, gets killed in the middle of spawning the dynamic connection tree make sure we do not leave any processes behind.

Own Id: OTP-18233 Aux Id: GH-6244, PR-6270

Improvements and New Features

A vulnerability has been discovered and corrected. It is registered as CVE-2022-37026 "Client Authentication Bypass". Corrections have been released on the supported tracks with patches 23.3.4.15, 24.3.4.2, and 25.0.2. The vulnerability might also exist in older OTP versions. We recommend that impacted users upgrade to one of these versions or later on the respective tracks. OTP 25.1 would be an even better choice. Impacted are those who are running an ssl/tls/dtls server using the ssl application either directly or indirectly via other applications. For example via inets (httpd), cowboy, etc. Note that the vulnerability only affects servers that request client certification, that is sets the option {verify, verify_peer}.

Own Id: OTP-18241

SSL 10.8.3

Fixed Bugs and Malfunctions

The link to crypto:engine_load refered the function with wrong arity.

Own Id: OTP-18173

SSL 10.8.2

Fixed Bugs and Malfunctions

Improved handling of unexpected messages during the handshake, taking the right action for unexpected messages.

Own Id: OTP-18145

SSL 10.8.1

Fixed Bugs and Malfunctions

When a TLS-1.3 enabled client tried to talk to a TLS-1.2 server that coalesces TLS-1.2 handshake message over one TLS record, the connection could fail due to some message being handled in the wrong state, this has been fixed.

Own Id: OTP-18087 Aux Id: GH-5961

Correctly handles supported protocol version change from default to something else by sni_fun supplied to ssl:handshake/[2,3] together with a TCP-socket (so called upgrade).

Own Id: OTP-18100 Aux Id: GH-5985

Also, TLS-1.3 should respond with a protocol version alert if previous versions, that are supported but not configured, are attempted.

Own Id: OTP-18129 Aux Id: GH-5950

SSL 10.8

Fixed Bugs and Malfunctions

When a TLS-1.3 enabled client tried to talk to a TLS-1.2 server that coalesces TLS-1.2 handshake message over one TLS record, the connection could fail due to some message being handled in the wrong state, this has been fixed.

Own Id: OTP-18087 Aux Id: GH-5961

Fixed tls-1.3 session ticket lifetime which was discarded to quickly before.

Own Id: OTP-18092 Aux Id: PR-5959

Improvements and New Features

With this change, it is possible to provide several certificates. Most appropriate will be selected based on negotiated properties.

Own Id: OTP-15993 Aux Id: GH-4143

Add options for users to be able to set spawn_opts for TLS processes (sender and receiver) this may be useful for tuning trade-offs between CPU and Memory usage.

Own Id: OTP-17855 Aux Id: PR-5328

Allow key file passwords to be input as a single binary, that is we change the data type to be the more for the purpose logical data type iodata() instead of string().

Own Id: OTP-17890

Logging enhancement, add location information to the warning log message.

Own Id: OTP-18000 Aux Id: PR-5790

Now also accepts the signature_algs_cert option in TLS-1.2 configuration.

Own Id: OTP-18014

Handle certificate selection correctly for server fallback and certificate authorities considerations.

Own Id: OTP-18045 Aux Id: ERIERL-792, OTP-15993

Enhance handling of handshake decoding errors, especially for certificate authorities extension to ensure graceful termination.

Own Id: OTP-18085

SSL 10.7.3.9

Fixed Bugs and Malfunctions

When a client initiated renegotiation was rejected and the client socket was in active mode the expected error message to the controlling process was not sent.

Own Id: OTP-18712 Aux Id: GH-7431

SSL 10.7.3.8

Fixed Bugs and Malfunctions

Added keylog information to all protocol versions in ssl:connection_information/2.

Own Id: OTP-18643 Aux Id: ERIERL-932

Improvements and New Features

Add RFC-6083 considerations for DTLS to enable gen_sctp based callback for the transport.

Own Id: OTP-18618 Aux Id: ERIERL-932

SSL 10.7.3.7

Fixed Bugs and Malfunctions

Client signature algorithm list input order is now honored again , it was accidently reversed by a previous fix.

Own Id: OTP-18550

SSL 10.7.3.6

Improvements and New Features

Maximize compatibility by ignoring change_cipher_spec during handshake even if middle_box_mode is not negotiated (mandated by client)

Own Id: OTP-18433 Aux Id: GH-6772

Move assert of middlebox message after an hello_retry_request to maximize interoperability. Does not changes semantics of the protocol only allows unexpected message delay from server.

Own Id: OTP-18467 Aux Id: GH-6807

SSL 10.7.3.5

Fixed Bugs and Malfunctions

Fixes handling of symlinks in cacertfile option.

Own Id: OTP-18266 Aux Id: GH-6328

SSL 10.7.3.4

Fixed Bugs and Malfunctions

With this change, value of cacertfile option will be adjusted before loading certs from the file. Adjustments include converting relative paths to absolute and converting symlinks to actual file path.

Thanks to Marcus Johansson

Own Id: OTP-18099 Aux Id: PR-6287

Incorrect handling of client middlebox negotiation for TLS-1.3 could result in that a TLS-1.3 server would not use middlebox mode although the client was expecting it too and failing the negotiation with unexpected message.

Own Id: OTP-18219 Aux Id: GH-6241, PR-6249

If the "User" process, the process starting the TLS connection, gets killed in the middle of spawning the dynamic connection tree make sure we do not leave any processes behind.

Own Id: OTP-18233 Aux Id: GH-6244, PR-6270

SSL 10.7.3.3

Fixed Bugs and Malfunctions

Reject unexpected application data in all relevant places for all TLS versions. Also, handle TLS-1.3 middlebox compatibility with more care. This will make malicious connections fail early and further, mitigate possible DoS attacks, that would be caught by the handshake timeout.

Thanks to Aina Toky Rasoamanana and Olivier Levillain from Télécom SudParis for alerting us of the issues in our implementation.

Own Id: OTP-18044

The link to crypto:engine_load refered the function with wrong arity.

Own Id: OTP-18173

Make sure periodical refresh of CA certificate files repopulates cache properly.

Own Id: OTP-18195

SSL 10.7.3.2

Fixed Bugs and Malfunctions

Improved handling of unexpected messages during the handshake, taking the right action for unexpected messages.

Own Id: OTP-18145

SSL 10.7.3.1

Fixed Bugs and Malfunctions

When a TLS-1.3 enabled client tried to talk to a TLS-1.2 server that coalesces TLS-1.2 handshake message over one TLS record, the connection could fail due to some message being handled in the wrong state, this has been fixed.

Own Id: OTP-18087 Aux Id: GH-5961

Fixed tls-1.3 session ticket lifetime which was discarded to quickly before.

Own Id: OTP-18092 Aux Id: PR-5959

Correctly handles supported protocol version change from default to something else by sni_fun supplied to ssl:handshake/[2,3] together with a TCP-socket (so called upgrade).

Own Id: OTP-18100 Aux Id: GH-5985

Also, TLS-1.3 should respond with a protocol version alert if previous versions, that are supported but not configured, are attempted.

Own Id: OTP-18129 Aux Id: GH-5950

Improvements and New Features

Enhance handling of handshake decoding errors, especially for certificate authorities extension to ensure graceful termination.

Own Id: OTP-18085

SSL 10.7.3

Fixed Bugs and Malfunctions

Client certification could fail if TLS-1.3 enabled client negotiated TLS-1.2 connection with the server, this is due to the wrong version being used when decoding the certificate request message from the server.

Own Id: OTP-18028 Aux Id: GH-5835

socket option packet_size was not handled in ssl:setops/2 and ssl:getotps/2

Own Id: OTP-18062 Aux Id: GH-5898

Remove legacy code to fix interoperability with new socket inet_backend.

Own Id: OTP-18071 Aux Id: GH-5930

SSL 10.7.2

Fixed Bugs and Malfunctions

With this change, potential hanging of pre TLS1.3 client receiving OSCP staple message is avoided.

Own Id: OTP-17994

SSL 10.7.1

Fixed Bugs and Malfunctions

Client certification could fail for TLS-1.3 servers that did not include the certificate_authorities extension in its certificate request message.

Own Id: OTP-17971 Aux Id: GH-5783

SSL 10.7

Fixed Bugs and Malfunctions

Improved error handling.

Own Id: OTP-17759 Aux Id: GH-5367

Before this change, net_kernel used with TLS distribution might be leaking processes in case of connectivity issues.

Own Id: OTP-17815 Aux Id: GH-5332

Fix makefile dependency bugs.

Own Id: OTP-17847 Aux Id: PR-5574 GH-5548

Make sure the TLS sender process handles explicit calls to erlang:disconnect_node properly, avoiding potential hanging problems in net_kernel.

Own Id: OTP-17929 Aux Id: GH-5708

Improvements and New Features

Add support for TLS-1.3 certificate_authorities extension. And process certificate_authorities field in pre-TLS-1.3 certificate requests.

Own Id: OTP-15719

Support password fun for protected keyfiles in ssl:connect function.

Own Id: OTP-17816 Aux Id: PR-5607

Add in some cases earlier detection of possible DoS attacks by malicious clients sending unexpected TLS messages instead of the client hello. Note that such attacks are already mitigated by providing a timeout for the TLS handshake.

Own Id: OTP-17903

SSL 10.6.1

Fixed Bugs and Malfunctions

Improve SNI (server name indication) handling so that protocol version can be selected with regards to SNI. Also, make sure that ssl:connection_information/1 returns the correct SNI value.

Own Id: OTP-17794 Aux Id: GH-5341, GH-4450

Fixed cipher suite listing functions so that the listing of all cipher suites will be complete. Another fix for cipher suite handling in OTP-24.1 accidentally excludes a few cipher suites from the listing of all cipher suites.

Own Id: OTP-17829 Aux Id: ERIERL-708

Reenable legacy cipher suite TLS_RSA_WITH_3DES_EDE_CBC_SHA for explicit configuration in TLS-1.2, not supported by default.

Own Id: OTP-17879 Aux Id: GH-5624

Improvements and New Features

Avoid unnecessary logs by better adjusting the tls_sender process to the new supervisor structure in OTP-24.2

Own Id: OTP-17831

SSL 10.6

Fixed Bugs and Malfunctions

Allow re-connect on DTLS sockets

Can happen when a computer reboots and connects from the same client port without the server noticing should be allowed according to RFC.

Own Id: OTP-17411 Aux Id: ERL-1203, GH-4393

Fix tls and non-tls distribution to use erl_epmd:address_please to figure out if IPv4 or IPv6 addresses should be used when connecting to the remote node.

Before this fix, a dns lookup of the remote node hostname determined which IP version was to be used which meant that the hostname had to resolve to a valid ip address.

Own Id: OTP-17809 Aux Id: PR-5337 GH-5334

Improvements and New Features

Use supervisor significant child to manage tls connection process and tls sender process dependency.

Own Id: OTP-17417

Random generation adjustment for TLS1.3

Own Id: OTP-17699

Allow any {03,XX} TLS record version in the client hello for maximum interoperability

Own Id: OTP-17761 Aux Id: GH-5380

SSL 10.5.3

Fixed Bugs and Malfunctions

Correct typo of ECC curve name in signature algorithm handling. Will make the signature algorithm ecdsa_secp521r1_sha512 succeed.

Own Id: OTP-17756 Aux Id: GH-5383, PR-5397

Suppress authenticity warning when option verify_none is explicitly supplied.

Own Id: OTP-17757 Aux Id: GH-5352, PR-5395

SSL 10.5.2

Fixed Bugs and Malfunctions

Fix TLS-1.2 RSA-PSS negotiation and also fix broken certificate request message for pre-TLS-1.3 servers.

Own Id: OTP-17688 Aux Id: GH-5255

Fix CRL issuer verification that under some circumstances could fail with a function_clause error.

Own Id: OTP-17723 Aux Id: GH-5300

SSL 10.5.1

Fixed Bugs and Malfunctions

Before that change, TLS downgrade could occasionally fail when data intended for downgraded socket were delivered together with CLOSE_NOTIFY alert to ssl app.

Own Id: OTP-17393

Avoid re-encoding of decoded certificates. This could cause unexpected failures as some subtle encoding errors can be tolerated when decoding but hence creating another sequence of bytes if the decoded value is re-encoded.

Own Id: OTP-17657

Fix possible process leak when the process doing ssl:transport_accept dies before initiating the TLS handshake.

Own Id: OTP-17666 Aux Id: GH-5239

Fix dtls memory leak, the replay window code was broken.

Own Id: OTP-17670 Aux Id: GH-5224

SSL 10.5

Fixed Bugs and Malfunctions

Fix Makefile dependency generation to work no matter what the ERL_TOP folder is called.

Own Id: OTP-17423 Aux Id: GH-4823 PR-4829

If trying to downgrade a TLS-1.3 connection to a plain TCP connection, possible TLS-1.3 session ticket messages will be ignored in the "downgrade" state while waiting for the close notify alert.

Own Id: OTP-17517 Aux Id: GH-5009

Corrected error handling to correctly generate an insufficient security alert when there are no suitable groups that can be negotiated in TLS-1.3 instead of crashing resulting in an internal error alert.

Own Id: OTP-17521

Properly handle default session data storage.

When a client tries to reuse an expired session the default server storage handling would crash losing other session data. This would cause a error report and possible loss of abbreviated handshakes.

Own Id: OTP-17635 Aux Id: GH-5192

Improvements and New Features

Add support for RSA-PSS-PSS signatures and signature_algorithms_cert in TLS-1.2. This is a TLS-1.3 RFC requirement to backport this functionality.

Own Id: OTP-16590 Aux Id: ERL-625, GH-5029

Use inet:monitor/1 to monitor listen-sockets so that we are compatible with the new socket backend for gen_tcp.

Own Id: OTP-17392 Aux Id: PR-5050

Enhance ssl:prf/4 handling and testing

Own Id: OTP-17464

Enhanced cipher suite filtering functionality, making sure TLS-1.3 and TLS-1.2 cipher suites can be supported correctly together even when TLS-1.2 anonymous ciphers are included.

Own Id: OTP-17501 Aux Id: GH-4978

Enhance gracefulness especially in TLS-1.3

Own Id: OTP-17530

SSL 10.4.2

Fixed Bugs and Malfunctions

Handle cross-signed root certificates when old root expired as reported in GH-4877.

Own Id: OTP-17475 Aux Id: GH-4877

The signature selection algorithm has been changed to also verify if the client supports signatures using the elliptic curve of the server's public/private key pair. This change fixes #4958.

Own Id: OTP-17529 Aux Id: PR-4979, GH-4958

Improvements and New Features

Slight optimization of certificate decoding.

Own Id: OTP-17150 Aux Id: GH-4877

SSL 10.4.1

Fixed Bugs and Malfunctions

Fix cache invalidation problem for CA certs provided by the cacertfile option.

Own Id: OTP-17435 Aux Id: ERIERL-653

SSL 10.4

Fixed Bugs and Malfunctions

Missing runtime dependencies has been added to this application.

Own Id: OTP-17243 Aux Id: PR-4557

TLS handshake should fail if OCSP staple is requested but missing. Note that OCSP support is still considered experimental and only partially implemented.

Own Id: OTP-17343

Improvements and New Features

Removed ssl:ssl_accept/1,2,3 and ssl:cipher:suites/0,1 use ssl:handshake/1,2,3 and ssl:cipher_suites/2,3 instead.

* POTENTIAL INCOMPATIBILITY *

Own Id: OTP-16974

Make TLS handshakes in Erlang distribution concurrent.

Own Id: OTP-17044 Aux Id: PR-2654

Randomize internal {active,n} optimization when running Erlang distribution over TLS to spread RAM/CPU spike that may occur when starting up a big cluster.

Own Id: OTP-17117 Aux Id: PR-2933

TLS connections now support EdDSA certificates.

Own Id: OTP-17142 Aux Id: PR-4756, GH-4637, GH-4650

Enhance documentation and logging of certificate handling.

Own Id: OTP-17384 Aux Id: GH-4800

SSL 10.3.1.5

Fixed Bugs and Malfunctions

Correct corner case of unexpected message handling for pre TLS-1.3 versions, could cause "late failure" and make the server dependent on its handshake timeout to prevent possible DoS attacks.

Own Id: OTP-18224

SSL 10.3.1.4

Fixed Bugs and Malfunctions

The link to crypto:engine_load refered the function with wrong arity.

Own Id: OTP-18173

SSL 10.3.1.3

Fixed Bugs and Malfunctions

Improved handling of unexpected messages during the handshake, taking the right action for unexpected messages.

Own Id: OTP-18145

SSL 10.3.1.2

Fixed Bugs and Malfunctions

Handle cross-signed root certificates when old root expired as reported in GH-4877.

Own Id: OTP-17475 Aux Id: GH-4877

The signature selection algorithm has been changed to also verify if the client supports signatures using the elliptic curve of the server's public/private key pair. This change fixes #4958.

Own Id: OTP-17529 Aux Id: PR-4979, GH-4958

Improvements and New Features

Slight optimization of certificate decoding.

Own Id: OTP-17150 Aux Id: GH-4877

SSL 10.3.1.1

Fixed Bugs and Malfunctions

Fix cache invalidation problem for CA certs provided by the cacertfile option.

Own Id: OTP-17435 Aux Id: ERIERL-653

SSL 10.3.1

Fixed Bugs and Malfunctions

Retain backwards compatible behavior of verify_fun when handling incomplete chains that are not verifiable.

Own Id: OTP-17296 Aux Id: GH-4682

Avoid server session handler crash, this will increase session ruse opportunities.

Own Id: OTP-17348 Aux Id: ERIERL-641

SSL 10.3

Fixed Bugs and Malfunctions

Fix CRL handling that previously could fail to find the issuer cert under some circumstances.

Own Id: OTP-17261 Aux Id: GH-4589

TLS-1.3 client could, under some circumstances, select an incorrect algorithm to sign the certificate verification message causing a TLS Decrypt Alert being issued by the server.

Own Id: OTP-17281 Aux Id: GH-4620

Correct handling of default values for emulated socket options and retain the order of the ssl options list to ensure backwards compatible behavior if options should be set more than once.

Own Id: OTP-17282

Improvements and New Features

Enhance pre TLS-1.3 session handling so the client and server side handling is completely separated and client disregards oldest session when reaching max limit of the session table.

Own Id: OTP-16876

This change implements the early data feature for TLS 1.3 clients.

TLS 1.3 allows clients to send data in the first flight using a Pre-Shared Key to authenticate the server and to encrypt the early data.

Own Id: OTP-16985

This change implements the early data feature for TLS 1.3 servers.

Own Id: OTP-17042

SSL 10.2.4.4

Fixed Bugs and Malfunctions

Improved handling of unexpected messages during the handshake, taking the right action for unexpected messages.

Own Id: OTP-18145

SSL 10.2.4.3

Fixed Bugs and Malfunctions

Fix cache invalidation problem for CA certs provided by the cacertfile option.

Own Id: OTP-17435 Aux Id: ERIERL-653

SSL 10.2.4.2

Fixed Bugs and Malfunctions

Fix handling of emulated socket options, the previous patch was incomplete,

Own Id: OTP-17305

SSL 10.2.4.1

Fixed Bugs and Malfunctions

Backport of OTP-17282

Correct handling of default values for emulated socket options and retain the order of the ssl options list to ensure backwards compatible behavior if options should be set more than once.

Own Id: OTP-17289 Aux Id: GH-4585

SSL 10.2.4

Fixed Bugs and Malfunctions

Enhance logging option log_level to support none and all, also restore backwards compatibility for log_alert option.

Own Id: OTP-17228 Aux Id: ERIERL-614

SSL 10.2.3

Fixed Bugs and Malfunctions

Avoid race when the first two upgrade server handshakes (that is servers that use a gen_tcp socket as input to ssl:handshake/2,3) start close to each other. Could lead to that one of the handshakes would fail.

Own Id: OTP-17190 Aux Id: ERIERL-606

SSL 10.2.2

Fixed Bugs and Malfunctions

Avoid that upgrade (from TCP to TLS) servers starts multiple session cache handlers for the same server. This applies to Erlang distribution over TLS servers.

Own Id: OTP-17139 Aux Id: ERL-1458, OTP-16239

Legacy cipher suites defined before TLS-1.2 (but still supported) should be possible to use in TLS-1.2. They where accidentally excluded for available cipher suites for TLS-1.2 in OTP-23.2.2.

Own Id: OTP-17174 Aux Id: ERIERL-597

Improvements and New Features

Enable Erlang distribution over TLS to run TLS-1.3, although TLS-1.2 will still be default.

Own Id: OTP-16239 Aux Id: ERL-1458, OTP-17139

SSL 10.2.1

Fixed Bugs and Malfunctions

Fix CVE-2020-35733 this only affects ssl-10.2 (OTP-23.2). This vulnerability could enable a man in the middle attack using a fake chain to a known trusted ROOT. Also limits alternative chain handling, for handling of possibly extraneous certs, to improve memory management.

Own Id: OTP-17098

Improvements and New Features

Add support for AES CCM based cipher suites defined in RFC 7251

Also Correct cipher suite name conversion to OpenSSL names. A few names where corrected earlier in OTP-16267 For backwards compatible reasons we support usage of openSSL names for cipher suites. Mostly anonymous suites names where incorrect, but also some legacy suites.

Own Id: OTP-17100

SSL 10.2

Fixed Bugs and Malfunctions

SSL's Erlang Distribution Protocol modules inet_tls_dist and inet6_tls_dist lacked a callback function, so the start flag "-dist_listen false" did not work, which has now been fixed.

Own Id: OTP-15126 Aux Id: ERL-1375

Correct OpenSSL names for newer cipher suites using DHE in their name that accidentally got the wrong value when fixing other older names using EDH instead.

Own Id: OTP-16267 Aux Id: ERIERL-571, ERIERL-477

This change improves the handling of DTLS listening dockets, making it possible to open multiple listeners on the same port with different IP addresses.

Own Id: OTP-16849 Aux Id: ERL-1339

Fix a bug that causes cross-build failure.

This change excludes the ssl.d dependency file from the source tarballs.

Own Id: OTP-16921

This change fixes ssl:peername/1 when called on a DTLS client socket.

Own Id: OTP-16923 Aux Id: ERL-1341, PR-2786

Retain emulation of active once on a closed socket to behave as before 23.1

Own Id: OTP-17018 Aux Id: ERL-1409

Corrected server session cache entry deletion pre TLS-1.3. May increase session reuse.

Own Id: OTP-17019 Aux Id: ERL-1412

Improvements and New Features

Handle extraneous certs in certificate chains as well as chains that are incomplete but can be reconstructed or unordered chains. The cert and certfile options will now accept a list of certificates so that the user may specify the chain explicitly.

Also, the default value of the depth option has been increased to allow longer chains by default.

Own Id: OTP-16277

This change implements optional NSS-style keylog in ssl:connection_information/2 for debugging purposes.

The keylog contains various TLS secrets that can be loaded in Wireshark to decrypt TLS packets.

Own Id: OTP-16445 Aux Id: PR-2823

Use new gen_statem feature of changing callback mode to improve code maintainability.

Own Id: OTP-16529

The handling of Service Name Indication has been aligned with RFC8446.

Own Id: OTP-16762

Add explicit session reuse option to TLS clients for pre TLS-1.3 sessions. Also, add documentation to Users Guide for such sessions.

Own Id: OTP-16893

SSL 10.1

Fixed Bugs and Malfunctions

If a passive socket is created, ssl:recv/2,3 is never called and then the peer closes the socket the controlling process will no longer receive an active close message.

Own Id: OTP-16697 Aux Id: ERIERL-496

Data deliver with ssl:recv/2,3 could fail for when using packet mode. This has been fixed by correcting the flow control handling of passive sockets when packet mode is used.

Own Id: OTP-16764

This change fixes a potential man-in-the-middle vulnerability when the ssl client is configured to automatically handle session tickets ({session_tickets, auto}).

Own Id: OTP-16765

Fix the internal handling of options 'verify' and 'verify_fun'.

This change fixes a vulnerability when setting the ssl option 'verify' to verify_peer in a continued handshake won't take any effect resulting in the acceptance of expired peer certificates.

Own Id: OTP-16767 Aux Id: ERIERL-512

This change fixes the handling of stateless session tickets when anti-replay is enabled.

Own Id: OTP-16776 Aux Id: ERL-1316

Fix a crash due to the faulty handling of stateful session tickets received by servers expecting stateless session tickets.

This change also improves the handling of faulty/invalid tickets.

Own Id: OTP-16777 Aux Id: ERL-1317

Correct flow ctrl checks from OTP-16764 to work as intended. Probably will not have a noticeable affect but will make connections more well behaved under some circumstances.

Own Id: OTP-16837 Aux Id: ERL-1319, OTP-16764

Distribution over TLS could exhibit livelock-like behaviour when there is a constant stream of distribution messages. Distribution data is now chunked every 16 Mb to avoid that.

Own Id: OTP-16851 Aux Id: PR-2703

Improvements and New Features

Implement the cookie extension for TLS 1.3.

Own Id: OTP-15855

Experimental OCSP client support.

Own Id: OTP-16448

TLS 1.0 -TLS-1.2 sessions tables now have a absolute max value instead of using a shrinking mechanism when reaching the limit. To avoid out of memory problems under heavy load situations. Note that this change infers that implementations of ssl_session_cache_api needs to implement the size function (introduce in OTP 19) for session reuse to be optimally utilized.

Own Id: OTP-16802 Aux Id: ERIERL-516

SSL 10.0

Fixed Bugs and Malfunctions

Fix a bug that causes cross-build failure.

This change excludes the ssl.d dependency file from the source tar balls.

Own Id: OTP-16562 Aux Id: ERL-1168

Correct translation of OpenSSL legacy names for two legacy cipher suites

Own Id: OTP-16573 Aux Id: ERIERL-477

Correct documentation for PSK identity and SRP username.

Own Id: OTP-16585

Make sure client hostname check is run when client uses its own verify_fun

Own Id: OTP-16626 Aux Id: ERL-1232

Improved signature selection mechanism in TLS 1.3 for increased interoperability.

Own Id: OTP-16638 Aux Id: ERL-1206

Improvements and New Features

Drop support for SSL-3.0. Support for this legacy TLS version has not been enabled by default since OTP 19. Now all code to support it has been removed, that is SSL-3.0 protocol version can not be used and is considered invalid.

* POTENTIAL INCOMPATIBILITY *

Own Id: OTP-14790

Added support for RSA-PSS signature schemes

Own Id: OTP-15247

Improve interoperability by implementing the middlebox compatibility mode.

The middlebox compatibility mode makes the TLS 1.3 handshake look more like a TLS 1.2 handshake and increases the chance of successfully establishing TLS 1.3 connections through legacy middleboxes.

Own Id: OTP-15589

Utilize new properties of erlang:dist_ctrl_get_data() for performance improvement of Erlang distribution over TLS.

Own Id: OTP-16127 Aux Id: OTP-15618

Calls of deprecated functions in the Old Crypto API are replaced by calls of their substitutions.

Own Id: OTP-16346

Implement cipher suite TLS_AES_128_CCM_8_SHA256.

Own Id: OTP-16391

This change adds TLS-1.3 to the list of default supported versions. That is, TLS-1.3 and TLS-1.2 are configured when ssl option 'versions' is not explicitly set.

* POTENTIAL INCOMPATIBILITY *

Own Id: OTP-16400

Refactored the internal handling of deprecated and removed functions.

Own Id: OTP-16469

Extended ssl:versions so that it lists supported, available and implemented TLS/DTLS versions.

Own Id: OTP-16519

Added new option exclusive for ssl:cipher_suites/2,3

Own Id: OTP-16532

Avoid DoS attack against stateful session_tickets by making session ticket ids unpredictable.

Own Id: OTP-16533

Add support for the max_fragment_length extension (RFC 6066).

Own Id: OTP-16547 Aux Id: PR-2547

Add srp_username in ssl:connection_info, update the document with types of this function.

Own Id: OTP-16584

SSL 9.6.2.3

Fixed Bugs and Malfunctions

Correct flow ctrl checks from OTP-16764 to work as intended. Probably will not have a noticeable affect but will make connections more well behaved under some circumstances.

Own Id: OTP-16837 Aux Id: ERL-1319, OTP-16764

Fix a bug that causes cross-build failure.

This change excludes the ssl.d dependency file from the source tar balls.

Own Id: OTP-16921

SSL 9.6.2.2

Fixed Bugs and Malfunctions

Data deliver with ssl:recv/2,3 could fail for when using packet mode. This has been fixed by correcting the flow control handling of passive sockets when packet mode is used.

Own Id: OTP-16764

Fix the internal handling of options 'verify' and 'verify_fun'.

This change fixes a vulnerability when setting the ssl option 'verify' to verify_peer in a continued handshake won't take any effect resulting in the acceptance of expired peer certificates.

Own Id: OTP-16767 Aux Id: ERIERL-512

SSL 9.6.2.1

Improvements and New Features

If a passive socket is created, ssl:recv/2,3 is never called and then the peer closes the socket the controlling process will no longer receive an active close message.

Own Id: OTP-16697 Aux Id: ERIERL-496

SSL 9.6.2

Fixed Bugs and Malfunctions

Fix timing bug that could cause ssl sockets to become unresponsive after an ssl:recv/3 call timed out

Own Id: OTP-16619 Aux Id: ERL-1213

SSL 9.6.1

Fixed Bugs and Malfunctions

Correct error handling when the partial_chain fun claims a certificate to be the trusted cert that is not part of the chain. This bug would hide the appropriate alert generating an "INTERNAL_ERROR" alert instead.

Own Id: OTP-16567 Aux Id: ERIERL-481

SSL 9.6

Fixed Bugs and Malfunctions

Correct handling of TLS record limit in TLS-1.3. The max value differs from previous versions. Also the payload data max record check was broken, that is record overflow problems could occur if user sent large amounts of data.

Own Id: OTP-16258

Correct close handling for DTLS

Own Id: OTP-16348 Aux Id: ERL-1110

Fix ssl:getstat/1-2 to also work for DTLS sockets

Own Id: OTP-16352 Aux Id: ERL-1099

Correct internal handling och socket active mode to avoid reviving TCP data aimed for a downgraded TLS socket.

Own Id: OTP-16425

When using the host name as fallback for SNI (server name indication) strip a possible trailing dot that is allowed in a host name but not in the SNI. Also if the server receives a SNI with a trailing dot send an UNRECOGNIZED_NAME alert.

Own Id: OTP-16437 Aux Id: ERL-1135

Immediately remove session entries if handshake is abruptly closed at transport level.

Own Id: OTP-16479

Improvements and New Features

Implementation of the key and initialization vector update feature, and general hardening of TLS 1.3.

There are cryptographic limits on the amount of plaintext which can be safely encrypted under a given set of keys.

This change enforces those limits by triggering automatic key updates on TLS 1.3 connections.

Own Id: OTP-15856

Add support for TLS 1.3 Session Tickets (stateful and stateless). This allows session resumption using keying material from a previous successful handshake.

Own Id: OTP-16253

Add support for key exchange with Edward curves and PSS-RSA padding in signature verification.

Own Id: OTP-16528

SSL 9.5.3

Fixed Bugs and Malfunctions

Enhance error handling, all ALERTS shall be handled gracefully and not cause a crash.

Own Id: OTP-16413 Aux Id: ERL-1136

Enhance alert logging, in some places the role indication of the alert origin was missing. So the log would say undefined instead of client or server.

Own Id: OTP-16424

Two different optimizations did not work together and resulted in the possible breakage of connections using stream ciphers (that is RC4). Reworked the implementation to avoid this.

Own Id: OTP-16426 Aux Id: ERL-1136

SSL 9.5.2

Fixed Bugs and Malfunctions

Fix the handling of GREASE values sent by web browsers when establishing TLS 1.3 connections. This change improves handling of GREASE values in various protocol elements sent in a TLS 1.3 ClientHello.

Own Id: OTP-16388 Aux Id: ERL-1130

Correct DTLS listen emulation, could cause problems with opening a new DTLS listen socket for a port previously used by a now closed DTLS listen socket.

Own Id: OTP-16396 Aux Id: ERL-1118

SSL 9.5.1

Fixed Bugs and Malfunctions

Add missing alert handling clause for TLS record handling. Could sometimes cause confusing error behaviors of TLS connections.

Own Id: OTP-16357 Aux Id: ERL-1166

Fix handling of ssl:recv that happens during a renegotiation. Using the passive receive function ssl:recv/[2,3] during a renegotiation would fail the connection with unexpected msg.

Own Id: OTP-16361

SSL 9.5

Fixed Bugs and Malfunctions

Corrected CRL handling which could cause CRL verification to fail. This could happen when the CRL distribution point explicitly specifies the CRL issuer, that is not using the fallback.

Own Id: OTP-16156 Aux Id: ERL-1030

Correct handling of unordered chains so that it works as expected

Own Id: OTP-16293

Fix bug causing ssl application to crash when handshake is paused and ClientHello contains extensions for session resumption (psk_key_exchange_modes, pre_shared_key).

Own Id: OTP-16295 Aux Id: ERL-1095

Fix connectivity problems with legacy servers when client is configured to support a range of protocol versions including TLS 1.3.

Own Id: OTP-16303

Improvements and New Features

Improve session handling for TLS-1.3 compatibility mode and cleaner internal handling so that removal of old session data can be more efficient, hopefully mitigating problems with big session tables during heavy load.

Own Id: OTP-15524 Aux Id: OTP-15352

Correct handling of DTLS listen socket emulation. Could cause failure to create new listen socket after process that owned previous listen socket died.

Own Id: OTP-15809 Aux Id: ERL-917

Add detailed info in ALERT description when client does not send a requested cert.

Own Id: OTP-16266

SSL 9.4

Fixed Bugs and Malfunctions

Handling of zero size fragments in TLS could cause an infinite loop. This has now been corrected.

Own Id: OTP-15328 Aux Id: ERIERL-379

DTLS record check needs to consider that a resent hello message can have a different version than the negotiated.

Own Id: OTP-15807 Aux Id: ERL-920

Improvements and New Features

Basic support for TLS 1.3 Client for experimental use. For more information see the Standards Compliance chapter of the User's Guide.

Own Id: OTP-15431

Correct solution for retaining tcp flow control OTP-15802 (ERL-934) as to not break ssl:recv as reported in (ERL-938)

Own Id: OTP-15823 Aux Id: ERL-934, ERL-938

Enhance dialyzer specs to reflect implementation better and avoid dialyzer warnings for the user that wants to use TLS with unix domain sockets.

Own Id: OTP-15851 Aux Id: PR-2235

Add support for ECDSA signature algorithms in TLS 1.3.

Own Id: OTP-15854

Correct error handling of TLS downgrade, possible return values form ssl:close/2 when downgrading is {ok, Port} or {error, Reason}, it could happen that only ok was returned instead of {error, closed} when downgrade failed due to that the peer closed the TCP connection.

Own Id: OTP-16027

SSL 9.3.5

Improvements and New Features

Enhance error handling for erroneous alerts from the peer.

Own Id: OTP-15943

SSL 9.3.4

Fixed Bugs and Malfunctions

Fix handling of certificate decoding problems in TLS 1.3 similarly as in TLS 1.2.

Own Id: OTP-15900

Hibernation now works as expected in all cases, was accidentally broken by optimization efforts.

Own Id: OTP-15910

Fix interoperability problems with openssl when the TLS 1.3 server is configured with the option signature_algs_cert.

Own Id: OTP-15913

SSL 9.3.3

Fixed Bugs and Malfunctions

Correct handshake handling, might cause strange symptoms such as ASN.1 certificate decoding issues.

Own Id: OTP-15879 Aux Id: ERL-968

Fix handling of the signature_algorithms_cert extension in the ClientHello handshake message.

Own Id: OTP-15887 Aux Id: ERL-973

Handle new ClientHello extensions when handshake is paused by the {handshake, hello} ssl option.

Own Id: OTP-15888 Aux Id: ERL-975

SSL 9.3.2

Fixed Bugs and Malfunctions

Returned "alert error string" is now same as logged alert string

Own Id: OTP-15844

Fix returned extension map fields to follow the documentation.

Own Id: OTP-15862 Aux Id: ERL-951

Avoid DTLS crash due to missing gen_server return value in DTLS packet demux process.

Own Id: OTP-15864 Aux Id: ERL-962

SSL 9.3.1

Fixed Bugs and Malfunctions

Missing check of size of user_data_buffer made internal socket behave as an active socket instead of active N. This could cause memory problems.

Own Id: OTP-15825 Aux Id: ERL-934, OTP-15823

SSL 9.3

Fixed Bugs and Malfunctions

The distribution handshake with TLS distribution (inet_tls_dist) does now utilize the socket option {nodelay, true}, which decreases the distribution setup time significantly.

Own Id: OTP-14792

Correct shutdown reason to avoid an incorrect crash report

Own Id: OTP-15710 Aux Id: ERL-893

Enhance documentation and type specifications.

Own Id: OTP-15746 Aux Id: ERIERL-333

Improvements and New Features

TLS-1.0, TLS-1.1 and DTLS-1.0 are now considered legacy and not supported by default

* POTENTIAL INCOMPATIBILITY *

Own Id: OTP-14865

Use new logger API in ssl. Introduce log levels and verbose debug logging for SSL.

Own Id: OTP-15055

Add new API function str_to_suite/1, cipher_suites/3 (list cipher suites as rfc or OpenSSL name strings) and suite_to_openssl_str/1

Own Id: OTP-15483 Aux Id: ERL-924

Basic support for TLS 1.3 Server for experimental use. The client is not yet functional, for more information see the Standards Compliance chapter of the User's Guide.

Own Id: OTP-15591

Add support for PSK CCM ciphers from RFC 6655

Own Id: OTP-15626

SSL 9.2.3.7

Fixed Bugs and Malfunctions

Data deliver with ssl:recv/2,3 could fail for when using packet mode. This has been fixed by correcting the flow control handling of passive sockets when packet mode is used.

Own Id: OTP-16764

SSL 9.2.3.6

Fixed Bugs and Malfunctions

Fix timing bug that could cause ssl sockets to become unresponsive after an ssl:recv/3 call timed out

Own Id: OTP-16619 Aux Id: ERL-1213

SSL 9.2.3.5

Fixed Bugs and Malfunctions

Handling of zero size fragments in TLS could cause an infinite loop. This has now been corrected.

Own Id: OTP-15328 Aux Id: ERIERL-379

SSL 9.2.3.4

Fixed Bugs and Malfunctions

Hibernation now works as expected in all cases, was accidentally broken by optimization efforts.

Own Id: OTP-15910

SSL 9.2.3.3

Fixed Bugs and Malfunctions

Correct handshake handling, might cause strange symptoms such as ASN.1 certificate decoding issues.

Own Id: OTP-15879 Aux Id: ERL-968

SSL 9.2.3.2

Fixed Bugs and Malfunctions

Returned "alert error string" is now same as logged alert string

Own Id: OTP-15844

SSL 9.2.3.1

Fixed Bugs and Malfunctions

Correct solution for retaining tcp flow control OTP-15802 (ERL-934) as to not break ssl:recv as reported in (ERL-938)

Own Id: OTP-15823 Aux Id: ERL-934, ERL-938

SSL 9.2.3

Fixed Bugs and Malfunctions

Missing check of size of user_data_buffer made internal socket behave as an active socket instead of active N. This could cause memory problems.

Own Id: OTP-15802 Aux Id: ERL-934

Improvements and New Features

Back port of bug fix ERL-893 from OTP-22 and document enhancements that will solve dialyzer warnings for users of the ssl application.

This change also affects public_key, eldap (and inet doc).

Own Id: OTP-15785 Aux Id: ERL-929, ERL-893, PR-2215

SSL 9.2.2

Fixed Bugs and Malfunctions

With the default BEAST Mitigation strategy for TLS 1.0 an empty TLS fragment could be sent after a one-byte fragment. This glitch has been fixed.

Own Id: OTP-15054 Aux Id: ERIERL-346

SSL 9.2.1

Fixed Bugs and Malfunctions

The timeout for a passive receive was sometimes not cancelled and later caused a server crash. This bug has now been corrected.

Own Id: OTP-14701 Aux Id: ERL-883, ERL-884

Add tag for passive message (active N) in cb_info to retain transport transparency.

Own Id: OTP-15679 Aux Id: ERL-861

SSL 9.2

Fixed Bugs and Malfunctions

Fix bug that an incorrect return value for gen_statem could be created when alert was a result of handling renegotiation info extension

Own Id: OTP-15502

Correct check for 3des_ede_cbc, could cause ssl to claim to support 3des_ede_cbc when cryptolib does not.

Own Id: OTP-15539

Improved DTLS error handling, avoids unexpected connection failure in rare cases.

Own Id: OTP-15561

Corrected active once emulation bug that could cause the ssl_closed meassage to not be sent. Bug introduced by OTP-15449

Own Id: OTP-15666 Aux Id: ERIERL-316,

Improvements and New Features

Add client option {reuse_session, SessionID::binary()} that can be used together with new option value {reuse_sessions, save}. This makes it possible to reuse a session from a specific connection establishment.

Own Id: OTP-15369

The Reason part of of the error return from the functions connect and handshake has a better and documented format. This will sometimes differ from previous returned reasons, however those where only documented as term() and should for that reason not be relied on.

* POTENTIAL INCOMPATIBILITY *

Own Id: OTP-15423

Refactor of state handling to improve TLS application data throughput and reduce CPU overhead

Own Id: OTP-15445

The SSL code has been optimized in many small ways to reduce CPU load for encryption/decryption, especially for Erlang's distribution protocol over TLS.

Own Id: OTP-15529

Add support for active N

Own Id: OTP-15665 Aux Id: ERL-811, PR-2072

SSL 9.1.2

Fixed Bugs and Malfunctions

Fix encoding of the SRP extension length field in ssl. The old encoding of the SRP extension length could cause interoperability problems with third party SSL implementations when SRP was used.

Own Id: OTP-15477 Aux Id: ERL-790

Guarantee active once data delivery, handling TCP stream properly.

Own Id: OTP-15504 Aux Id: ERL-371

Correct gen_statem returns for some error cases

Own Id: OTP-15505

SSL 9.1.1

Fixed Bugs and Malfunctions

Fixed renegotiation bug. Client did not handle server initiated renegotiation correctly after rewrite to two connection processes, due to ERL-622 commit d87ac1c55188f5ba5cdf72384125d94d42118c18. This could manifest it self as a " bad_record_mac" alert.

Also included are some optimizations

Own Id: OTP-15489 Aux Id: ERL-308

SSL 9.1

Fixed Bugs and Malfunctions

PEM cache was not evicting expired entries due to due to timezone confusion.

Own Id: OTP-15368

Make sure an error is returned if a "transport_accept socket" is used in some other call than ssl:handshake* or ssl:controlling_process

Own Id: OTP-15384 Aux Id: ERL-756

Fix timestamp handling in the PEM-cache could cause entries to not be invalidated at the correct time.

Own Id: OTP-15402

Extend check for undelivered data at closing, could under some circumstances fail to deliver all data that was actually received.

Own Id: OTP-15412 Aux Id: ERL-731

Correct signature check for TLS-1.2 that allows different algorithms for signature of peer cert and peer cert key. Not all allowed combinations where accepted.

Own Id: OTP-15415 Aux Id: ERL-763

Correct gen_statem return value, could cause renegotiation to fail.

Own Id: OTP-15418 Aux Id: ERL-770

Improvements and New Features

Add engine support for RSA key exchange

Own Id: OTP-15420 Aux Id: ERIERL-268

ssl now uses active n internally to boost performance. Old active once behavior can be restored by setting application variable see manual page for ssl application (man 6).

* POTENTIAL INCOMPATIBILITY *

Own Id: OTP-15449

SSL 9.0.3

Fixed Bugs and Malfunctions

Correct alert handling with new TLS sender process, from ssl-9.0.2. CLOSE ALERTS could under some circumstances be encoded using an incorrect cipher state. This would cause the peer to regard them as unknown messages.

Own Id: OTP-15337 Aux Id: ERL-738

Correct handling of socket packet option with new TLS sender process, from ssl-9.0.2. When changing the socket option {packet, 1|2|3|4} with ssl:setopts/2 the option must internally be propagated to the sender process as well as the reader process as this particular option also affects the data to be sent.

Own Id: OTP-15348 Aux Id: ERL-747

SSL 9.0.2

Fixed Bugs and Malfunctions

Use separate processes for sending and receiving application data for TLS connections to avoid potential deadlock that was most likely to occur when using TLS for Erlang distribution. Note does not change the API.

Own Id: OTP-15122

Correct handling of empty server SNI extension

Own Id: OTP-15168

Correct PSK cipher suite handling and add selected_cipher_suite to connection information

Own Id: OTP-15172

Adopt to the fact that cipher suite sign restriction are relaxed in TLS-1.2

Own Id: OTP-15173

Enhance error handling of non existing PEM files

Own Id: OTP-15174

Correct close handling of transport accepted sockets in the error state

Own Id: OTP-15216

Correct PEM cache to not add references to empty entries when PEM file does not exist.

Own Id: OTP-15224

Correct handling of all PSK cipher suites

Before only some PSK suites would be correctly negotiated and most PSK ciphers suites would fail the connection.

Own Id: OTP-15285

Improvements and New Features

TLS will now try to order certificate chains if they appear to be unordered. That is prior to TLS 1.3, “certificate_list” ordering was required to be strict, however some implementations already allowed for some flexibility. For maximum compatibility, all implementations SHOULD be prepared to handle potentially extraneous certificates and arbitrary orderings from any TLS version.

Own Id: OTP-12983

TLS will now try to reconstructed an incomplete certificate chains from its local CA-database and use that data for the certificate path validation. This especially makes sense for partial chains as then the peer might not send an intermediate CA as it is considered the trusted root in that case.

Own Id: OTP-15060

Option keyfile defaults to certfile and should be trumped with key. This failed for engine keys.

Own Id: OTP-15193

Error message improvement when own certificate has decoding issues, see also issue ERL-668.

Own Id: OTP-15234

Correct dialyzer spec for key option

Own Id: OTP-15281

SSL 9.0.1

Fixed Bugs and Malfunctions

Correct cipher suite handling for ECDHE_*, the incorrect handling could cause an incorrrect suite to be selected and most likely fail the handshake.

Own Id: OTP-15203

SSL 9.0

Fixed Bugs and Malfunctions

Correct handling of ECDH suites.

Own Id: OTP-14974

Proper handling of clients that choose to send an empty answer to a certificate request

Own Id: OTP-15050

Improvements and New Features

Distribution over SSL (inet_tls) has, to improve performance, been rewritten to not use intermediate processes and ports.

Own Id: OTP-14465

Add support for ECDHE_PSK cipher suites

Own Id: OTP-14547

For security reasons no longer support 3-DES cipher suites by default

* INCOMPATIBILITY with possibly *

Own Id: OTP-14768

For security reasons RSA-key exchange cipher suites are no longer supported by default

* INCOMPATIBILITY with possible *

Own Id: OTP-14769

The interoperability option to fallback to insecure renegotiation now has to be explicitly turned on.

* INCOMPATIBILITY with possibly *

Own Id: OTP-14789

Drop support for SSLv2 enabled clients. SSLv2 has been broken for decades and never supported by the Erlang SSL/TLS implementation. This option was by default disabled and enabling it has proved to sometimes break connections not using SSLv2 enabled clients.

* POTENTIAL INCOMPATIBILITY *

Own Id: OTP-14824

Remove CHACHA20_POLY1305 ciphers form default for now. We have discovered interoperability problems, ERL-538, that we believe needs to be solved in crypto.

* INCOMPATIBILITY with possibly *

Own Id: OTP-14882

Generalize DTLS packet multiplexing to make it easier to add future DTLS features and uses.

Own Id: OTP-14888

Use uri_string module instead of http_uri.

Own Id: OTP-14902

The SSL distribution protocol -proto inet_tls has stopped setting the SSL option server_name_indication. New verify funs for client and server in inet_tls_dist has been added, not documented yet, that checks node name if present in peer certificate. Usage is still also yet to be documented.

Own Id: OTP-14969 Aux Id: OTP-14465, ERL-598

Deprecate ssl:ssl_accept/[1,2,3] in favour of ssl:handshake/[1,2,3]

Own Id: OTP-15056

Customizes the hostname verification of the peer certificate, as different protocols that use TLS such as HTTP or LDAP may want to do it differently

Own Id: OTP-15102 Aux Id: ERL-542, OTP-14962

Add utility function for converting erlang cipher suites to a string representation (ERL-600).

Own Id: OTP-15106

First version with support for DTLS

Own Id: OTP-15142

SSL 8.2.6.4

Fixed Bugs and Malfunctions

Add engine support for RSA key exchange

Own Id: OTP-15420

SSL 8.2.6.3

Fixed Bugs and Malfunctions

Extend check for undelivered data at closing, could under some circumstances fail to deliverd all data that was acctualy recivied.

Own Id: OTP-15412

SSL 8.2.6.2

Fixed Bugs and Malfunctions

Correct handling of empty server SNI extension

Own Id: OTP-15168

Correct cipher suite handling for ECDHE_*, the incorrect handling could cause an incorrrect suite to be selected and most likely fail the handshake.

Own Id: OTP-15203

SSL 8.2.6.1

Fixed Bugs and Malfunctions

Improve cipher suite handling correcting ECC and TLS-1.2 requierments. Backport of solution for ERL-641

Own Id: OTP-15178

Improvements and New Features

Option keyfile defaults to certfile and should be trumped with key. This failed for engine keys.

Own Id: OTP-15193

SSL 8.2.6

Fixed Bugs and Malfunctions

Proper handling of clients that choose to send an empty answer to a certificate request

Own Id: OTP-15050

SSL 8.2.5

Fixed Bugs and Malfunctions

Fix filter function to not incorrectly exclude AEAD cipher suites

Own Id: OTP-14981

SSL 8.2.4

Fixed Bugs and Malfunctions

Optimization of bad merge conflict resolution causing dubble decode

Own Id: OTP-14843

Restore error propagation to OTP-19.3 behaviour, in OTP-20.2 implementation adjustments to gen_statem needed some further adjustments to avoid a race condition. This could cause a TLS server to not always report file path errors correctly.

Own Id: OTP-14852

Corrected RC4 suites listing function to regard TLS version

Own Id: OTP-14871

Fix alert handling so that unexpected messages are logged and alerted correctly

Own Id: OTP-14919

Correct handling of anonymous cipher suites

Own Id: OTP-14952

Improvements and New Features

Added new API functions to facilitate cipher suite handling

Own Id: OTP-14760

Correct TLS_FALLBACK_SCSV handling so that this special flag suite is always placed last in the cipher suite list in accordance with the specs. Also make sure this functionality is used in DTLS.

Own Id: OTP-14828

Add TLS record version sanity check for early as possible error detection and consistency in ALERT codes generated

Own Id: OTP-14892

SSL 8.2.3

Fixed Bugs and Malfunctions

Packet options cannot be supported for unreliable transports, that is, packet option for DTLS over udp will not be supported.

Own Id: OTP-14664

Ensure data delivery before close if possible. This fix is related to fix in PR-1479.

Own Id: OTP-14794

Improvements and New Features

The crypto API is extended to use private/public keys stored in an Engine for sign/verify or encrypt/decrypt operations.

The ssl application provides an API to use this new engine concept in TLS.

Own Id: OTP-14448

Implemented renegotiation for DTLS

Own Id: OTP-14563

A new command line option -ssl_dist_optfile has been added to facilitate specifying the many options needed when using SSL as the distribution protocol.

Own Id: OTP-14657

SSL 8.2.2

Fixed Bugs and Malfunctions

TLS sessions must be registered with SNI if provided, so that sessions where client hostname verification would fail cannot connect reusing a session created when the server name verification succeeded.

Own Id: OTP-14632

An erlang TLS server configured with cipher suites using rsa key exchange, may be vulnerable to an Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) against RSA, which when exploited, may result in plaintext recovery of encrypted messages and/or a Man-in-the-middle (MiTM) attack, despite the attacker not having gained access to the server’s private key itself. CVE-2017-1000385

Exploiting this vulnerability to perform plaintext recovery of encrypted messages will, in most practical cases, allow an attacker to read the plaintext only after the session has completed. Only TLS sessions established using RSA key exchange are vulnerable to this attack.

Exploiting this vulnerability to conduct a MiTM attack requires the attacker to complete the initial attack, which may require thousands of server requests, during the handshake phase of the targeted session within the window of the configured handshake timeout. This attack may be conducted against any TLS session using RSA signatures, but only if cipher suites using RSA key exchange are also enabled on the server. The limited window of opportunity, limitations in bandwidth, and latency make this attack significantly more difficult to execute.

RSA key exchange is enabled by default although least prioritized if server order is honored. For such a cipher suite to be chosen it must also be supported by the client and probably the only shared cipher suite.

Captured TLS sessions encrypted with ephemeral cipher suites (DHE or ECDHE) are not at risk for subsequent decryption due to this vulnerability.

As a workaround if default cipher suite configuration was used you can configure the server to not use vulnerable suites with the ciphers option like this:

{ciphers, [Suite || Suite <- ssl:cipher_suites(), element(1,Suite) =/= rsa]}

that is your code will look somethingh like this:

ssl:listen(Port, [{ciphers, [Suite || Suite <- ssl:cipher_suites(), element(1,S) =/= rsa]} | Options]).

Thanks to Hanno Böck, Juraj Somorovsky and Craig Young for reporting this vulnerability.

Own Id: OTP-14748

Improvements and New Features

If no SNI is available and the hostname is an IP-address also check for IP-address match. This check is not as good as a DNS hostname check and certificates using IP-address are not recommended.

Own Id: OTP-14655

SSL 8.2.1

Fixed Bugs and Malfunctions

Max session table works correctly again

Own Id: OTP-14556

Improvements and New Features

Customize alert handling for DTLS over UDP to mitigate DoS attacks

Own Id: OTP-14078

Improved error propagation and reports

Own Id: OTP-14236

SSL 8.2

Fixed Bugs and Malfunctions

ECDH-ECDSA key exchange supported, was accidentally dismissed in earlier versions.

Own Id: OTP-14421

Correct close semantics for active once connections. This was a timing dependent bug the resulted in the close message not always reaching the ssl user process.

Own Id: OTP-14443

Improvements and New Features

TLS-1.2 clients will now always send hello messages on its own format, as opposed to earlier versions that will send the hello on the lowest supported version, this is a change supported by the latest RFC.

This will make interoperability with some newer servers smoother. Potentially, but unlikely, this could cause a problem with older servers if they do not adhere to the RFC and ignore unknown extensions.

* POTENTIAL INCOMPATIBILITY *

Own Id: OTP-13820

Allow Erlang/OTP to use OpenSSL in FIPS-140 mode, in order to satisfy specific security requirements (mostly by different parts of the US federal government).

See the new crypto users guide "FIPS mode" chapter about building and using the FIPS support which is disabled by default.

(Thanks to dszoboszlay and legoscia)

Own Id: OTP-13921 Aux Id: PR-1180

Implemented DTLS cookie generation, required by spec, instead of using a hardcoded value.

Own Id: OTP-14076

Implement sliding window replay protection of DTLS records.

Own Id: OTP-14077

TLS client processes will by default call public_key:pkix_verify_hostname/2 to verify the hostname of the connection with the server certificates specified hostname during certificate path validation. The user may explicitly disables it. Also if the hostname cannot be derived from the first argument to connect or is not supplied by the server name indication option, the check will not be performed.

Own Id: OTP-14197

Extend connection_information/[1,2] . The values session_id, master_secret, client_random and server_random can no be accessed by connection_information/2. Note only session_id will be added to connection_information/1. The rational is that values concerning the connection security should have to be explicitly requested.

Own Id: OTP-14291

Chacha cipher suites are currently not tested enough to be most preferred ones

Own Id: OTP-14382

Basic support for DTLS that been tested together with OpenSSL.

Test by providing the option {protocol, dtls} to the ssl API functions connect and listen.

Own Id: OTP-14388

SSL 8.1.3.1.1

Fixed Bugs and Malfunctions

Fix alert handling so that unexpected messages are logged and alerted correctly

Own Id: OTP-14929

SSL 8.1.3.1

Fixed Bugs and Malfunctions

An erlang TLS server configured with cipher suites using rsa key exchange, may be vulnerable to an Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) against RSA, which when exploited, may result in plaintext recovery of encrypted messages and/or a Man-in-the-middle (MiTM) attack, despite the attacker not having gained access to the server’s private key itself. CVE-2017-1000385

Exploiting this vulnerability to perform plaintext recovery of encrypted messages will, in most practical cases, allow an attacker to read the plaintext only after the session has completed. Only TLS sessions established using RSA key exchange are vulnerable to this attack.

Exploiting this vulnerability to conduct a MiTM attack requires the attacker to complete the initial attack, which may require thousands of server requests, during the handshake phase of the targeted session within the window of the configured handshake timeout. This attack may be conducted against any TLS session using RSA signatures, but only if cipher suites using RSA key exchange are also enabled on the server. The limited window of opportunity, limitations in bandwidth, and latency make this attack significantly more difficult to execute.

RSA key exchange is enabled by default although least prioritized if server order is honored. For such a cipher suite to be chosen it must also be supported by the client and probably the only shared cipher suite.

Captured TLS sessions encrypted with ephemeral cipher suites (DHE or ECDHE) are not at risk for subsequent decryption due to this vulnerability.

As a workaround if default cipher suite configuration was used you can configure the server to not use vulnerable suites with the ciphers option like this:

{ciphers, [Suite || Suite <- ssl:cipher_suites(), element(1,Suite) =/= rsa]}

that is your code will look somethingh like this:

ssl:listen(Port, [{ciphers, [Suite || Suite <- ssl:cipher_suites(), element(1,S) =/= rsa]} | Options]).

Thanks to Hanno Böck, Juraj Somorovsky and Craig Young for reporting this vulnerability.

Own Id: OTP-14748

SSL 8.1.3

Fixed Bugs and Malfunctions

Remove debug printout

Own Id: OTP-14396

SSL 8.1.2

Fixed Bugs and Malfunctions

Correct active once emulation, for TLS. Now all data received by the connection process will be delivered through active once, even when the active once arrives after that the gen_tcp socket is closed by the peer.

Own Id: OTP-14300

SSL 8.1.1

Fixed Bugs and Malfunctions

Corrected termination behavior, that caused a PEM cache bug and sometimes resulted in connection failures.

Own Id: OTP-14100

Fix bug that could hang ssl connection processes when failing to require more data for very large handshake packages. Add option max_handshake_size to mitigate DoS attacks.

Own Id: OTP-14138

Improved support for CRL handling that could fail to work as intended when an id-ce-extKeyUsage was present in the certificate. Also improvements where needed to distributionpoint handling so that all revocations actually are found and not deemed to be not determinable.

Own Id: OTP-14141

A TLS handshake might accidentally match old sslv2 format and ssl application would incorrectly aborted TLS handshake with ssl_v2_client_hello_no_supported. Parsing was altered to avoid this problem.

Own Id: OTP-14222

Correct default cipher list to prefer AES 128 before 3DES

Own Id: OTP-14235

Improvements and New Features

Move PEM cache to a dedicated process, to avoid making the SSL manager process a bottleneck. This improves scalability of TLS connections.

Own Id: OTP-13874

SSL 8.1

Fixed Bugs and Malfunctions

List of possible anonymous suites, never supported by default, where incorrect for some TLS versions.

Own Id: OTP-13926

Improvements and New Features

Experimental version of DTLS. It is runnable but not complete and cannot be considered reliable for production usage.

Own Id: OTP-12982

Add API options to handle ECC curve selection.

Own Id: OTP-13959

SSL 8.0.3

Fixed Bugs and Malfunctions

A timing related bug in event handling could cause interoperability problems between an erlang TLS server and some TLS clients, especially noticed with Firefox as TLS client.

Own Id: OTP-13917

Correct ECC curve selection, the error could cause the default to always be selected.

Own Id: OTP-13918

SSL 8.0.2

Fixed Bugs and Malfunctions

Correctly formed handshake messages received out of order will now correctly fail the connection with unexpected message.

Own Id: OTP-13853

Correct handling of signature algorithm selection

Own Id: OTP-13711

Improvements and New Features

ssl application now behaves gracefully also on partially incorrect input from peer.

Own Id: OTP-13834

Add application environment configuration bypass_pem_cache. This can be used as a workaround for the current implementation of the PEM-cache that has proven to be a bottleneck.

Own Id: OTP-13883

SSL 8.0.1

Fixed Bugs and Malfunctions

The TLS/SSL protocol version selection for the SSL server has been corrected to follow RFC 5246 Appendix E.1 especially in case where the list of supported versions has gaps. Now the server selects the highest protocol version it supports that is not higher than what the client supports.

Own Id: OTP-13753 Aux Id: seq13150

SSL 8.0

Fixed Bugs and Malfunctions

Server now rejects, a not requested client cert, as an incorrect handshake message and ends the connection.

Own Id: OTP-13651

Improvements and New Features

Remove default support for DES cipher suites

* POTENTIAL INCOMPATIBILITY *

Own Id: OTP-13195

Deprecate the function crypto:rand_bytes and make sure that crypto:strong_rand_bytes is used in all places that are cryptographically significant.

Own Id: OTP-13214

Better error handling of user error during TLS upgrade. ERL-69 is solved by gen_statem rewrite of ssl application.

Own Id: OTP-13255

Provide user friendly error message when crypto rejects a key

Own Id: OTP-13256

Add ssl:getstat/1 and ssl:getstat/2

Own Id: OTP-13415

TLS distribution connections now allow specifying the options verify_fun, crl_check and crl_cache. See the documentation. GitHub pull req #956 contributed by Magnus Henoch.

Own Id: OTP-13429 Aux Id: Pull#956

Remove confusing error message when closing a distributed erlang node running over TLS

Own Id: OTP-13431

Remove default support for use of md5 in TLS 1.2 signature algorithms

Own Id: OTP-13463

ssl now uses gen_statem instead of gen_fsm to implement the ssl connection process, this solves some timing issues in addition to making the code more intuitive as the behaviour can be used cleanly instead of having a lot of workaround for shortcomings of the behaviour.

Own Id: OTP-13464

Phase out interoperability with clients that offer SSLv2. By default they are no longer supported, but an option to provide interoperability is offered.

* POTENTIAL INCOMPATIBILITY *

Own Id: OTP-13465

OpenSSL has functions to generate short (eight hex digits) hashes of issuers of certificates and CRLs. These hashes are used by the "c_rehash" script to populate directories of CA certificates and CRLs, e.g. in the Apache web server. Add functionality to let an Erlang program find the right CRL for a given certificate in such a directory.

Own Id: OTP-13530

Some legacy TLS 1.0 software does not tolerate the 1/n-1 content split BEAST mitigation technique. Add a beast_mitigation SSL option (defaulting to one_n_minus_one) to select or disable the BEAST mitigation technique.

Own Id: OTP-13629

Enhance error log messages to facilitate for users to understand the error

Own Id: OTP-13632

Increased default DH params to 2048-bit

Own Id: OTP-13636

Propagate CRL unknown CA error so that public_key validation process continues correctly and determines what should happen.

Own Id: OTP-13656

Introduce a flight concept for handshake packages. This is a preparation for enabling DTLS, however it can also have a positive effects for TLS on slow and unreliable networks.

Own Id: OTP-13678

SSL 7.3.3.2

Fixed Bugs and Malfunctions

An erlang TLS server configured with cipher suites using rsa key exchange, may be vulnerable to an Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) against RSA, which when exploited, may result in plaintext recovery of encrypted messages and/or a Man-in-the-middle (MiTM) attack, despite the attacker not having gained access to the server’s private key itself. CVE-2017-1000385

Exploiting this vulnerability to perform plaintext recovery of encrypted messages will, in most practical cases, allow an attacker to read the plaintext only after the session has completed. Only TLS sessions established using RSA key exchange are vulnerable to this attack.

Exploiting this vulnerability to conduct a MiTM attack requires the attacker to complete the initial attack, which may require thousands of server requests, during the handshake phase of the targeted session within the window of the configured handshake timeout. This attack may be conducted against any TLS session using RSA signatures, but only if cipher suites using RSA key exchange are also enabled on the server. The limited window of opportunity, limitations in bandwidth, and latency make this attack significantly more difficult to execute.

RSA key exchange is enabled by default although least prioritized if server order is honored. For such a cipher suite to be chosen it must also be supported by the client and probably the only shared cipher suite.

Captured TLS sessions encrypted with ephemeral cipher suites (DHE or ECDHE) are not at risk for subsequent decryption due to this vulnerability.

As a workaround if default cipher suite configuration was used you can configure the server to not use vulnerable suites with the ciphers option like this:

{ciphers, [Suite || Suite <- ssl:cipher_suites(), element(1,Suite) =/= rsa]}

that is your code will look somethingh like this:

ssl:listen(Port, [{ciphers, [Suite || Suite <- ssl:cipher_suites(), element(1,S) =/= rsa]} | Options]).

Thanks to Hanno Böck, Juraj Somorovsky and Craig Young for reporting this vulnerability.

Own Id: OTP-14748

SSL 7.3.3

Fixed Bugs and Malfunctions

Correct ssl:prf/5 to use the negotiated cipher suite's prf function in ssl:prf/5 instead of the default prf.

Own Id: OTP-13546

Timeouts may have the value 0, guards have been corrected to allow this

Own Id: OTP-13635

Change of internal handling of hash sign pairs as the used one enforced to much restrictions making some valid combinations unavailable.

Own Id: OTP-13670

SSL 7.3.3.0.1

Fixed Bugs and Malfunctions

An erlang TLS server configured with cipher suites using rsa key exchange, may be vulnerable to an Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) against RSA, which when exploited, may result in plaintext recovery of encrypted messages and/or a Man-in-the-middle (MiTM) attack, despite the attacker not having gained access to the server’s private key itself. CVE-2017-1000385

Exploiting this vulnerability to perform plaintext recovery of encrypted messages will, in most practical cases, allow an attacker to read the plaintext only after the session has completed. Only TLS sessions established using RSA key exchange are vulnerable to this attack.

Exploiting this vulnerability to conduct a MiTM attack requires the attacker to complete the initial attack, which may require thousands of server requests, during the handshake phase of the targeted session within the window of the configured handshake timeout. This attack may be conducted against any TLS session using RSA signatures, but only if cipher suites using RSA key exchange are also enabled on the server. The limited window of opportunity, limitations in bandwidth, and latency make this attack significantly more difficult to execute.

RSA key exchange is enabled by default although least prioritized if server order is honored. For such a cipher suite to be chosen it must also be supported by the client and probably the only shared cipher suite.

Captured TLS sessions encrypted with ephemeral cipher suites (DHE or ECDHE) are not at risk for subsequent decryption due to this vulnerability.

As a workaround if default cipher suite configuration was used you can configure the server to not use vulnerable suites with the ciphers option like this:

{ciphers, [Suite || Suite <- ssl:cipher_suites(), element(1,Suite) =/= rsa]}

that is your code will look somethingh like this:

ssl:listen(Port, [{ciphers, [Suite || Suite <- ssl:cipher_suites(), element(1,S) =/= rsa]} | Options]).

Thanks to Hanno Böck, Juraj Somorovsky and Craig Young for reporting this vulnerability.

Own Id: OTP-14748

Improvements and New Features

Create a little randomness in sending of session invalidation messages, to mitigate load when whole table is invalidated.

Own Id: OTP-13490

SSL 7.3.2

Fixed Bugs and Malfunctions

Correct cipher suites conversion and guard expression. Caused problems with GCM cipher suites and client side option to set signature_algorithms extension values.

Own Id: OTP-13525

SSL 7.3.1

Fixed Bugs and Malfunctions

Corrections to cipher suite handling using the 3 and 4 tuple format in addition to commit 89d7e21cf4ae988c57c8ef047bfe85127875c70c

Own Id: OTP-13511

Improvements and New Features

Make values for the TLS-1.2 signature_algorithms extension configurable

Own Id: OTP-13261

SSL 7.3

Fixed Bugs and Malfunctions

Make sure there is only one poller validator at a time for validating the session cache.

Own Id: OTP-13185

A timing related issue could cause ssl to hang, especially happened with newer versions of OpenSSL in combination with ECC ciphers.

Own Id: OTP-13253

Work around a race condition in the TLS distribution start.

Own Id: OTP-13268

Big handshake messages are now correctly fragmented in the TLS record layer.

Own Id: OTP-13306

Improve portability of ECC tests in Crypto and SSL for "exotic" OpenSSL versions.

Own Id: OTP-13311

Certificate extensions marked as critical are ignored when using verify_none

Own Id: OTP-13377

If a certificate doesn't contain a CRL Distribution Points extension, and the relevant CRL is not in the cache, and the crl_check option is not set to best_effort , the revocation check should fail.

Own Id: OTP-13378

Enable TLS distribution over IPv6

Own Id: OTP-13391

Improvements and New Features

Improve error reporting for TLS distribution

Own Id: OTP-13219

Include options from connect, listen and accept in connection_information/1,2

Own Id: OTP-13232

Allow adding extra options for outgoing TLS distribution connections, as supported for plain TCP connections.

Own Id: OTP-13285

Use loopback as server option in TLS-distribution module

Own Id: OTP-13300

Verify certificate signature against original certificate binary.

This avoids bugs due to encoding errors when re-encoding a decode certificate. As there exists several decode step and using of different ASN.1 specification this is a risk worth avoiding.

Own Id: OTP-13334

Use application:ensure_all_started/2 instead of hard-coding dependencies

Own Id: OTP-13363

SSL 7.2

Fixed Bugs and Malfunctions

Honor distribution port range options

Own Id: OTP-12838

Correct supervisor specification in TLS distribution.

Own Id: OTP-13134

Correct cache timeout

Own Id: OTP-13141

Avoid crash and restart of ssl process when key file does not exist.

Own Id: OTP-13144

Enable passing of raw socket options on the format {raw,,,_} to the underlying socket.

Own Id: OTP-13166

Hibernation with small or a zero timeout will now work as expected

Own Id: OTP-13189

Improvements and New Features

Add upper limit for session cache, configurable on ssl application level.

If upper limit is reached, invalidate the current cache entries, e.i the session lifetime is the max time a session will be kept, but it may be invalidated earlier if the max limit for the table is reached. This will keep the ssl manager process well behaved, not exhusting memory. Invalidating the entries will incrementally empty the cache to make room for fresh sessions entries.

Own Id: OTP-12392

Use new time functions to measure passed time.

Own Id: OTP-12457

Improved error handling in TLS distribution

Own Id: OTP-13142

Distribution over TLS now honors the nodelay distribution flag

Own Id: OTP-13143

SSL 7.1

Fixed Bugs and Malfunctions

Add DER encoded ECPrivateKey as valid input format for key option.

Own Id: OTP-12974

Correct return value of default session callback module

This error had the symptom that the client check for unique session would always fail, potentially making the client session table grow a lot and causing long setup times.

Own Id: OTP-12980

Improvements and New Features

Add possibility to downgrade an SSL/TLS connection to a tcp connection, and give back the socket control to a user process.

This also adds the possibility to specify a timeout to the ssl:close function.

Own Id: OTP-11397

Add application setting to be able to change fatal alert shutdown timeout, also shorten the default timeout. The fatal alert timeout is the number of milliseconds between sending of a fatal alert and closing the connection. Waiting a little while improves the peers chances to properly receiving the alert so it may shutdown gracefully.

Own Id: OTP-12832

SSL 7.0

Fixed Bugs and Malfunctions

Ignore signature_algorithm (TLS 1.2 extension) sent to TLS 1.0 or TLS 1.1 server

Own Id: OTP-12670

Improve error handling in TLS distribution module to avoid lingering sockets.

Own Id: OTP-12799 Aux Id: Tom Briden

Add option {client_renegotiation, boolean()} option to the server-side of the SSL application.

Own Id: OTP-12815

Improvements and New Features

Add new API functions to handle CRL-verification

Own Id: OTP-10362 Aux Id: kunagi-215 [126]

Remove default support for SSL-3.0, due to Poodle vunrability in protocol specification.

Add padding check for TLS-1.0 to remove Poodle vunrability from TLS 1.0, also add the option padding_check. This option only affects TLS-1.0 connections and if set to false it disables the block cipher padding check to be able to interoperate with legacy software.

Remove default support for RC4 cipher suites, as they are consider too weak.

* POTENTIAL INCOMPATIBILITY *

Own Id: OTP-12390

Add support for TLS ALPN (Application-Layer Protocol Negotiation) extension.

Own Id: OTP-12580

Add SNI (Server Name Indication) support for the server side.

Own Id: OTP-12736

SSL 6.0.1.1

Fixed Bugs and Malfunctions

Gracefully ignore proprietary hash_sign algorithms

Own Id: OTP-12829

SSL 6.0.1

Fixed Bugs and Malfunctions

Terminate gracefully when receiving bad input to premaster secret calculation

Own Id: OTP-12783

SSL 6.0

Fixed Bugs and Malfunctions

Exclude self-signed trusted anchor certificates from certificate prospective certification path according to RFC 3280.

This will avoid some unnecessary certificate processing.

Own Id: OTP-12449

Improvements and New Features

Separate client and server session cache internally.

Avoid session table growth when client starts many connections in such a manner that many connections are started before session reuse is possible. Only save a new session in client if there is no equivalent session already stored.

Own Id: OTP-11365

The PEM cache is now validated by a background process, instead of always keeping it if it is small enough and clearing it otherwise. That strategy required that small caches where cleared by API function if a file changes on disk.

However export the API function to clear the cache as it may still be useful.

Own Id: OTP-12391

Add padding check for TLS-1.0 to remove Poodle vulnerability from TLS 1.0, also add the option padding_check. This option only affects TLS-1.0 connections and if set to false it disables the block cipher padding check to be able to interoperate with legacy software.

* POTENTIAL INCOMPATIBILITY *

Own Id: OTP-12420

Add support for TLS_FALLBACK_SCSV used to prevent undesired TLS version downgrades. If used by a client that is vulnerable to the POODLE attack, and the server also supports TLS_FALLBACK_SCSV, the attack can be prevented.

Own Id: OTP-12458

SSL 5.3.8

Fixed Bugs and Malfunctions

Make sure the clean rule for ssh, ssl, eunit and otp_mibs actually removes generated files.

Own Id: OTP-12200

Improvements and New Features

Change code to reflect that state data may be secret to avoid breaking dialyzer contracts.

Own Id: OTP-12341

SSL 5.3.7

Fixed Bugs and Malfunctions

Handle the fact that servers may send an empty SNI extension to the client.

Own Id: OTP-12198

SSL 5.3.6

Fixed Bugs and Malfunctions

Corrected handling of ECC certificates, there where several small issues with the handling of such certificates in the ssl and public_key application. Now ECC signed ECC certificates shall work and not only RSA signed ECC certificates.

Own Id: OTP-12026

Check that the certificate chain ends with a trusted ROOT CA e.i. a self-signed certificate, but provide an option partial_chain to enable the application to define an intermediat CA as trusted.

Own Id: OTP-12149

Improvements and New Features

Add decode functions for SNI (Server Name Indication)

Own Id: OTP-12048

SSL 5.3.5

Fixed Bugs and Malfunctions

ssl:recv now returns {error, einval} if applied to a non passive socket, the same as gen_tcp:recv.

Thanks to Danil Zagoskin for reporting this issue

Own Id: OTP-11878

Corrected handling of default values for signature_algorithms extension in TLS-1.2 and corresponding values used in previous versions that does not support this extension.

Thanks to Danil Zagoskin

Own Id: OTP-11886

Handle socket option inheritance when pooling of accept sockets is used

Own Id: OTP-11897

Make sure that the list of versions, possibly supplied in the versions option, is not order dependent.

Thanks to Ransom Richardson for reporting this issue

Own Id: OTP-11912

Reject connection if the next_protocol message is sent twice.

Own Id: OTP-11926

Correct options handling when ssl:ssl_accept/3 is called with new ssl options after calling ssl:listen/2

Own Id: OTP-11950

Improvements and New Features

Gracefully handle unknown alerts

Thanks to Atul Atri for reporting this issue

Own Id: OTP-11874

Gracefully ignore cipher suites sent by client not supported by the SSL/TLS version that the client has negotiated.

Thanks to Danil Zagoskin for reporting this issue

Own Id: OTP-11875

Gracefully handle structured garbage, i.e a client sends some garbage in a ssl record instead of a valid fragment.

Thanks to Danil Zagoskin

Own Id: OTP-11880

Gracefully handle invalid alerts

Own Id: OTP-11890

Generalize handling of default ciphers

Thanks to Andreas Schultz

Own Id: OTP-11966

Make sure change cipher spec is correctly handled

Own Id: OTP-11975

SSL 5.3.4

Fixed Bugs and Malfunctions

Fix incorrect dialyzer spec and types, also enhance documentation.

Thanks to Ayaz Tuncer.

Own Id: OTP-11627

Fix possible mismatch between SSL/TLS version and default ciphers. Could happen when you specified SSL/TLS-version in optionlist to listen or accept.

Own Id: OTP-11712

Application upgrade (appup) files are corrected for the following applications:

asn1, common_test, compiler, crypto, debugger, dialyzer, edoc, eldap, erl_docgen, et, eunit, gs, hipe, inets, observer, odbc, os_mon, otp_mibs, parsetools, percept, public_key, reltool, runtime_tools, ssh, syntax_tools, test_server, tools, typer, webtool, wx, xmerl

A new test utility for testing appup files is added to test_server. This is now used by most applications in OTP.

(Thanks to Tobias Schlager)

Own Id: OTP-11744

Improvements and New Features

Moved elliptic curve definition from the crypto NIF/OpenSSL into Erlang code, adds the RFC-5639 brainpool curves and makes TLS use them (RFC-7027).

Thanks to Andreas Schultz

Own Id: OTP-11578

Unicode adaptations

Own Id: OTP-11620

Added option honor_cipher_order. This instructs the server to prefer its own cipher ordering rather than the client's and can help protect against things like BEAST while maintaining compatibility with clients which only support older ciphers.

Thanks to Andrew Thompson for the implementation, and Andreas Schultz for the test cases.

Own Id: OTP-11621

Replace boolean checking in validate_option with is_boolean guard.

Thanks to Andreas Schultz.

Own Id: OTP-11634

Some function specs are corrected or moved and some edoc comments are corrected in order to allow use of edoc. (Thanks to Pierre Fenoll)

Own Id: OTP-11702

Correct clean up of certificate database when certs are inputted in pure DER format.The incorrect code could cause a memory leek when certs where inputted in DER. Thanks to Bernard Duggan for reporting this.

Own Id: OTP-11733

Improved documentation of the cacertfile option

Own Id: OTP-11759 Aux Id: seq12535

Avoid next protocol negotiation failure due to incorrect option format.

Own Id: OTP-11760

Handle v1 CRLs, with no extensions and fixes issues with IDP (Issuing Distribution Point) comparison during CRL validation.

Thanks to Andrew Thompson

Own Id: OTP-11761

Server now ignores client ECC curves that it does not support instead of crashing.

Thanks to Danil Zagoskin for reporting the issue and suggesting a solution.

Own Id: OTP-11780

Handle SNI (Server Name Indication) alert unrecognized_name and gracefully deal with unexpected alerts.

Thanks to Masatake Daimon for reporting this.

Own Id: OTP-11815

Add possibility to specify ssl options when calling ssl:ssl_accept

Own Id: OTP-11837

SSL 5.3.3

Fixed Bugs and Malfunctions

Add missing validation of the server_name_indication option and test for its explicit use. It was not possible to set or disable the default server_name_indication as the validation of the option was missing.

Own Id: OTP-11567

Elliptic curve selection in server mode now properly selects a curve suggested by the client, if possible, and the fallback alternative is changed to a more widely supported curve.

Own Id: OTP-11575

Bug in the TLS hello extension handling caused the server to behave as it did not understand secure renegotiation.

Own Id: OTP-11595

SSL 5.3.2

Fixed Bugs and Malfunctions

Honors the clients advertised support of elliptic curves and no longer sends incorrect elliptic curve extension in server hello.

Own Id: OTP-11370

Fix initialization of DTLS fragment reassembler, in previously contributed code, for future support of DTLS . Thanks to Andreas Schultz.

Own Id: OTP-11376

Corrected type error in client_preferred_next_protocols documentation. Thanks to Julien Barbot.

Own Id: OTP-11457

Improvements and New Features

TLS code has been refactored to prepare for future DTLS support. Also some DTLS code is in place but not yet runnable, some of it contributed by Andreas Schultz and some of it written by the OTP team. Thanks to to Andreas for his participation.

Own Id: OTP-11292

Remove extraneous dev debug code left in the close function. Thanks to Ken Key.

Own Id: OTP-11447

Add SSL Server Name Indication (SNI) client support. Thanks to Julien Barbot.

Own Id: OTP-11460

SSL 5.3.1

Fixed Bugs and Malfunctions

Setopts during renegotiation caused the renegotiation to be unsuccessful.

If calling setopts during a renegotiation the FSM state might change during the handling of the setopts messages, this is now handled correctly.

Own Id: OTP-11228

Now handles signature_algorithm field in digitally_signed properly with proper defaults. Prior to this change some elliptic curve cipher suites could fail reporting the error "bad certificate".

Own Id: OTP-11229

The code emulating the inet header option was changed in the belief that it made it inet compatible. However the testing is a bit hairy as the inet option is actually broken, now the tests are corrected and the header option should work in the same broken way as inet again, preferably use the bitsyntax instead.

Own Id: OTP-11230

Improvements and New Features

Make the ssl manager name for erlang distribution over SSL/TLS relative to the module name of the ssl_manager.

This can be beneficial when making tools that rename modules for internal processing in the tool.

Own Id: OTP-11255

Add documentation regarding log_alert option.

Own Id: OTP-11271

SSL 5.3

Fixed Bugs and Malfunctions

Honor the versions option to ssl:connect and ssl:listen.

Own Id: OTP-10905

Next protocol negotiation with reused sessions will now succeed

Own Id: OTP-10909

Improvements and New Features

Add support for PSK (Pre Shared Key) and SRP (Secure Remote Password) cipher suites, thanks to Andreas Schultz.

Own Id: OTP-10450 Aux Id: kunagi-269 [180]

Fix SSL Next Protocol Negotiation documentation. Thanks to Julien Barbot.

Own Id: OTP-10955

Fix ssl_connection to support reading proxy/chain certificates. Thanks to Valentin Kuznetsov.

Own Id: OTP-10980

Integrate elliptic curve contribution from Andreas Schultz

In order to be able to support elliptic curve cipher suites in SSL/TLS, additions to handle elliptic curve infrastructure has been added to public_key and crypto.

This also has resulted in a rewrite of the crypto API to gain consistency and remove unnecessary overhead. All OTP applications using crypto has been updated to use the new API.

Impact: Elliptic curve cryptography (ECC) offers equivalent security with smaller key sizes than other public key algorithms. Smaller key sizes result in savings for power, memory, bandwidth, and computational cost that make ECC especially attractive for constrained environments.

Own Id: OTP-11009

SSL 5.2.1

Improvements and New Features

Transport callback handling is changed so that gen_tcp is treated as a special case where inet will be called directly for functions such as setopts, as gen_tcp does not have its own setopts. This will enable users to use the transport callback for other customizations such as websockets.

Own Id: OTP-10847

Follow up to OTP-10451 solved in ssl-5.2 R16A. Make sure format_error return good strings. Replace confusing legacy atoms with more descriptive atoms.

Own Id: OTP-10864

SSL 5.1.2.1

Improvements and New Features

Make log_alert configurable as option in ssl, SSLLogLevel added as option to inets conf file

Own Id: OTP-11259

SSL 5.2

Fixed Bugs and Malfunctions

SSL: TLS 1.2, advertise sha224 support, thanks to Andreas Schultz.

Own Id: OTP-10586

If an ssl server is restarted with new options and a client tries to reuse a session the server must make sure that it complies to the new options before agreeing to reuse it.

Own Id: OTP-10595

Now handles cleaning of CA-certificate database correctly so that there will be no memory leek, bug was introduced in ssl- 5.1 when changing implementation to increase parallel execution.

Impact: Improved memory usage, especially if you have many different certificates and upgrade tcp-connections to TLS-connections.

Own Id: OTP-10710

Improvements and New Features

Support Next Protocol Negotiation in TLS, thanks to Ben Murphy for the contribution.

Impact: Could give performance benefit if used as it saves a round trip.

Own Id: OTP-10361 Aux Id: kunagi-214 [125]

TLS 1.2 will now be the default TLS version if sufficient crypto support is available otherwise TLS 1.1 will be default.

Impact: A default TLS connection will have higher security and hence it may be perceived as slower then before.

Own Id: OTP-10425 Aux Id: kunagi-275 [186]

It is now possible to call controlling_process on a listen socket, same as in gen_tcp.

Own Id: OTP-10447

Remove filter mechanisms that made error messages backwards compatible with old ssl but hid information about what actually happened.

This does not break the documented API however other reason terms may be returned, so code that matches on the reason part of {error, Reason} may fail.

* POTENTIAL INCOMPATIBILITY *

Own Id: OTP-10451 Aux Id: kunagi-270 [181]

Added missing dependencies to Makefile

Own Id: OTP-10594

Removed deprecated function ssl:pid/0, it has been pointless since R14 but has been keep for backwards compatibility.

* POTENTIAL INCOMPATIBILITY *

Own Id: OTP-10613 Aux Id: kunagi-331 [242]

Refactor to simplify addition of key exchange methods, thanks to Andreas Schultz.

Own Id: OTP-10709

SSL 5.1.2

Fixed Bugs and Malfunctions

ssl:ssl_accept/2 timeout is no longer ignored

Own Id: OTP-10600

SSL 5.1.1

Fixed Bugs and Malfunctions

ssl:recv/3 could "loose" data when the timeout occurs. If the timeout in ssl:connect or ssl:ssl_accept expired the ssl connection process was not terminated as it should, this due to gen_fsm:send_all_state_event timeout is a client side time out. These timouts are now handled by the gen_fsm-procss instead.

Own Id: OTP-10569

Improvements and New Features

Better termination handling that avoids hanging.

Own Id: OTP-10574

SSL 5.1

Fixed Bugs and Malfunctions

Sometimes the client process could receive an extra {error, closed} message after ssl:recv had returned {error, closed}.

Own Id: OTP-10118

ssl v3 alert number 41 (no_certificate_RESERVED) is now recognized

Own Id: OTP-10196

Improvements and New Features

Experimental support for TLS 1.1 is now available, will be officially supported from OTP-R16. Thanks to Andreas Schultz for implementing the first version.

Own Id: OTP-8871

Experimental support for TLS 1.2 is now available, will be officially supported from OTP-R16. Thanks to Andreas Schultz for implementing the first version.

Own Id: OTP-8872

Removed some bottlenecks increasing the applications parallelism especially for the client side.

Own Id: OTP-10113

Workaround for handling certificates that wrongly encode X509countryname in utf-8 when the actual value is a valid ASCCI value of length 2. Such certificates are accepted by many browsers such as Chrome and Fierfox so for interoperability reasons we will too.

Own Id: OTP-10222

SSL 5.0.1

Fixed Bugs and Malfunctions

Robustness and improvement to distribution over SSL

Fix a bug where ssl_tls_dist_proxy would crash at caller timeout. Fix a bug where a timeout from the SSL layer would block the distribution indefinitely. Run the proxy exclusively on the loopback interface. (Thanks to Paul Guyot)

Own Id: OTP-9915

Fix setup loop of SSL TLS dist proxy

Fix potential leak of processes waiting indefinitely for data from closed sockets during socket setup phase. (Thanks to Paul Guyot)

Own Id: OTP-9916

Correct spelling of registered (Thanks to Richard Carlsson)

Own Id: OTP-9925

Added TLS PRF function to the SSL API for generation of additional key material from a TLS session. (Thanks to Andreas Schultz)

Own Id: OTP-10024

SSL 5.0

Fixed Bugs and Malfunctions

Invalidation handling of sessions could cause the time_stamp field in the session record to be set to undefined crashing the session clean up process. This did not affect the connections but would result in that the session table would grow.

Own Id: OTP-9696 Aux Id: seq11947

Changed code to use ets:foldl and throw instead of ets:next traversal, avoiding the need to explicitly call ets:safe_fixtable. It was possible to get a badarg-crash under special circumstances.

Own Id: OTP-9703 Aux Id: seq11947

Send ssl_closed notification to active ssl user when a tcp error occurs.

Own Id: OTP-9734 Aux Id: seq11946

If a passive receive was ongoing during a renegotiation the process evaluating ssl:recv could be left hanging for ever.

Own Id: OTP-9744

Improvements and New Features

Support for the old ssl implementation is dropped and the code is removed.

Own Id: OTP-7048

The erlang distribution can now be run over the new ssl implementation. All options can currently not be set but it is enough to replace to old ssl implementation.

Own Id: OTP-7053

public_key, ssl and crypto now supports PKCS-8

Own Id: OTP-9312

Implements a CBC timing attack counter measure. Thanks to Andreas Schultz for providing the patch.

Own Id: OTP-9683

Mitigates an SSL/TLS Computational DoS attack by disallowing the client to renegotiate many times in a row in a short time interval, thanks to Tuncer Ayaz for alerting us about this.

Own Id: OTP-9739

Implements the 1/n-1 splitting countermeasure to the Rizzo Duong BEAST attack, affects SSL 3.0 and TLS 1.0. Thanks to Tuncer Ayaz for alerting us about this.

Own Id: OTP-9750

SSL 4.1.6

Fixed Bugs and Malfunctions

replace "a ssl" with "an ssl" reindent pkix_path_validation/3 Trivial documentation fixes (Thanks to Christian von Roques )

Own Id: OTP-9464

Improvements and New Features

Adds function clause to avoid denial of service attack. Thanks to Vinod for reporting this vulnerability.

Own Id: OTP-9364

Error handling code now takes care of inet:getopts/2 and inets:setopts/2 crashes. Thanks to Richard Jones for reporting this.

Own Id: OTP-9382

Support explicit use of packet option httph and httph_bin

Own Id: OTP-9461

Decoding of hello extensions could fail to come to the correct conclusion due to an error in a binary match pattern. Thanks to Ben Murphy.

Own Id: OTP-9589

SSL 4.1.5

Improvements and New Features

Calling gen_tcp:connect with option {ip, {127,0,0,1}} results in an exit with reason badarg. Neither SSL nor INETS This was not caught, resulting in crashes with incomprehensible reasons.

Own Id: OTP-9289 Aux Id: seq11845

SSL 4.1.3

Fixed Bugs and Malfunctions

Fixed error in cache-handling fix from ssl-4.1.2

Own Id: OTP-9018 Aux Id: seq11739

Verification of a critical extended_key_usage-extension corrected

Own Id: OTP-9029 Aux Id: seq11541

SSL 4.1.2

Fixed Bugs and Malfunctions

The ssl application caches certificate files, it will now invalidate cache entries if the diskfile is changed.

Own Id: OTP-8965 Aux Id: seq11739

Now runs the terminate function before returning from the call made by ssl:close/1, as before the caller of ssl:close/1 could get problems with the reuseaddr option.

Own Id: OTP-8992

SSL 4.1.1

Fixed Bugs and Malfunctions

Correct handling of client certificate verify message When checking the client certificate verify message the server used the wrong algorithm identifier to determine the signing algorithm, causing a function clause error in the public_key application when the key-exchange algorithm and the public key algorithm of the client certificate happen to differ.

Own Id: OTP-8897

Improvements and New Features

For testing purposes ssl now also support some anonymous cipher suites when explicitly configured to do so.

Own Id: OTP-8870

Sends an error alert instead of crashing if a crypto function for the selected cipher suite fails.

Own Id: OTP-8930 Aux Id: seq11720

SSL 4.1

Improvements and New Features

Updated ssl to ignore CA certs that violate the asn1-spec for a certificate, and updated public key asn1 spec to handle inherited DSS-params.

Own Id: OTP-7884

Changed ssl implementation to retain backwards compatibility for old option {verify, 0} that shall be equivalent to {verify, verify_none}, also separate the cases unknown ca and selfsigned peer cert, and restored return value of deprecated function public_key:pem_to_der/1.

Own Id: OTP-8858

Changed the verify fun so that it differentiate between the peer certificate and CA certificates by using valid_peer or valid as the second argument to the verify fun. It may not always be trivial or even possible to know when the peer certificate is reached otherwise.

* POTENTIAL INCOMPATIBILITY *

Own Id: OTP-8873

SSL 4.0.1

Fixed Bugs and Malfunctions

The server now verifies the client certificate verify message correctly, instead of causing a case-clause.

Own Id: OTP-8721

The client hello message now always include ALL available cipher suites (or those specified by the ciphers option). Previous implementation would filter them based on the client certificate key usage extension (such filtering only makes sense for the server certificate).

Own Id: OTP-8772

Fixed handling of the option {mode, list} that was broken for some packet types for instance line.

Own Id: OTP-8785

Empty packets were not delivered to the client.

Own Id: OTP-8790

Building in a source tree without prebuilt platform independent build results failed on the SSL examples when:

cross building. This has been solved by not building the SSL examples during a cross build.

building on Windows.

Own Id: OTP-8791

Fixed a handshake error which occurred on some ssl implementations.

Own Id: OTP-8793

Improvements and New Features

Revise the public_key API - Cleaned up and documented the public_key API to make it useful for general use, also changed ssl to use the new API.

Own Id: OTP-8722

Added support for inputing certificates and keys directly in DER format these options will override the pem-file options if specified.

Own Id: OTP-8723

To gain interoperability ssl will not check for padding errors when using TLS 1.0. It is first in TLS 1.1 that checking the padding is an requirement.

Own Id: OTP-8740

Changed the semantics of the verify_fun option in the ssl-application so that it takes care of both application handling of path validation errors and verification of application specific extensions. This means that it is now possible for the server application in verify_peer mode to handle path validation errors. This change moved some functionality earlier in ssl to the public_key application.

Own Id: OTP-8770

Added the functionality so that the verification fun will be called when a certificate is considered valid by the path validation to allow access to each certificate in the path to the user application. Also try to verify subject-AltName, if unable to verify it let the application verify it.

Own Id: OTP-8825

SSL 4.0

Improvements and New Features

New ssl now support client/server-certificates signed by dsa keys.

Own Id: OTP-8587

Ssl has now switched default implementation and removed deprecated certificate handling. All certificate handling is done by the public_key application.

Own Id: OTP-8695

TLS/DTLS Protocol Overview

Purpose

Transport Layer Security (TLS) and its predecessor, the Secure Sockets Layer (SSL), are cryptographic protocols designed to provide communications security over a computer network. The protocols use X.509 certificates and hence public key (asymmetric) cryptography to authenticate the counterpart with whom they communicate, and to exchange a symmetric key for payload encryption. The protocol provides data/message confidentiality (encryption), integrity (through message authentication code checks) and host verification (through certificate path validation). DTLS (Datagram Transport Layer Security) that is based on TLS but datagram oriented instead of stream oriented.

Erlang Support

The Erlang SSL application implements the TLS/DTLS protocol for the currently supported versions, see the ssl manual page.

By default TLS is run over the TCP/IP protocol even though you can plug in any other reliable transport protocol with the same Application Programming Interface (API) as the gen_tcp module in Kernel. DTLS is by default run over UDP/IP, which means that application data has no delivery guarantees. Other transports, such as SCTP, may be supported in future releases.

If a client and a server wants to use an upgrade mechanism, such as defined by RFC 2817, to upgrade a regular TCP/IP connection to a TLS connection, this is supported by the Erlang SSL application API. This can be useful for, for example, supporting HTTP and HTTPS on the same port and implementing virtual hosting. Note this is a TLS feature only.

Security Overview

To achieve authentication and privacy, the client and server perform a TLS/DTLS handshake procedure before transmitting or receiving any data. During the handshake, they agree on a protocol version and cryptographic algorithms, generate shared secrets using public key cryptographies, and optionally authenticate each other with digital certificates.

Data Privacy and Integrity

A symmetric key algorithm has one key only. The key is used for both encryption and decryption. These algorithms are fast, compared to public key algorithms (using two keys, one public and one private) and are therefore typically used for encrypting bulk data.

The keys for the symmetric encryption are generated uniquely for each connection and are based on a secret negotiated in the TLS/DTLS handshake.

The TLS/DTLS handshake protocol and data transfer is run on top of the TLS/DTLS Record Protocol, which uses a keyed-hash Message Authenticity Code (MAC), or a Hash-based MAC (HMAC), to protect the message data integrity. From the TLS RFC: "A Message Authentication Code is a one-way hash computed from a message and some secret data. It is difficult to forge without knowing the secret data. Its purpose is to detect if the message has been altered."

Digital Certificates

A certificate is similar to a driver's license, or a passport. The holder of the certificate is called the subject. The certificate is signed with the private key of the issuer of the certificate. A chain of trust is built by having the issuer in its turn being certified by another certificate, and so on, until you reach the so called root certificate, which is self-signed, that is, issued by itself.

Certificates are issued by Certification Authorities (CAs) only. A handful of top CAs in the world issue root certificates. You can examine several of these certificates by clicking through the menus of your web browser.

Peer Authentication

Authentication of the peer is done by public key path validation as defined in RFC 3280. This means basically the following:

Each certificate in the certificate chain is issued by the previous one.

The certificates attributes are valid.

The root certificate is a trusted certificate that is present in the trusted certificate database kept by the peer.

The server always sends a certificate chain as part of the TLS handshake, but the client only sends one if requested by the server. If the client does not have an appropriate certificate, it can send an "empty" certificate to the server.

The client can choose to accept some path evaluation errors, for example, a web browser can ask the user whether to accept an unknown CA root certificate. The server, if it requests a certificate, does however not accept any path validation errors. It is configurable if the server is to accept or reject an "empty" certificate as response to a certificate request.

TLS Sessions - Prior to TLS-1.3

From the TLS RFC: "A TLS session is an association between a client and a server. Sessions are created by the handshake protocol. Sessions define a set of cryptographic security parameters, which can be shared among multiple connections. Sessions are used to avoid the expensive negotiation of new security parameters for each connection."

Session data is by default kept by the SSL application in a memory storage, hence session data is lost at application restart or takeover. Users can define their own callback module to handle session data storage if persistent data storage is required. Session data is also invalidated when session database exceeds its limit or 24 hours after being saved (RFC max lifetime recommendation). The amount of time the session data is to be saved can be configured.

By default the TLS/DTLS clients try to reuse an available session and by default the TLS/DTLS servers agree to reuse sessions when clients ask for it. See also Session Reuse Prior to TLS-1.3

TLS-1.3 session tickets

In TLS 1.3 the session reuse is replaced by a new session tickets mechanism based on the prior to shared key concept. This mechanism also obsoletes the session tickets from RFC5077, not implemented by this application. See also Session Tickets and Session Resumption in TLS-1.3

Examples

To see relevant version information for ssl, call ssl:versions/0 .

To see all supported cipher suites, call ssl:cipher_suites(all, 'tlsv1.3'). The available cipher suites for a connection depend on the TLS version and prior to TLS-1.3 also on the certificate. To see the default cipher suite list change all to default. Note that TLS 1.3 and previous versions do not have any cipher suites in common, for listing cipher suites for a specific version use ssl:cipher_suites(exclusive, 'tlsv1.3'). Specific cipher suites that you want your connection to use can also be specified. Default is to use the strongest available.

Warning

Enabling cipher suites using RSA as a key exchange algorithm is strongly discouraged (only available prior to TLS-1.3). For some configurations software preventions may exist, and can make them usable if they work, but relying on them to work is risky and there are many more reliable cipher suites that can be used instead.

The following sections shows small examples of how to set up client/server connections using the Erlang shell. The returned value of the sslsocket is abbreviated with [...] as it can be fairly large and is opaque to the user except for the purpose of pattern matching.

Note

Note that client certificate verification is optional for the server and needs additional conguration on both sides to work. The Certificate and keys, in the examples, are provided using the ssl:cert_key_conf/0 supplied in the certs_keys introduced in OTP 25.

Basic Client

 1 > ssl:start(), ssl:connect("google.com", 443, [{verify, verify_peer},
                                                 {cacerts, public_key:cacerts_get()}]).
   {ok,{sslsocket, [...]}}

Basic Connection

Step 1: Start the server side:

1 server> ssl:start().
ok

Step 2: with alternative certificates, in this example the EDDSA certificate will be preferred if TLS-1.3 is negotiated and the RSA certificate will always be used for TLS-1.2 as it does not support the EDDSA algorithm:

2 server> {ok, ListenSocket} =
ssl:listen(9999, [{certs_keys, [#{certfile => "eddsacert.pem",
                                  keyfile => "eddsakey.pem"},
                                #{certfile => "rsacert.pem",
                                  keyfile => "rsakey.pem",
                                  password => "foobar"}
                               ]},{reuseaddr, true}]).
{ok,{sslsocket, [...]}}

Step 3: Do a transport accept on the TLS listen socket:

3 server> {ok, TLSTransportSocket} = ssl:transport_accept(ListenSocket).
{ok,{sslsocket, [...]}}

Note

ssl:transport_accept/1 and ssl:handshake/2 are separate functions so that the handshake part can be called in a new Erlang process dedicated to handling the connection

Step 4: Start the client side:

1 client> ssl:start().
ok

Be sure to configure trusted certificates to use for server certificate verification.

2 client> {ok, Socket} = ssl:connect("localhost", 9999,
      [{verify, verify_peer},
      {cacertfile, "cacerts.pem"}, {active, once}], infinity).
{ok,{sslsocket, [...]}}

Step 5: Do the TLS handshake:

4 server> {ok, Socket} = ssl:handshake(TLSTransportSocket).
{ok,{sslsocket, [...]}}

Note

A real server should use ssl:handshake/2, which accepts a timeout, to avoid DoS attacks. In the example the timeout defaults to infinity.

Step 6: Send a message over TLS:

5 server> ssl:send(Socket, "foo").
ok

Step 7: Flush the shell message queue to see that the message sent on the server side is recived by the client side:

3 client> flush().
Shell got {ssl,{sslsocket,[...]},"foo"}
ok

Upgrade Example - TLS only

Upgrading a a TCP/IP connection to a TLS connections is mostly used when there is a desire have unencrypted communication first and then later secure the communication channel by using TLS. Note that the client and server need to agree to do the upgrade in the protocol doing the communication. This is concept is often referenced as STARTLS and used in many protocols such as SMTP, FTPS and HTTPS via a proxy.

Warning

Maximum security recommendations are however moving away from such solutions.

To upgrade to a TLS connection:

Step 1: Start the server side:

1 server> ssl:start().
  ok

Step 2: Create a normal TCP listen socket and ensure active is set to false and not set to any active mode otherwise TLS handshake messages can be delivered to the wrong process.

2 server> {ok, ListenSocket} = gen_tcp:listen(9999, [{reuseaddr, true},
  {active, false}]).
  {ok, #Port<0.475>}

Step 3: Accept client connection:

3 server> {ok, Socket} = gen_tcp:accept(ListenSocket).
  {ok, #Port<0.476>}

Step 4: Start the client side:

1 client> ssl:start().
  ok

2 client> {ok, Socket} = gen_tcp:connect("localhost", 9999,  [], infinity).

Step 5: Do the TLS handshake:

4 server> {ok, TLSSocket} = ssl:handshake(Socket, [{verify, verify_peer},
  {fail_if_no_peer_cert, true},
  {cacertfile, "cacerts.pem"},
  {certs_keys, [#{certfile => "cert.pem", keyfile => "key.pem"}]}]).
  {ok,{sslsocket,[...]}}

Step 6: Upgrade to a TLS connection. The client and server must agree upon the upgrade. The server must be prepared to be a TLS server before the client can do a successful connect.

3 client>{ok, TLSSocket} = ssl:connect(Socket, [{verify, verify_peer},
  {cacertfile, "cacerts.pem"},
  {certs_keys, [#{certfile => "cert.pem", keyfile => "key.pem"}]}], infinity).
{ok,{sslsocket,[...]}}

Step 7: Send a message over TLS:

4 client> ssl:send(TLSSocket, "foo").
      ok

Step 8: Set active once on the TLS socket:

5 server> ssl:setopts(TLSSocket, [{active, once}]).
      ok

Step 9: Flush the shell message queue to see that the message sent on the client side is recived by the server side:

5 server> flush().
      Shell got {ssl,{sslsocket,[...]},"foo"}
      ok

Customizing cipher suites

Fetch default cipher suite list for a TLS/DTLS version. Change default to all to get all possible cipher suites.

1>  Default = ssl:cipher_suites(default, 'tlsv1.2').
    [#{cipher => aes_256_gcm,key_exchange => ecdhe_ecdsa,
    mac => aead,prf => sha384}, ....]

In OTP 20 it is desirable to remove all cipher suites that uses rsa key exchange (removed from default in 21)

2> NoRSA =
    ssl:filter_cipher_suites(Default,
                             [{key_exchange, fun(rsa) -> false;
                                                (_) -> true
                                             end}]).
    [...]

Pick just a few suites

 3> Suites =
 ssl:filter_cipher_suites(Default,
                             [{key_exchange, fun(ecdh_ecdsa) -> true;
                                                (_) -> false
                                             end},
                              {cipher, fun(aes_128_cbc) -> true;
                                          (_) ->false
                                       end}]).

[#{cipher => aes_128_cbc,key_exchange => ecdh_ecdsa,
   mac => sha256,prf => sha256},
 #{cipher => aes_128_cbc,key_exchange => ecdh_ecdsa,mac => sha,
   prf => default_prf}]

Make some particular suites the most preferred, or least preferred by changing prepend to append.

 4>ssl:prepend_cipher_suites(Suites, Default).
  [#{cipher => aes_128_cbc,key_exchange => ecdh_ecdsa,
     mac => sha256,prf => sha256},
   #{cipher => aes_128_cbc,key_exchange => ecdh_ecdsa,mac => sha,
     prf => default_prf},
   #{cipher => aes_256_cbc,key_exchange => ecdhe_ecdsa,
     mac => sha384,prf => sha384}, ...]

Customizing signature algorithms(TLS-1.2)/schemes(TLS-1.3)

Starting from TLS-1.2 signature algorithms (called signature schemes in TLS-1.3) is something that can be negotiated and hence also configured. These algorithms/schemes will be used for digital signatures in protocol messages and in certificates.

Note

TLS-1.3 schemes have atom names whereas TLS-1.2 configuration is two element tuples composed by one hash algorithm and one signature algorithm. When both versions are supported the configuration can be a mix of these as both versions might be negotiated. All rsa_pss based schemes are back ported to TLS-1.2 and can be used also in a TLS-1.2 configuration. In TLS-1.2 the signature algorithms chosen by the server will also be affected by the chiper suite that is chosen, which is not the case in TLS-1.3.

Using the function ssl:signature_algs/2 will let you inspect different aspects of possible configurations for your system. For example if TLS-1.3 and TLS-1.2 is supported the default signature_algorithm list in OTP-26 and cryptolib from OpenSSL 3.0.2 would look like:

 1>  ssl:signature_algs(default, 'tlsv1.3').
 %% TLS-1.3 schemes
 [eddsa_ed25519,eddsa_ed448,ecdsa_secp521r1_sha512,
  ecdsa_secp384r1_sha384,ecdsa_secp256r1_sha256,
  rsa_pss_pss_sha512,rsa_pss_pss_sha384,rsa_pss_pss_sha256,
  rsa_pss_rsae_sha512,rsa_pss_rsae_sha384,rsa_pss_rsae_sha256,
  %% Legacy schemes only valid for certificate signatures in TLS-1.3
  %% (would have a tuple name in TLS-1.2 only configuration)
  rsa_pkcs1_sha512,rsa_pkcs1_sha384,rsa_pkcs1_sha256
  %% TLS 1.2 algorithms
  {sha512,ecdsa},
  {sha384,ecdsa},
  {sha256,ecdsa}]

If you want to add support for non default supported algorithms you should append them to the default list as the configuration is in prefered order, something like this:

    MySignatureAlgs = ssl:signature_algs(default, 'tlsv1.3') ++ [{sha, rsa}, {sha, dsa}],
    ssl:connect(Host,Port,[{signature_algs, MySignatureAlgs,...]}),
    ...

See also ssl:signature_algs/2 and sign_algo()

Using an Engine Stored Key

Erlang ssl application is able to use private keys provided by OpenSSL engines using the following mechanism:

1> ssl:start().
ok

Load a crypto engine, should be done once per engine used. For example dynamically load the engine called MyEngine:

2> {ok, EngineRef} =
crypto:engine_load(<<"dynamic">>,
[{<<"SO_PATH">>, "/tmp/user/engines/MyEngine"},<<"LOAD">>],
[]).
{ok,#Ref<0.2399045421.3028942852.173962>}

Create a map with the engine information and the algorithm used by the engine:

3> PrivKey =
 #{algorithm => rsa,
   engine => EngineRef,
   key_id => "id of the private key in Engine"}.

Use the map in the ssl key option:

4> {ok, SSLSocket} =
 ssl:connect("localhost", 9999,
                [{cacertfile, "cacerts.pem"},
                 {certs_keys, [#{certfile => "cert.pem", key => PrivKey}]}
                ], infinity).

See also crypto documentation

NSS keylog

The NSS keylog debug feature can be used by authorized users to for instance enable wireshark to decrypt TLS packets.

The option to be used is for legacy reasons called keep_secrets and of course defaults to false. The legacy value true will enable you retrieve keylogging from the connection in a polling manner and does not work as intended for all use cases.

      {ok, [{keylog, KeylogItems}]} = ssl:connection_information(CSock, [keylog]).
      file:write(FileHandle, [[KeylogItem,$\n] || KeylogItem <- KeylogItems]).

Instead you should use the option values {keylog, fun()} or {keylog_hs, fun()} to retrieve keylogs on all key update events or to retrieve keylog if the connection fails during the handshake.

Warning

Note that enabling this is for debug purposes and defeats the purpose of the TLS protocol, so use with care.

An outline of this use case:

    Me = self(),
    Fun = fun(KeylogInfo) ->
                  Me ! {keylog, KeylogInfo}
          end,
    Options = [{keep_secrets, {keylog, Fun} ...]

    ...

    receive
        {keylog	,#{items := KeylogItems, client_random := Rand}} ->
	    FileHandle = get_file(Rand),
	    file:write(FileHandle, [[KeylogItem,$\n] || KeylogItem <- KeylogItems])
    ...

Session Reuse Prior to TLS 1.3

Clients can request to reuse a session established by a previous full handshake between that client and server by sending the id of the session in the initial handshake message. The server may or may not agree to reuse it. If agreed the server will send back the id and if not it will send a new id. The ssl application has several options for handling session reuse.

On the client side the ssl application will save session data to try to automate session reuse on behalf of the client processes on the Erlang node. Note that only verified sessions will be saved for security reasons, that is session resumption relies on the certificate validation to have been run in the original handshake. To minimize memory consumption only unique sessions will be saved unless the special save value is specified for the following option {reuse_sessions, boolean() | save} in which case a full handshake will be performed and that specific session will have been saved before the handshake returns. The session id and even an opaque binary containing the session data can be retrieved using ssl:connection_information/1 function. A saved session (guaranteed by the save option) can be explicitly reused using {reuse_session, SessionId}. Also it is possible for the client to reuse a session that is not saved by the ssl application using {reuse_session, {SessionId, SessionData}}.

Note

When using explicit session reuse, it is up to the client to make sure that the session being reused is for the correct server and has been verified.

Here follows a client side example, divide into several steps for readability.

Step 1 - Automated Session Reuse

1> ssl:start().
ok

2>{ok, C1} = ssl:connect("localhost", 9999, [{verify, verify_peer},
                                           {versions, ['tlsv1.2']},
                                           {cacertfile, "cacerts.pem"}]).
{ok,{sslsocket,{gen_tcp,#Port<0.7>,tls_connection,undefined}, ...}}

3> ssl:connection_information(C1, [session_id]).
{ok,[{session_id,<<95,32,43,22,35,63,249,22,26,36,106,
                   152,49,52,124,56,130,192,137,161,
                   146,145,164,232,...>>}]}

%% Reuse session if possible, note that if C2 is really fast the session
%% data might not be available for reuse.
4>{ok, C2} = ssl:connect("localhost", 9999, [{verify, verify_peer},
                                           {versions, ['tlsv1.2']},
                                           {cacertfile, "cacerts.pem"},
                                           {reuse_sessions, true}]).
{ok,{sslsocket,{gen_tcp,#Port<0.8>,tls_connection,undefined}, ...]}}

%% C2 got same session ID as client one, session was automatically reused.
5> ssl:connection_information(C2, [session_id]).
{ok,[{session_id,<<95,32,43,22,35,63,249,22,26,36,106,
                   152,49,52,124,56,130,192,137,161,
                   146,145,164,232,...>>}]}

Step 2- Using save Option

%% We want save this particular session for
%% reuse although it has the same basis as C1
6> {ok, C3} = ssl:connect("localhost", 9999, [{verify, verify_peer},
                                           {versions, ['tlsv1.2']},
                                           {cacertfile, "cacerts.pem"},
                                           {reuse_sessions, save}]).

{ok,{sslsocket,{gen_tcp,#Port<0.9>,tls_connection,undefined}, ...]}}

%% A full handshake is performed and we get a new session ID
7> {ok, [{session_id, ID}]} = ssl:connection_information(C3, [session_id]).
{ok,[{session_id,<<91,84,27,151,183,39,84,90,143,141,
                   121,190,66,192,10,1,27,192,33,95,78,
                   8,34,180,...>>}]}

%% Use automatic session reuse
8> {ok, C4} = ssl:connect("localhost", 9999, [{verify, verify_peer},
                                           {versions, ['tlsv1.2']},
                                           {cacertfile, "cacerts.pem"},
                                           {reuse_sessions, true}]).

{ok,{sslsocket,{gen_tcp,#Port<0.10>,tls_connection,
                        undefined}, ...]}}

%% The "saved" one happened to be selected, but this is not a guarantee
9> ssl:connection_information(C4, [session_id]).
{ok,[{session_id,<<91,84,27,151,183,39,84,90,143,141,
                   121,190,66,192,10,1,27,192,33,95,78,
                   8,34,180,...>>}]}

%% Make sure to reuse the "saved" session
10> {ok, C5} = ssl:connect("localhost", 9999, [{verify, verify_peer},
                                           {versions, ['tlsv1.2']},
                                           {cacertfile, "cacerts.pem"},
                                           {reuse_session, ID}]).
{ok,{sslsocket,{gen_tcp,#Port<0.11>,tls_connection,
                        undefined}, ...]}}

11> ssl:connection_information(C5, [session_id]).
{ok,[{session_id,<<91,84,27,151,183,39,84,90,143,141,
                   121,190,66,192,10,1,27,192,33,95,78,
                   8,34,180,...>>}]}

Step 3 - Explicit Session Reuse

%% Perform a full handshake and the session will not be saved for reuse
12> {ok, C9} =
ssl:connect("localhost", 9999, [{verify, verify_peer},
                                    {versions, ['tlsv1.2']},
                                    {cacertfile, "cacerts.pem"},
                                    {reuse_sessions, false},
                                    {server_name_indication, disable}]).
{ok,{sslsocket,{gen_tcp,#Port<0.14>,tls_connection, ...}}

%% Fetch session ID and data for C9 connection
12> {ok, [{session_id, ID1}, {session_data, SessData}]} =
        ssl:connection_information(C9, [session_id, session_data]).
{ok,[{session_id,<<9,233,4,54,170,88,170,180,17,96,202,
                   85,85,99,119,47,9,68,195,50,120,52,
                   130,239,...>>},
     {session_data,<<131,104,13,100,0,7,115,101,115,115,105,
                     111,110,109,0,0,0,32,9,233,4,54,170,...>>}]}

%% Explicitly reuse the session from C9
13> {ok, C10} = ssl:connect("localhost", 9999, [{verify, verify_peer},
                                    {versions, ['tlsv1.2']},
                                    {cacertfile, "cacerts.pem"},
                                    {reuse_session, {ID1, SessData}}]).
{ok,{sslsocket,{gen_tcp,#Port<0.15>,tls_connection,
                        undefined}, ...}}

14> ssl:connection_information(C10, [session_id]).
{ok,[{session_id,<<9,233,4,54,170,88,170,180,17,96,202,
                   85,85,99,119,47,9,68,195,50,120,52,
                   130,239,...>>}]}

Step 4 - Not Possible to Reuse Explicit Session by ID Only

%% Try to reuse the session from C9 using only the id
15> {ok, E} =  ssl:connect("localhost", 9999, [{verify, verify_peer},
                                    {versions, ['tlsv1.2']},
                                    {cacertfile, "cacerts.pem"},
                                    {reuse_session, ID1}]).
{ok,{sslsocket,{gen_tcp,#Port<0.18>,tls_connection,
                        undefined}, ...}}

%% This will fail (as it is not saved for reuse)
%% and a full handshake will be performed, we get a new id.
16>  ssl:connection_information(E, [session_id]).
{ok,[{session_id,<<87,46,43,126,175,68,160,153,37,29,
                   196,240,65,160,254,88,65,224,18,63,
                   18,17,174,39,...>>}]}

On the server side the the {reuse_sessions, boolean()} option determines if the server will save session data and allow session reuse or not. This can be further customized by the option {reuse_session, fun()} that may introduce a local policy for session reuse.

Session Tickets and Session Resumption in TLS 1.3

TLS 1.3 introduces a new secure way of resuming sessions by using session tickets. A session ticket is an opaque data structure that is sent in the pre_shared_key extension of a ClientHello, when a client attempts to resume a session with keying material from a previous successful handshake.

Session tickets can be stateful or stateless. A stateful session ticket is a database reference (session ticket store) and used with stateful servers, while a stateless ticket is a self-encrypted and self-authenticated data structure with cryptographic keying material and state data, enabling session resumption with stateless servers.

The choice between stateful or stateless depends on the server requirements as the session tickets are opaque for the clients. Generally, stateful tickets are smaller and the server can guarantee that tickets are only used once. Stateless tickets contain additional data, require less storage on the server side, but they offer different guarantees against anti-replay. See also Anti-Replay Protection in TLS 1.3

Session tickets are sent by servers on newly established TLS connections. The number of tickets sent and their lifetime are configurable by application variables. See also SSL's configuration.

Session tickets are protected by application traffic keys, and in stateless tickets, the opaque data structure itself is self-encrypted.

An example with automatic and manual session resumption:

      {ok, _} = application:ensure_all_started(ssl).
      LOpts = [{certs_keys, [#{certfile => "cert.pem",
                               keyfile => "key.pem"}]},
               {versions, ['tlsv1.2','tlsv1.3']},
               {session_tickets, stateless}].
      {ok, LSock} = ssl:listen(8001, LOpts).
      {ok, ASock} = ssl:transport_accept(LSock).

Step 2 (client): Start the client and connect to server:

      {ok, _} = application:ensure_all_started(ssl).
      COpts = [{cacertfile, "cert.pem"},
               {versions, ['tlsv1.2','tlsv1.3']},
               {log_level, debug},
               {session_tickets, auto}].
      ssl:connect("localhost", 8001, COpts).

Step 3 (server): Start the TLS handshake:

      {ok, CSocket} = ssl:handshake(ASock).

A connection is established using a full handshake. Below is a summary of the exchanged messages:

      >>> TLS 1.3 Handshake, ClientHello ...
      <<< TLS 1.3 Handshake, ServerHello ...
      <<< Handshake, EncryptedExtensions ...
      <<< Handshake, Certificate ...
      <<< Handshake, CertificateVerify ...
      <<< Handshake, Finished ...
      >>> Handshake, Finished ...
      <<< Post-Handshake, NewSessionTicket ...

At this point the client has stored the received session tickets and ready to use them when establishing new connections to the same server.

Step 4 (server): Accept a new connection on the server:

      {ok, ASock2} = ssl:transport_accept(LSock).

Step 5 (client): Make a new connection:

      ssl:connect("localhost", 8001, COpts).

Step 6 (server): Start the handshake:

      {ok, CSock2} =ssl:handshake(ASock2).

The second connection is a session resumption using keying material from the previous handshake:

      >>> TLS 1.3 Handshake, ClientHello ...
      <<< TLS 1.3 Handshake, ServerHello ...
      <<< Handshake, EncryptedExtensions ...
      <<< Handshake, Finished ...
      >>> Handshake, Finished ...
      <<< Post-Handshake, NewSessionTicket ...

Manual handling of session tickets is also supported. In manual mode, it is the responsibility of the client to handle received session tickets.

Step 7 (server): Accept a new connection on the server:

      {ok, ASock3} = ssl:transport_accept(LSock).

Step 8 (client): Make a new connection to server:

      {ok, _} = application:ensure_all_started(ssl).
      COpts2 = [{cacertfile, "cacerts.pem"},
                {versions, ['tlsv1.2','tlsv1.3']},
                {log_level, debug},
                {session_tickets, manual}].
      ssl:connect("localhost", 8001, COpts).

Step 9 (server): Start the handshake:

      {ok, CSock3} = ssl:handshake(ASock3).

After the handshake is performed, the user process receivess messages with the tickets sent by the server.

Step 10 (client): Receive a new session ticket:

      Ticket = receive {ssl, session_ticket, Ticket0} -> Ticket0 end.

Step 11 (server): Accept a new connection on the server:

      {ok, ASock4} = ssl:transport_accept(LSock).

Step 12 (client): Initiate a new connection to the server with the session ticket received in Step 10:

      {ok, _} = application:ensure_all_started(ssl).
      COpts2 = [{cacertfile, "cert.pem"},
                {versions, ['tlsv1.2','tlsv1.3']},
                {log_level, debug},
                {session_tickets, manual},
                {use_ticket, [Ticket]}].
      ssl:connect("localhost", 8001, COpts).

Step 13 (server): Start the handshake:

      {ok, CSock4} = ssl:handshake(ASock4).

Early Data in TLS-1.3

TLS 1.3 allows clients to send data on the first flight if the endpoints have a shared crypographic secret (pre-shared key). This means that clients can send early data if they have a valid session ticket received in a previous successful handshake. For more information about session resumption see Session Tickets and Session Resumption in TLS 1.3.

The security properties of Early Data are weaker than other kinds of TLS data. This data is not forward secret, and it is vulnerable to replay attacks. For available mitigation strategies see Anti-Replay Protection in TLS 1.3.

In normal operation, clients will not know which, if any, of the available mitigation strategies servers actually implement, and hence must only send early data which they deem safe to be replayed. For example, idempotent HTTP operations, such as HEAD and GET, can usually be regarded as safe but even they can be exploited by a large number of replays causing resource limit exhaustion and other similar problems.

An example of sending early data with automatic and manual session ticket handling:

Server

early_data_server() ->
    application:load(ssl),
    {ok, _} = application:ensure_all_started(ssl),
    Port = 11029,
    LOpts = [{certs_keys, [#{certfile => "cert.pem", keyfile => "key.pem"}]},
             {reuseaddr, true},
             {versions, ['tlsv1.2','tlsv1.3']},
             {session_tickets, stateless},
             {early_data, enabled},
            ],
    {ok, LSock} = ssl:listen(Port, LOpts),
    %% Accept first connection
    {ok, ASock0} = ssl:transport_accept(LSock),
    {ok, CSock0} = ssl:handshake(ASock0),
    %% Accept second connection
    {ok, ASock1} = ssl:transport_accept(LSock),
    {ok, CSock1} = ssl:handshake(ASock1),
    Sock.

Client (automatic ticket handling):

early_data_auto() ->
    %% First handshake 1-RTT - get session tickets
    application:load(ssl),
    {ok, _} = application:ensure_all_started(ssl),
    Port = 11029,
    Data = <<"HEAD / HTTP/1.1\r\nHost: \r\nConnection: close\r\n">>,
    COpts0 = [{cacertfile, "cacerts.pem"},
              {versions, ['tlsv1.2', 'tlsv1.3']},
              {session_tickets, auto}],
    {ok, Sock0} = ssl:connect("localhost", Port, COpts0),

    %% Wait for session tickets
    timer:sleep(500),
    %% Close socket if server cannot handle multiple
    %% connections e.g. openssl s_server
    ssl:close(Sock0),

    %% Second handshake 0-RTT
    COpts1 = [{cacertfile,  "cacerts.pem"},
              {versions, ['tlsv1.2', 'tlsv1.3']},
              {session_tickets, auto},
              {early_data, Data}],
    {ok, Sock} = ssl:connect("localhost", Port, COpts1),
    Sock.

Client (manual ticket handling):

early_data_manual() ->
    %% First handshake 1-RTT - get session tickets
    application:load(ssl),
    {ok, _} = application:ensure_all_started(ssl),
    Port = 11029,
    Data = <<"HEAD / HTTP/1.1\r\nHost: \r\nConnection: close\r\n">>,
    COpts0 = [{cacertfile, "cacerts.pem"},
              {versions, ['tlsv1.2', 'tlsv1.3']},
              {session_tickets, manual}],
    {ok, Sock0} = ssl:connect("localhost", Port, COpts0),

    %% Wait for session tickets
    Ticket =
        receive
            {ssl, session_ticket, Ticket0} ->
                Ticket0
        end,

    %% Close socket if server cannot handle multiple connections
    %% e.g. openssl s_server
    ssl:close(Sock0),

    %% Second handshake 0-RTT
    COpts1 = [{cacertfile, "cacerts.pem"},
              {versions, ['tlsv1.2', 'tlsv1.3']},
              {session_tickets, manual},
              {use_ticket, [Ticket]},
              {early_data, Data}],
    {ok, Sock} = ssl:connect("localhost", Port, COpts1),
    Sock.

Anti-Replay Protection in TLS 1.3

The TLS 1.3 protocol does not provide inherent protection for replay of 0-RTT data but describes mechanisms that SHOULD be implemented by compliant server implementations. The implementation of TLS 1.3 in the SSL application employs all standard methods to prevent potential threats.

Single-use tickets

This mechanism is available with stateful session tickets. Session tickets can only be used once, subsequent use of the same ticket results in a full handshake. Stateful servers enforce this rule by maintaining a database of outstanding valid tickets.

Client Hello Recording

This mechanism is available with stateless session tickets. The server records a unique value derived from the ClientHello (PSK binder) in a given time window. The ticket's age is verified by using both the "obsfuscated_ticket_age" and an additional timestamp encrypted in the ticket data. As the used datastore allows false positives, apparent replays will be answered by doing a full 1-RTT handshake.

Freshness Checks

This mechanism is available with the stateless session tickets. As the ticket data has an embedded timestamp, the server can determine if a ClientHello was sent reasonably recently and accept the 0-RTT handshake, otherwise if falls back to a full 1-RTT handshake. This mechanism is tightly coupled with the previous one, it prevents storing an unlimited number of ClientHellos.

The current implementation uses a pair of Bloom filters to implement the last two mechanisms. Bloom filters are fast, memory-efficient, probabilistic data structures that can tell if an element may be in a set or if it is definitely not in the set.

If the option anti_replay is defined in the server, a pair of Bloom filters (current and old) are used to record incoming ClientHello messages (it is the unique binder value that is actually stored). The current Bloom filter is used for WindowSize seconds to store new elements. At the end of the time window the Bloom filters are rotated (the current Bloom filter becomes the old and an empty Bloom filter is set as current.

The Anti-Replay protection feature in stateless servers executes in the following steps when a new ClientHello is received:

Reported ticket age (obfuscated ticket age) shall be less than ticket lifetime.

Actual ticket age shall be less than the ticket lifetime (stateless session tickets contain the servers timestamp when the ticket was issued).

ClientHello created with the ticket shall be sent relatively recently (freshness checks).

If all above checks passed both current and old Bloom filters are checked to detect if binder was already seen. Being a probabilistic data structure, false positives can occur and they trigger a full handshake.

If the binder is not seen, the binder is validated. If the binder is valid, the server proceeds with the 0-RTT handshake.

Using DTLS

Using DTLS has basically the same API as TLS. You need to add the option {protocol, dtls} to the connect and listen functions. For example

 client>{ok, Socket} = ssl:connect("localhost", 9999, [{protocol, dtls},
                                               {verify, verify_peer},
                                               {cacertfile, "cacerts.pem"}],
                           infinity).
{ok,{sslsocket, [...]}}

Erlang Distribution over TLS

This section describes how the Erlang distribution can use TLS to get extra verification and security.

The Erlang distribution can in theory use almost any connection-based protocol as bearer. However, a module that implements the protocol-specific parts of the connection setup is needed. The default distribution module is inet_tcp_dist in the Kernel application. When starting an Erlang node distributed, net_kernel uses this module to set up listen ports and connections.

In the SSL application, an extra distribution module, inet_tls_dist, can be used as an alternative. All distribution connections will use TLS and all participating Erlang nodes in a distributed system must use this distribution module.

The security level depends on the parameters provided to the TLS connection setup. Erlang node cookies are however always used, as they can be used to differentiate between two different Erlang networks.

To set up Erlang distribution over TLS:

Step 1: Build boot scripts including the SSL application.

Step 2: Specify the distribution module for net_kernel.

Step 3: Specify the security options and other SSL options.

Step 4: Set up the environment to always use TLS.

The following sections describe these steps.

Building Boot Scripts Including the SSL Application

Boot scripts are built using the systools utility in the SASL application. For more information on systools, see the SASL documentation. This is only an example of what can be done.

The simplest boot script possible includes only the Kernel and STDLIB applications. Such a script is located in the bin directory of the Erlang distribution. The source for the script is found under the Erlang installation top directory under releases/<OTP version>/start_clean.rel.

Do the following:

Copy that script to another location (and preferably another name).

Add the applications Crypto, Public Key, and SSL with their current version numbers after the STDLIB application.

The following shows an example .rel file with TLS added:

      {release, {"OTP  APN 181 01","R15A"}, {erts, "5.9"},
      [{kernel,"2.15"},
      {stdlib,"1.18"},
      {crypto, "2.0.3"},
      {public_key, "0.12"},
      {asn1, "4.0"},
      {ssl, "5.0"}
      ]}.

The version numbers differ in your system. Whenever one of the applications included in the script is upgraded, change the script.

Do the following:

Build the boot script.

Assuming the .rel file is stored in a file start_ssl.rel in the current directory, a boot script can be built as follows:

   1> systools:make_script("start_ssl",[]).

There is now a start_ssl.boot file in the current directory.

Do the following:

Test the boot script. To do this, start Erlang with the -boot command-line parameter specifying this boot script (with its full path, but without the .boot suffix). In UNIX it can look as follows:

$ erl -boot /home/me/ssl/start_ssl
Erlang (BEAM) emulator version 5.0

Eshell V5.0  (abort with ^G)
1> whereis(ssl_manager).
<0.41.0>

The whereis function-call verifies that the SSL application is started.

As an alternative to building a bootscript, you can explicitly add the path to the SSL ebin directory on the command line. This is done with command-line option -pa. This works as the SSL application does not need to be started for the distribution to come up, as a clone of the SSL application is hooked into the Kernel application. So, as long as the SSL application code can be reached, the distribution starts. The -pa method is only recommended for testing purposes.

Note

The clone of the SSL application must enable the use of the SSL code in such an early bootstage as needed to set up the distribution. However, this makes it impossible to soft upgrade the SSL application.

Specifying Distribution Module for net_kernel

The distribution module for TLS is named inet_tls_dist and is specified on the command line with option -proto_dist. The argument to -proto_dist is to be the module name without suffix _dist. So, this distribution module is specified with -proto_dist inet_tls on the command line.

Extending the command line gives the following:

$ erl -boot /home/me/ssl/start_ssl -proto_dist inet_tls

For the distribution to be started, give the emulator a name as well:

$ erl -boot /home/me/ssl/start_ssl -proto_dist inet_tls -sname ssl_test
Erlang (BEAM) emulator version 5.0 [source]

Eshell V5.0  (abort with ^G)
(ssl_test@myhost)1>

However, a node started in this way refuses to talk to other nodes, as no TLS parameters are supplied (see the next section).

Specifying TLS Options

The TLS distribution options can be written into a file that is consulted when the node is started. This file name is then specified with the command line argument -ssl_dist_optfile.

Any available TLS option can be specified in an options file.

Note

Options that take a fun() has to use the syntax fun Mod:Func/Arity since a function body cannot be compiled when consulting a file. Also the encoding of the file can be specified as defined by module epp.

Warning

Do not tamper with the socket options list, binary, active, packet, nodelay and deliver since they are used by the distribution protocol handler itself. Other raw socket options such as packet_size may interfere severely, so beware!

For TLS to work, at least a public key and a certificate must be specified for the server side and the client needs to specify CAs that it trusts (client certification is optional and requires more configuration).

In the following example (to keep it simple), the PEM file "/home/me/ssl/erlserver.pem" contains both the server certificate and its private key .

Create a file named for example "/home/me/ssl/ssl_test@myhost.conf":

[{server,
  [{certfile, "/home/me/ssl/erlserver.pem"}]},
 {client,
  [{cacertfile, "/home/me/ssl/client_trusted.pem"}]}].

And then start the node like this (line breaks in the command are for readability, and shall not be there when typed):

$ erl -boot /home/me/ssl/start_ssl -proto_dist inet_tls
  -ssl_dist_optfile "/home/me/ssl/ssl_test@myhost.conf"
  -sname ssl_test

The options in the {server, Opts} tuple are used when calling ssl:handshake/3, and the options in the {client, Opts} tuple are used when calling ssl:connect/4.

For the client, the option {server_name_indication, atom_to_list(TargetNode)} is added when connecting. This makes it possible to use the client option {verify, verify_peer}, and the client will verify that the certificate matches the node name you are connecting to. This only works if the the server certificate is issued to the name atom_to_list(TargetNode).

For the server it is also possible to use the option {verify, verify_peer} and the server will only accept client connections with certificates that are trusted by a root certificate that the server knows. A client that presents an untrusted certificate will be rejected. This option is preferably combined with {fail_if_no_peer_cert, true} or a client will still be accepted if it does not present any certificate.

A node started in this way is fully functional, using TLS as the distribution protocol.

verify_fun Configuration Example

The verify_fun option creates a reference to the implementing function since the configuration is evaluated as an Erlang term. In an example file for use with -ssl_dist_optfile:

[{server,[{fail_if_no_peer_cert,true},
          {certfile,"/home/me/ssl/cert.pem"},
          {keyfile,"/home/me/ssl/privkey.pem"},
          {cacertfile,"/home/me/ssl/ca_cert.pem"},
          {verify,verify_peer},
          {verify_fun,{fun mydist:verify/3,"any initial value"}}]},
 {client,[{certfile,"/home/me/ssl/cert.pem"},
          {keyfile,"/home/me/ssl/privkey.pem"},
          {cacertfile,"/home/me/ssl/ca_cert.pem"},
          {verify,verify_peer},
          {verify_fun,{fun mydist:verify/3,"any initial value"}}]}].

mydist:verify/3 will be called with:

OtpCert, the other party's certificate PKIX Certificates

SslStatus, OTP's verification outcome, such as valid or a tuple {bad_cert, unknown_ca}

Init will be "any initial value"

A pattern for verify/3 will look like:

verify(OtpCert, _SslStatus, Init) ->
    IsOk = is_ok(OtpCert, Init),
    NewInitValue = "some new value",
    case IsOk of
       true ->
           {valid, NewInitValue};
       false ->
           {failure, NewInitValue}
    end.

verify_fun can accept a verify/4 function, which will receive:

OtpCert, the other party's certificate PKIX Certificates

DerCert, the other party's original DER Encoded certificate

SslStatus, OTP's verification outcome, such as valid or a tuple {bad_cert, unknown_ca}

Init will be "any initial value"

The verify/4 can use the DerCert for atypical workarounds such as handling decoding errors and directly verifying signatures.

For more details see {verify_fun, Verify} in common_option_cert

Using TLS distribution over IPv6

It is possible to use TLS distribution over IPv6 instead of IPv4. To do this, pass the option -proto_dist inet6_tls instead of -proto_dist inet_tls when starting Erlang, either on the command line or in the ERL_FLAGS environment variable.

An example command line with this option would look like this:

$ erl -boot /home/me/ssl/start_ssl -proto_dist inet6_tls
  -ssl_dist_optfile "/home/me/ssl/ssl_test@myhost.conf"
  -sname ssl_test

A node started in this way will only be able to communicate with other nodes using TLS distribution over IPv6.

TLS Hardening Guide

This guide describes how to harden Transport Layer Security (TLS) connections configured with the ssl application. It covers cryptographic algorithm selection, protocol version configuration, certificate verification, and revocation checking.

Note

There can exist trade-offs between interoperability and security, and between resource consumption and security. If you make such trade-offs it is important that you make an informed decision and understand the consequences. Also this guide will always reflect the status of defaults for the release where it is published, unless otherwise specifically stated. Hence using older releases may need more configuration to achieve the same result.

Erlang's TLS implementation provided by the ssl application strives to have secure defaults. That said, we will avoid changing defaults in non-major releases.

For embedded systems with constrained bandwidth, cipher suites using Advanced Encryption Standard (AES) with counter cipher block chaining message authentication code, that is AES-CCM-8 (8-byte authentication tag) can be configured and provides 64-bit integrity instead of 128-bit.

Warning

Be aware that enabling anything documented as legacy will make your application less secure.

Warning

Network Security Services Key Log Format (NSS Key Logging) is a debugging functionality that should not be enabled in production systems as it defeats the purpose of the TLS protocol.

Cryptographic Algorithms

The available cryptographic algorithms depend on the version of OpenSSL cryptolib that Erlang/OTP is built and linked with.

When you configure algorithm options such as supported_groups, or signature_algs, the ssl application automatically removes any algorithms not supported by the underlying OpenSSL cryptolib. The exception is the ciphers option: user-supplied cipher suites are not automatically filtered against crypto support, this is due to the more complex composition of algorithms in cipher suites pre TLS-1.3. In this case use ssl:filter_cipher_suites/2 to remove suites that are not supported by linked OpenSSL cryptolib.

Note

The TLS protocol is implemented in Erlang, and therefore only the cryptographic functions come from the OpenSSL cryptolib. This reduces the error surface by excluding buffer overflows and other pointer related errors that does not exist in Erlang programs.

Algorithms selection

The TLS protocol typically specifies that the client's algorithm preference determines the algorithm selection. The server option honor_cipher_order overrides this for cipher suite selection in all TLS versions. For TLS-1.2 and legacy versions, honor_ecc_order does the same for ECC curve selection.

Signature Algorithms

The signature_algs option configures which signature algorithms are acceptable for TLS protocol messages. The signature_algs_cert, option separately configures acceptable algorithms for certificate chain signatures.

If signature_algs is specified but not signature_algs_cert the value of signature_algs will implicitly be used for signature_algs_cert; however if none of them are explicitly specified certificate signatures are verified against default signature_algs (with additional legacy SHA-1 algorithms — see note below).

Note

Currently using the default signature_algs will add signature_algs_cert that allows signature algorithms using SHA-1 as pseudo random function for certificate signatures. This is not allowed by default for protocol signatures. It is expected to be removed after 2030, when such certificates should have been phased out.

Post Quantum Algorithms

Post-Quantum Cryptography (PQC) algorithms are designed to resist attacks from future cryptographically relevant quantum computers (CRQCs), which are expected to break algorithms such as RSA and ECC. PQC is only available in TLS-1.3.

Note

Even though CRQCs do not yet exist, enabling PQC protects against "harvest now, decrypt later" attacks where an adversary records encrypted traffic today for future decryption.

PQC algorithms generally require more computation and network bandwidth than classical algorithms. Key sizes, signatures, and ciphertexts are larger.

For key exchange, several ML-KEM hybrid groups are supported. By default, only x25519mlkem768 is offered — a hybrid that combines classical X25519 with ML-KEM-768 to balance current security with future quantum resistance, as the newer algorithms are less battle-tested.

For authentication, the signature algorithms ML-DSA and SLH-DSA are supported. ML-DSA is preferred due to faster signing and smaller signatures. Using PQC signature algorithms requires appropriate PQC certificates and keys.

Privacy and Integrity

The protocol version TLS-1.3 is a major upgrade of the protocol over previous versions, and supporting both TLS-1.3 and TLS-1.2 will require a configuration including options from both.

TLS 1.3 significantly improves session handling over TLS 1.2 by reducing the handshake from two round-trips (2-RTT) to one (1-RTT). It mandates forward secrecy, encrypts more of the handshake, and introduces 0-RTT resumption for previously visited sites.

The protocol itself will prevent version downgrade when using TLS-1.3 and TLS-1.2, which are the default supported versions. All other TLS versions still configurable are legacy versions. Datagram transport layer security, DTLS-1.2 over User Datagram Protocol (UDP) can also be configured and has functionality similar to TLS-1.2 but will always be less reliable and may lose application data just like plain UDP communication. DTLS over other transports can possibly be achieved but not out of the box. DTLS-1.3 is currently not supported.

Cipher Suites

TLS-1.3 does not share any cipher suites with previous protocol versions. You will need to include at least one cipher suite for both TLS-1.3 and TLS-1.2 to be able to support both versions in the ciphers option.

TLS 1.3 uses only modern Authenticated Encryption with Associated Data (AEAD) cipher suites, so does the ssl application's TLS-1.2 default.

Session Key Renewal

Renegotiation options only apply to versions prior to TLS-1.3. TLS-1.3 replaces renegotiation with the key update mechanism, which only handles session key rotation and does not allow renegotiating cipher suites or certificates mid-connection.

A server can disable client-initiated renegotiation with the client_renegotiation option to avoid possible DoS-attacks.

By default, the server mitigates renegotiation abuse by enforcing a 12-second delay between client initiated renegotiations.

Key Exchange Groups

TLS-1.3 decouples key exchange algorithms from cipher suites. The key exchange algorithms are configured using the supported_groups option. In TLS-1.2 in addition to the cipher suites the options eccs, dh, dhfile, are available for configuring the key exchange.

TLS 1.3 removes static RSA, supporting only ephemeral Diffie-Hellman, which provides mandatory Perfect Forward Secrecy (PFS), so does the ssl application's TLS-1.2 default.

Pre-Shared Keys

Warning

Do not use the same Pre-Shared Key (PSK) across both TLS 1.2 and TLS 1.3, as it is considered unsafe.

In TLS-1.2, PSK is supported by PSK cipher suites, which generally lack forward secrecy unless combined with DHE or ECDHE key exchange. In TLS-1.3, PSK are most commonly used together with a key exchange algorithm, providing forward secrecy, although a PSK only option still exists.

Early Data

Early data (0-RTT) in TLS-1.3 is not forward secret and is vulnerable to replay attacks. The server option early_data is disabled by default.

Warning

Only enable early data if your application can safely handle replayed requests (that is for instance, idempotent HTTP methods).

See Early Data in TLS-1.3 for mitigation strategies and examples.

Authenticity

Certificate verification is essential for establishing trust in TLS connections. The ssl application provides several mechanisms for customizing and strengthening certificate validation.

Certificate and Keys

Use the certs_keys option to be able to configure more than one possible certificate for the client or server. The best one compatible with the peer will be chosen.

Verify Function

The verify_fun option lets you customize certificate path validation for both TLS clients and servers. Use it to add application-specific checks beyond the standard chain verification.

Warning

However, the verify_fun can also be used to accept certain errors. Doing so is at your own risk and will weaken the security properties of your application. Legacy client verify option set to the value verify_none skips all certificate verification errors using a special verify_fun and should only be used for testing and debugging purposes.

Note

On the server side, verify_none is default as client certification is an optional feature of the protocol and it needs configuring. When client certification is configured, setting verify option to verify_peer, the server legacy option fail_if_no_peer_cert defaults to true.

To summarize:

Always use verify_peer on the client side (default since OTP 26)

Avoid accepting {bad_cert, _} errors in verify_fun unless there is some edge-case workaround that you have confidence in excluding.

When enabling client certification on the server, ensure fail_if_no_peer_cert is true (default since OTP 26).

Certificate Revocation Verification

Certificate revocation verification is important for security and needs to be performed. However it requires some application specific knowledge to set it up correctly, hence the option crl_check default to false. Use true to verify the entire certificate chain, or peer to verify only the peer certificate.

Warning

The best_effort value is legacy and insecure — it silently accepts certificates when revocation status cannot be determined.

The built-in Certificate Revocation List (CRL) cache can be pre-populated via ssl_crl_cache:insert/1 or configured to fetch CRLs from HTTP distribution points in certificates. For custom CRL sources, implement the ssl_crl_cache_api behaviour.

The client can request Online Certificate Status Protocol (OCSP) stapling from the server with the stapling option (disabled by default). In TLS-1.2, only end-entity certificate stapling is supported as opposed to TLS-1.3. If the server does not provide a staple, the connection by default fails with {bad_cert, missing_ocsp_staple}.

A custom verify_fun can intercept this to implement fallback revocation checking (that is, direct CRL fetch).

Warning

Accepting {bad_cert, missing_ocsp_staple} without performing alternative revocation checking is insecure, as it allows a MITM attacker to suppress revocation information by omitting the staple.

Note

The ssl application does not perform direct OCSP queries (client contacting the OCSP responder via the certificate's Authority Information Access (AIA) extension), only OCSP stapling (server-provided responses in the TLS handshake) is supported to be verified by the client. The Erlang server has no stapling support. Also, OCSP support seems to be on the decline, for instance Let's Encrypt has dropped it.

Standards Compliance

Purpose

This section describes the current state of standards compliance of the ssl application.

Common (prior to TLS 1.3)

For security reasons RSA key exchange cipher suites are no longer supported by default, but can be configured. (OTP 21)

For security reasons DES cipher suites are no longer supported by default, but can be configured. (OTP 20)

For security reasons 3DES cipher suites are no longer supported by default, but can be configured. (OTP 21)

Renegotiation Indication Extension RFC 5746 is supported

Ephemeral Diffie-Hellman cipher suites are supported, but not Diffie Hellman Certificates cipher suites.

Elliptic Curve cipher suites are supported if the Crypto application supports it and named curves are used.

Export cipher suites are not supported as the U.S. lifted its export restrictions in early 2000.

IDEA cipher suites are not supported as they have become deprecated by the TLS 1.2 specification so it is not motivated to implement them.

Compression is not supported.

It is possible to use Pre-Shared Key (PSK) and Secure Remote Password (SRP) cipher suites, but they are not enabled by default and need addition configuration.

Common

CRL validation is supported.

Policy certificate extensions are supported. (OTP 27)

'Server Name Indication' extension (RFC 6066) is supported.

Application Layer Protocol Negotiation (ALPN) and its successor Next Protocol Negotiation (NPN) are supported.

SSL 2.0

For security reasons SSL-2.0 is not supported. Interoperability with SSL-2.0 enabled clients dropped. (OTP 21)

SSL 3.0

For security reasons SSL-3.0 is no longer supported at all. (OTP 23)

For security reasons SSL-3.0 is no longer supported by default, but can be configured. (OTP 19)

TLS 1.0

For security reasons TLS-1.0 is no longer supported by default, but can be configured. (OTP 22)

TLS 1.1

For security reasons TLS-1.1 is no longer supported by default, but can be configured. (OTP 22)

TLS 1.2

Supported

DTLS 1.0

For security reasons DTLS-1.0 (based on TLS 1.1) is no longer supported by default, but can be configured. (OTP 22)

DTLS 1.2

Supported (based on TLS 1.2)

DTLS 1.3

Not yet supported

TLS 1.3

OTP-22 introduces support for TLS 1.3. The current implementation supports a selective set of cryptographic algorithms:

Key Exchange: ECDHE groups supported by default

Groups: all standard groups supported for the Diffie-Hellman key exchange

Groups: Support brainpool groups from RFC 8734

Ciphers: all mandatory cipher suites are supported

Signature Algorithms: All algorithms form RFC 8446

Certificates: RSA, ECDSA and EDDSA keys

Other notable features:

PSK and session resumption is supported (stateful and stateless tickets)

Anti-replay protection using Bloom-filters with stateless tickets

Early data and 0-RTT is supported

Key and Initialization Vector Update is supported

For more detailed information see the Standards Compliance below.

The following table describes the current state of standards compliance for TLS 1.3.

(C = Compliant, NC = Non-Compliant, PC = Partially-Compliant, NA = Not Applicable)

Section | Feature | State | Since
1.3. Updates Affecting TLS 1.2 |  | C | 24.1
| Version downgrade protection mechanism | C | 22
| RSASSA-PSS signature schemes | C | 24.1
| supported_versions (ClientHello) extension | C | 22
| signature_algorithms_cert extension | C | 24.1
2. Protocol Overview |  | PC | 22
| (EC)DHE | C | 22
| PSK-only | NC |
| PSK with (EC)DHE | C | 22.2
2.1. Incorrect DHE share | HelloRetryRequest | C | 22
2.2. Resumption and Pre-Shared Key (PSK) |  | C | 22.2
2.3. 0-RTT Data |  | PC | 23.3
4.1.1. Cryptographic Negotiation |  | C | 22.2
| supported_groups extension | C | 22
| signature_algorithms extension | C | 22
| pre_shared_key extension | C | 22.2
4.1.2. Client Hello | Client | PC | 22.1
| server_name (RFC6066) | C | 23.2
| max_fragment_length (RFC6066) | C | 23.0
| status_request (RFC6066) | C | 27.0
| supported_groups (RFC7919) | C | 22.1
| signature_algorithms (RFC8446) | C | 22.1
| use_srtp (RFC5764) | C | 26.0
| heartbeat (RFC6520) | NC |
| application_layer_protocol_negotiation (RFC7301) | C | 22.1
| signed_certificate_timestamp (RFC6962) | NC |
| client_certificate_type (RFC7250) | NC |
| server_certificate_type (RFC7250) | NC |
| padding (RFC7685) | NC |
| key_share (RFC8446) | C | 22.1
| pre_shared_key (RFC8446) | C | 22.2
| psk_key_exchange_modes (RFC8446) | C | 22.2
| early_data (RFC8446) | C | 23.3
| cookie (RFC8446) | C | 23.1
| supported_versions (RFC8446) | C | 22.1
| certificate_authorities (RFC8446) | C | 24.3
| oid_filters (RFC8446) | NC |
| post_handshake_auth (RFC8446) | NC |
| signature_algorithms_cert (RFC8446) | C | 22.1
| Server | PC | 22
| server_name (RFC6066) | C | 23.2
| max_fragment_length (RFC6066) | C | 23.0
| status_request (RFC6066) | NC |
| supported_groups (RFC7919) | C | 22
| signature_algorithms (RFC8446) | C | 22
| use_srtp (RFC5764) | C | 26.0
| heartbeat (RFC6520) | NC |
| application_layer_protocol_negotiation (RFC7301) | C | 22.1
| signed_certificate_timestamp (RFC6962) | NC |
| client_certificate_type (RFC7250) | NC |
| server_certificate_type (RFC7250) | NC |
| padding (RFC7685) | NC |
| key_share (RFC8446) | C | 22
| pre_shared_key (RFC8446) | C | 22.2
| psk_key_exchange_modes (RFC8446) | C | 22.2
| early_data (RFC8446) | C | 23.3
| cookie (RFC8446) | C | 23.1
| supported_versions (RFC8446) | C | 22
| oid_filters (RFC8446) | NC |
| post_handshake_auth (RFC8446) | NC |
| signature_algorithms_cert (RFC8446) | C | 22
4.1.3. Server Hello | Client | C | 22.2
| Version downgrade protection | C | 22.1
| key_share (RFC8446) | C | 22.1
| pre_shared_key (RFC8446) | C | 22.2
| supported_versions (RFC8446) | C | 22.1
| use_srtp (RFC5764) | C | 26.0
| Server | C | 22.2
| Version downgrade protection | C | 22
| key_share (RFC8446) | C | 22
| pre_shared_key (RFC8446) | C | 22.2
| supported_versions (RFC8446) | C | 22
| use_srtp (RFC5764) | C | 26.0
4.1.4. Hello Retry Request | Server | C | 22
| key_share (RFC8446) | C | 22
| cookie (RFC8446) | C | 23.1
| supported_versions (RFC8446) | C | 22
4.2.1. Supported Versions | Client | C | 22.1
| Server | C | 22
4.2.2. Cookie | Client | C | 23.1
| Server | C | 23.1
4.2.3. Signature Algorithms | Client | C | 24
| rsa_pkcs1_sha256 | C | 22.1
| rsa_pkcs1_sha384 | C | 22.1
| rsa_pkcs1_sha512 | C | 22.1
| ecdsa_secp256r1_sha256 | C | 22.1
| ecdsa_secp384r1_sha384 | C | 22.1
| ecdsa_secp521r1_sha512 | C | 22.1
| rsa_pss_rsae_sha256 | C | 22.1
| rsa_pss_rsae_sha384 | C | 22.1
| rsa_pss_rsae_sha512 | C | 22.1
| ed25519 | C | 24
| ed448 | C | 24
| rsa_pss_pss_sha256 | C | 23
| rsa_pss_pss_sha384 | C | 23
| rsa_pss_pss_sha512 | C | 23
| rsa_pkcs1_sha1 | C | 22.1
| ecdsa_sha1 | C | 22.1
| Server | C | 24
| rsa_pkcs1_sha256 | C | 22
| rsa_pkcs1_sha384 | C | 22
| rsa_pkcs1_sha512 | C | 22
| ecdsa_secp256r1_sha256 | C | 22.1
| ecdsa_secp384r1_sha384 | C | 22.1
| ecdsa_secp521r1_sha512 | C | 22.1
| rsa_pss_rsae_sha256 | C | 22
| rsa_pss_rsae_sha384 | C | 22
| rsa_pss_rsae_sha512 | C | 22
| ed25519 | C | 24
| ed448 | C | 24
| rsa_pss_pss_sha256 | C | 23
| rsa_pss_pss_sha384 | C | 23
| rsa_pss_pss_sha512 | C | 23
| rsa_pkcs1_sha1 | C | 22
| ecdsa_sha1 | C | 22
4.2.4. Certificate Authorities | Client | C | 24.3
| Server | C | 24.3
4.2.5. OID Filters | Client | NC |
| Server | NC |
4.2.6. Post-Handshake Client Authentication | Client | NC |
| Server | NC |
4.2.7. Supported Groups | Client | C | 22.1
| secp256r1 | C | 22.1
| secp384r1 | C | 22.1
| secp521r1 | C | 22.1
| x25519 | C | 22.1
| x448 | C | 22.1
| ffdhe2048 | C | 22.1
| ffdhe3072 | C | 22.1
| ffdhe4096 | C | 22.1
| ffdhe6144 | C | 22.1
| ffdhe8192 | C | 22.1
| Server | C | 22
| secp256r1 | C | 22
| secp384r1 | C | 22
| secp521r1 | C | 22
| x25519 | C | 22
| x448 | C | 22
| ffdhe2048 | C | 22
| ffdhe3072 | C | 22
| ffdhe4096 | C | 22
| ffdhe6144 | C | 22
| ffdhe8192 | C | 22
4.2.8. Key Share | Client | C | 22.1
| Server | C | 22
4.2.9. Pre-Shared Key Exchange Modes | Client | C | 22.2
| Server | C | 22.2
4.2.10. Early Data Indication | Client | C | 23.3
| Server | C | 23.3
4.2.11. Pre-Shared Key Extension | Client | C | 22.2
| Server | C | 22.2
4.2.11.1. Ticket Age | Client | C | 22.2
| Server | C | 22.2
4.2.11.2. PSK Binder | Client | C | 22.2
| Server | C | 22.2
4.2.11.3. Processing Order | Client | NC |
| Server | NC |
4.3.1. Encrypted Extensions | Client | PC | 22.1
| server_name (RFC6066) | C | 23.2
| max_fragment_length (RFC6066) | C | 23.0
| supported_groups (RFC7919) | NC |
| use_srtp (RFC5764) | NC |
| heartbeat (RFC6520) | NC |
| application_layer_protocol_negotiation (RFC7301) | C | 23.0
| client_certificate_type (RFC7250) | NC |
| server_certificate_type (RFC7250) | NC |
| early_data (RFC8446) | C | 23.3
| Server | PC | 22
| server_name (RFC6066) | C | 23.2
| max_fragment_length (RFC6066) | C | 23.0
| supported_groups (RFC7919) | NC |
| use_srtp (RFC5764) | NC |
| heartbeat (RFC6520) | NC |
| application_layer_protocol_negotiation (RFC7301) | C | 23.0
| client_certificate_type (RFC7250) | NC |
| server_certificate_type (RFC7250) | NC |
| early_data (RFC8446) | C | 23.3
4.3.2. Certificate Request | Client | PC | 22.1
| status_request (RFC6066) | NC |
| signature_algorithms (RFC8446) | C | 22.1
| signed_certificate_timestamp (RFC6962) | NC |
| certificate_authorities (RFC8446) | C | 24.3
| oid_filters (RFC8446) | NC |
| signature_algorithms_cert (RFC8446) | C | 22.1
| Server | PC | 22
| status_request (RFC6066) | NC |
| signature_algorithms (RFC8446) | C | 22
| signed_certificate_timestamp (RFC6962) | NC |
| certificate_authorities (RFC8446) | C | 24.3
| oid_filters (RFC8446) | NC |
| signature_algorithms_cert (RFC8446) | C | 22
4.4.1. The Transcript Hash |  | C | 22
4.4.2. Certificate | Client | PC | 22.1
| Arbitrary certificate chain orderings | C | 22.2
| Extraneous certificates in chain | C | 23.2
| status_request (RFC6066) | C | 27.0
| signed_certificate_timestamp (RFC6962) | NC |
| Server | PC | 22
| status_request (RFC6066) | NC |
| signed_certificate_timestamp (RFC6962) | NC |
4.4.2.1. OCSP Status and SCT Extensions | Client | PC | 27.0
| Server | NC |
4.4.2.2. Server Certificate Selection |  | C | 24.3
| The certificate type MUST be X.509v3, unless explicitly negotiated otherwise | C | 22
| The server's end-entity certificate's public key (and associated restrictions) MUST be compatible with the selected authentication algorithm from the client's "signature_algorithms" extension (currently RSA, ECDSA, or EdDSA). | C | 22
| The certificate MUST allow the key to be used for signing with a signature scheme indicated in the client's "signature_algorithms"/"signature_algorithms_cert" extensions | C | 22
| The "server_name" and "certificate_authorities" extensions are used to guide certificate selection. As servers MAY require the presence of the "server_name" extension, clients SHOULD send this extension, when applicable. | C | 24.3
4.4.2.3. Client Certificate Selection |  | PC | 22.1
| The certificate type MUST be X.509v3, unless explicitly negotiated otherwise | C | 22.1
| If the "certificate_authorities" extension in the CertificateRequest message was present, at least one of the certificates in the certificate chain SHOULD be issued by one of the listed CAs. | C | 24.3
| The certificates MUST be signed using an acceptable signature algorithm | C | 22.1
| If the CertificateRequest message contained a non-empty "oid_filters" extension, the end-entity certificate MUST match the extension OIDs that are recognized by the client | NC |
4.4.2.4. Receiving a Certificate Message | Client | C | 22.1
| Server | C | 22
4.4.3. Certificate Verify | Client | C | 22.1
| Server | C | 22
4.4.4. Finished | Client | C | 22.1
| Server | C | 22
4.5. End of Early Data | Client | C | 23.3
| Server | C | 23.3
4.6.1. New Session Ticket Message | Client | C | 23.3
| early_data (RFC8446) | C | 23.3
| Server | C | 23.3
| early_data (RFC8446) | C | 23.3
4.6.2. Post-Handshake Authentication | Client | NC |
| Server | NC |
4.6.3. Key and Initialization Vector Update | Client | C | 22.3
| Server | C | 22.3
5.1. Record Layer |  | C | 22
| MUST NOT be interleaved with other record types | C | 22
| MUST NOT span key changes | C | 22
| MUST NOT send zero-length fragments | C | 22
| Alert messages MUST NOT be fragmented | C | 22
5.2. Record Payload Protection |  | C | 22
5.3. Per-Record Nonce |  | C | 22
5.4. Record Padding |  | PC | 22
| MAY choose to pad | NC |
| MUST NOT send Handshake and Alert records that have a zero-length TLSInnerPlaintext.content | NC |
| The padding sent is automatically verified | C | 22
5.5. Limits on Key Usage |  | C | 22.3
6.1. Closure Alerts |  | 22 |

| close_notify | C | 22 |
| user_cancelled | C | 22 |

6.2. Error Alerts |  | PC | 22
7.1. Key Schedule |  | C | 22
7.2. Updating Traffic Secrets |  | C | 22
7.3. Traffic Key Calculation |  | C | 22
7.5. Exporters |  | PC | 26.3
8. 0-RTT and Anti-Replay |  | C | 22.2
8.1. Single-Use Tickets |  | C | 22.2
8.2. Client Hello Recording |  | C | 22.2
8.3. Freshness Checks |  | C | 22.2
9.1. Mandatory-to-Implement Cipher Suites |  | C | 22.1
| MUST implement the TLS_AES_128_GCM_SHA256 | C | 22
| SHOULD implement the TLS_AES_256_GCM_SHA384 | C | 22
| SHOULD implement the TLS_CHACHA20_POLY1305_SHA256 | C | 22
| Digital signatures | C | 22.1
| MUST support rsa_pkcs1_sha256 (for certificates) | C | 22
| MUST support rsa_pss_rsae_sha256 (for CertificateVerify and certificates) | C | 22
| MUST support ecdsa_secp256r1_sha256 | C | 22.1
| Key Exchange | C | 22
| MUST support key exchange with secp256r1 | C | 22
| SHOULD support key exchange with X25519 | C | 22
9.2. Mandatory-to-Implement Extensions |  | C | 23.2
| Supported Versions | C | 22
| Cookie | C | 23.1
| Signature Algorithms | C | 22
| Signature Algorithms Certificate | C | 22
| Negotiated Groups | C | 22
| Key Share | C | 22
| Server Name Indication | C | 23.2
| MUST send and use these extensions | C | 22.2
| "supported_versions" is REQUIRED for ClientHello, ServerHello and HelloRetryRequest | C | 22.1
| "signature_algorithms" is REQUIRED for certificate authentication | C | 22
| "supported_groups" is REQUIRED for ClientHello messages using (EC)DHE key exchange | C | 22
| "key_share" is REQUIRED for (EC)DHE key exchange | C | 22
| "pre_shared_key" is REQUIRED for PSK key agreement | C | 22.2
| "psk_key_exchange_modes" is REQUIRED for PSK key agreement | C | 22.2
| TLS 1.3 ClientHello | C | 22.1
| If not containing a "pre_shared_key" extension, it MUST contain both a "signature_algorithms" extension and a "supported_groups" extension. | C | 22.1
| If containing a "supported_groups" extension, it MUST also contain a "key_share" extension, and vice versa. An empty KeyShare.client_shares vector is permitted. | C | 22.1
| TLS 1.3 ServerHello | C | 23.2
| MUST support the use of the "server_name" extension | C | 23.2
9.3. Protocol Invariants |  | C | 22.1
| MUST correctly handle extensible fields | C | 22.1
| A client sending a ClientHello MUST support all parameters advertised in it. Otherwise, the server may fail to interoperate by selecting one of those parameters. | C | 22.1
| A server receiving a ClientHello MUST correctly ignore all unrecognized cipher suites, extensions, and other parameters. Otherwise, it may fail to interoperate with newer clients. In TLS 1.3, a client receiving a CertificateRequest or NewSessionTicket MUST also ignore all unrecognized extensions. | C | 22.1
| A middlebox which terminates a TLS connection MUST behave as a compliant TLS server | NA |
| A middlebox which forwards ClientHello parameters it does not understand MUST NOT process any messages beyond that ClientHello. It MUST forward all subsequent traffic unmodified. Otherwise, it may fail to interoperate with newer clients and servers. | NA |
B.4. Cipher Suites |  | C | 23
| TLS_AES_128_GCM_SHA256 | C | 22
| TLS_AES_256_GCM_SHA384 | C | 22
| TLS_CHACHA20_POLY1305_SHA256 | C | 22
| TLS_AES_128_CCM_SHA256 | C | 22
| TLS_AES_128_CCM_8_SHA256 | C | 23
C.1. Random Number Generation and Seeding |  | C | 22
C.2. Certificates and Authentication |  | C | 22
C.3. Implementation Pitfalls |  | PC | 22
C.4. Client Tracking Prevention |  | C | 22.2
C.5. Unauthenticated Operation |  | C | 22
D.1. Negotiating with an Older Server |  | C | 22.2
D.2. Negotiating with an Older Client |  | C | 22
D.3. 0-RTT Backward Compatibility |  | NC |
D.4. Middlebox Compatibility Mode |  | C | 23
D.5. Security Restrictions Related to Backward Compatibility |  | C | 22

Table: Standards Compliance

ssl

Interface functions for TLS (Transport Layer Security) and DTLS (Datagram Transport Layer Security).

Note

The application's name is still SSL because the first versions of the TLS protocol were named SSL (Secure Socket Layer). However, no version of the old SSL protocol is supported by this application.

Example:

1> ssl:start(), ssl:connect("google.com", 443, [{verify, verify_peer},
    {cacerts, public_key:cacerts_get()}]).
{ok,{sslsocket, [...]}}

See Examples for detailed usage and more examples of this API.

Special Erlang node configuration for the application can be found in SSL Application.

Summary

Types: Algorithms

cipher()

Cipher algorithms that can be used for payload encryption.

cipher_filters()

Filter that allows you to customize cipher suite list.

cipher_suites()

A list of cipher suites that should be supported.

ciphers()

Cipher suite formats.

erl_cipher_suite()

Erlang cipher suite representation

group()

TLS-1.3 key exchange configuration.

hash()

Hash algorithms used together with signing and encryption functions.

kex_algo()

Cipher Suite Key Exchange Algorithm will be any in TLS-1.3 as key exchange is no longer part of cipher suite configuration in TLS-1.3.

named_curve()

Key exchange configuration prior to TLS-1.3.

post_quantum_schemes()

Supported in TLS-1.3 only. ML-DSA since 28.1, SLH-DSA since 28.3.

rsassa_pss_scheme()

Supported in TLS-1.3 and TLS-1.2.

sha2()

SHA2 hash algorithms.

sign_algo()

Signature algorithms.

sign_scheme()

Signature schemes, defined by TLS-1.3, and replacing signature algorithms from TLS-1.2.

signature_algs()

Explicitly list acceptable signature algorithms for certificates and handshake messages in the preferred order.

srp_param_type()

SRP cipher suite configuration prior to TLS-1.3.

Types: Algorithms Legacy

legacy_cipher()

Cipher algorithms that are no longer supported by default for security reasons.

legacy_hash()

Hash algorithms that are no longer supported by default for security reasons.

legacy_named_curve()

Key exchange configuration prior to TLS-1.3.

legacy_sign_algo()

Signature algorithms that are no longer supported by default for security reasons.

legacy_sign_scheme()

This is only used for certificate signatures if TLS-1.2 is negotiated, meaning that the peer only supports TLS-1.2, but we also support TLS-1.3.

old_cipher_suite()

For backwards compatibility only; do not use.

Types: Certificates

anchor_fun()

Claim an intermediate CA in the chain as trusted.

cert_key_conf()

Configuration of the entity certificate and its corresponding key.

crl_cache_opts()

Options for using built-in CRL cache support.

key()

The user's private key.

Types: Client Options

client_option()

The following options are specific to the client side, or have different semantics for the client and server

client_option_cert()

Certificate-related options specific to the client side, or with different semantics for the client and server.

client_option_legacy()

Legacy client options.

client_option_pre_tls13()

Options only relevant to TLS versions prior to TLS-1.3.

client_option_tls13()

Options only relevant for TLS-1.3.

session_ticket()

Types: Client and Server Options

common_option()

Options common to both client and server side.

common_option_cert()

Common certificate related options to both client and server.

common_option_dtls()

Common options to client and server only valid for DTLS.

common_option_legacy()

Legacy options considered deprecated in favor of other options, insecure to use, or plainly not relevant anymore.

common_option_pre_tls13()

Options common to client and server side prior to TLS-1.3.

common_option_tls13()

Common options to both client and server for TLS-1.3.

Types: Deprecated

prf_random() deprecated

Types: Info

connection_info()

Key value list convening some information about the established connection.

connection_info_keys()

TLS connection keys for which information can be retrieved.

connection_info_pre_tls13()

TLS connection information relevant prior to TLS-1.3.

security_info()

TLS connection information that can be used for NSS key logging.

Types: Server Options

server_option()

Options specific to the server side, or with different semantics for the client and server.

server_option_cert()

Certificate related options for a server.

server_option_legacy()

Legacy server options.

server_option_pre_tls13()

Options only relevant to TLS versions prior to TLS-1.3.

server_option_tls13()

Options only relevant for TLS-1.3.

Types: Socket

active_msgs()

The type for the messages that are delivered to the owner of a TLS/DTLS socket in active mode.

dtls_legacy_version()

A DTLS protocol version that are no longer supported by default for security reasons and scheduled for removal in OTP 30.

dtls_version()

DTLS protocol version.

error_alert()

If a TLS connection fails a TLS protocol ALERT will be sent/received.

host()

A name or address to a host.

protocol_extensions()

Client hello extensions.

protocol_version()

TLS or DTLS protocol version.

reason()

Error reason for debug purposes.

session_id()

Identifies a TLS session prior to TLS-1.3.

socket()

A socket that can be used to perform a so-called "START-TLS", which means using an already connected socket previously used for plain TCP traffic and upgrading it to use TLS.

socket_option()

Options for the transport socket.

sslsocket()

An opaque reference to the TLS/DTLS connection.

tls_alert()

TLS Alert Protocol reasons.

tls_client_option()

An option that can be supplied to a TLS client.

tls_legacy_version()

A TLS protocol version that are no longer supported by default for security reasons and scheduled for removal in OTP 30.

tls_option()

An option related to the TLS/DTLS protocol.

tls_server_option()

An option that can be supplied to a TLS server.

tls_version()

TLS protocol version.

transport_option()

Transport option defines a callback module and message tags to handle the underlying transport socket.

Types

keylog_info()

keylog_item()

Client API

connect(TCPSocket, TLSOptions)

Equivalent to connect(TCPSocket, TLSOptions, infinity).

connect(TCPSocketOrHost, TLSOptionsOrPort, TimeoutOrTLSOptions)

Opens a TLS/DTLS connection.

connect(Host, Port, TLSOptions, Timeout)

Opens a TLS/DTLS connection to Host, Port.

Client and Server API

close(SslSocket)

Closes a TLS/DTLS connection.

close(SslSocket, How)

Closes or downgrades a TLS connection.

controlling_process(SslSocket, NewController)

Assigns a new controlling process to the SSL socket.

handshake_cancel(Socket)

Cancel the handshake with a fatal USER_CANCELED alert.

handshake_continue(HsSocket, Options)

Equivalent to handshake_continue(HsSocket, Options, infinity).

handshake_continue(HsSocket, Options, Timeout)

Continue the TLS handshake, possibly with new, additional, or changed options.

recv(SslSocket, Length)

Equivalent to recv(Socket, Length, infinity).

recv(SslSocket, Length, Timeout)

Receives a packet from a socket in passive mode.

send(SslSocket, Data)

Writes Data to SslSocket.

setopts(SslSocket, Options)

Sets options according to Options for socket SslSocket.

shutdown(SslSocket, How)

Immediately closes a socket in one or two directions.

Deprecated API

prf(SslSocket, Secret, Label, Seed, WantedLength) deprecated

Uses the Pseudo-Random Function (PRF) of a TLS session to generate extra key material.

Pre TLS-1.3 API

eccs()

Returns a list of all supported elliptic curves, including legacy curves, for all TLS/DTLS versions prior to TLS-1.3.

eccs(Version)

Returns the elliptic curves supported by default for Version.

renegotiate(SslSocket)

Initiates a new handshake.

Server API

handshake(HsSocket)

Equivalent to handshake(HsSocket, infinity).

handshake(HsSocket, OptionsOrTimeout)

Performs the TLS/DTLS server-side handshake.

handshake(Socket, Options, Timeout)

Performs the TLS/DTLS server-side handshake.

listen(Port, Options)

Creates an SSL listen socket.

transport_accept(ListenSocket)

Equivalent to transport_accept(ListenSocket, infinity).

transport_accept(ListenSocket, Timeout)

Accepts an incoming connection request on a listen socket.

TLS-1.3 Only API

groups()

Returns all supported groups in TLS 1.3.

groups(Description)

Returns default supported groups in TLS 1.3.

update_keys(SslSocket, Type)

Create new session keys.

Utility Functions

append_cipher_suites(Deferred, Suites)

Make Deferred suites become the least preferred suites.

cipher_suites(Description, Version)

Lists all available cipher suites corresponding to Description.

cipher_suites(Description, Version, StringType)

Equivalent to cipher_suites/2, but lists RFC or OpenSSL string names instead of erl_cipher_suite().

clear_pem_cache()

Clears the PEM cache.

connection_information(SslSocket)

Returns the most relevant information about the connection.

connection_information(SslSocket, Items)

Returns the requested information items about the connection if they are defined.

export_key_materials(SslSocket, Labels, Contexts, WantedLengths)

Equivalent to export_key_materials(TLSSocket, Labels, Contexts, WantedLengths, true).

export_key_materials(SslSocket, Labels, Contexts, WantedLengths, ConsumeSecret)

Uses a Pseudo-Random Function (PRF prior to TLS-1.3) or a Key Derivation Function (HKDF in TLS-1.3) for a TLS connection to generate and export keying materials.

filter_cipher_suites(Suites, Filters)

Removes cipher suites if any of the filter functions returns false for any part of the cipher suite.

format_error(Error)

Presents the error returned by an SSL function as a printable string.

getopts(SslSocket, OptionNames)

Gets the values of the specified socket options.

getstat(SslSocket)

Get statistics for the underlying socket.

getstat(SslSocket, Options)

Get one or more statistic values for the underlying socket.

negotiated_protocol(SslSocket)

Returns the protocol negotiated through ALPN or NPN extensions.

peercert(SslSocket)

The peer certificate is returned as a DER-encoded binary.

peername(SslSocket)

Returns the address and port number of the peer.

prepend_cipher_suites(Preferred, Suites)

Make Preferred suites become the most preferred suites.

signature_algs(Description, Version)

Lists all available signature algorithms corresponding to Description.

sockname(SslSocket)

Returns the local address and port number of socket SslSocket.

start()

Equivalent to start(temporary).

start(Type)

Starts the SSL application.

stop()

Stops the SSL application.

str_to_suite(CipherSuiteName)

Converts an RFC or OpenSSL name string to an erl_cipher_suite/0

suite_to_openssl_str(CipherSuite)

Converts an erl_cipher_suite() value to an OpenSSL name string.

suite_to_str(CipherSuite)

Converts an erl_cipher_suite() value to an RFC name string.

versions()

Lists information, mainly concerning TLS/DTLS versions, in runtime for debugging and testing purposes.

Types: Algorithms

cipher()

-type cipher() ::
          aes_256_gcm | aes_128_gcm | aes_256_ccm | aes_128_ccm | chacha20_poly1305 | aes_256_ccm_8 |
          aes_128_ccm_8 | aes_128_cbc | aes_256_cbc |
          legacy_cipher().

Cipher algorithms that can be used for payload encryption.

cipher_filters()

-type cipher_filters() ::
          [{key_exchange | cipher | mac | prf,
            fun((kex_algo() | cipher() | hash() | aead | default_prf) -> true | false)}].

Filter that allows you to customize cipher suite list.

cipher_suites()

(not exported)

-type cipher_suites() :: ciphers().

A list of cipher suites that should be supported.

Function ssl:cipher_suites/2 can be used to find all cipher suites that are supported by default and all cipher suites that can be configured.

If you compose your own cipher_suites/0 make sure they are filtered for crypto library support using ssl:filter_cipher_suites/2 .

The following function can help creating customized cipher suite lists:

ssl:append_cipher_suites/2

ssl:prepend_cipher_suites/2

ssl:suite_to_str/1

ssl:str_to_suite/1

ssl:suite_to_openssl_str/1

Note

Note that TLS-1.3 and TLS-1.2 use different sets of cipher suites. To support both versions, cipher suites from both sets need to be included. If the supplied list does not comply with the configured versions or crypto library, that is, resulting in an empty list, the option will fall back to its appropriate default value for the configured versions.

Non-default cipher suites, including anonymous cipher suites (prior to TLS 1.3), are supported for interoperability and testing purposes. These can be used by adding them to your cipher suite list. Note that they also need to be supported and enabled by the peer to be actually used, and they may require additional configuration; see srp_param_type().

ciphers()

-type ciphers() :: [erl_cipher_suite()] | string().

Cipher suite formats.

For backwards compatibility, cipher suites can be configured as a colon-separated string of cipher suite RFC names (or even old OpenSSL names). However, a more flexible approach is to use utility functions together with cipher_filters() if a customized cipher suite option is needed.

erl_cipher_suite()

-type erl_cipher_suite() ::
          #{key_exchange := kex_algo(),
            cipher := cipher(),
            mac := hash() | aead,
            prf := hash() | default_prf}.

Erlang cipher suite representation

Warning

Enabling cipher suites using RSA as a key exchange algorithm is strongly discouraged (only available prior to TLS-1.3). For some configurations software preventions may exist, and can make them usable if they work, but relying on them to work is risky. There exists more reliable cipher suites that can be used instead.

group()

-type group() ::
          x25519mlkem768 | secp384r1mlkem1024 | secp256r1mlkem768 | mlkem1024 | mlkem768 | mlkem512 |
          x25519 | x448 | secp256r1 | secp384r1 | secp521r1 | brainpoolP512r1tls13 |
          brainpoolP384r1tls13 | brainpoolP256r1tls13 | ffdhe2048 | ffdhe3072 | ffdhe4096 | ffdhe6144 |
          ffdhe8192.

TLS-1.3 key exchange configuration.

hash()

-type hash() :: sha2() | legacy_hash().

Hash algorithms used together with signing and encryption functions.

kex_algo()

-type kex_algo() ::
          ecdhe_ecdsa | ecdh_ecdsa | ecdh_rsa | rsa | dhe_rsa | dhe_dss | srp_rsa | srp_dss | dhe_psk |
          rsa_psk | psk | ecdh_anon | dh_anon | srp_anon | any.

Cipher Suite Key Exchange Algorithm will be any in TLS-1.3 as key exchange is no longer part of cipher suite configuration in TLS-1.3.

named_curve()

-type named_curve() ::
          x25519 | x448 | secp521r1 | brainpoolP512r1 | brainpoolP384r1 | secp384r1 | brainpoolP256r1 |
          secp256r1 |
          legacy_named_curve().

Key exchange configuration prior to TLS-1.3.

post_quantum_schemes()

(not exported)

-type post_quantum_schemes() :: crypto:mldsa() | crypto:slh_dsa().

Supported in TLS-1.3 only. ML-DSA since 28.1, SLH-DSA since 28.3.

rsassa_pss_scheme()

(not exported)

-type rsassa_pss_scheme() ::
          rsa_pss_rsae_sha512 | rsa_pss_rsae_sha384 | rsa_pss_rsae_sha256 | rsa_pss_pss_sha512 |
          rsa_pss_pss_sha384 | rsa_pss_pss_sha256.

Supported in TLS-1.3 and TLS-1.2.

sha2()

(not exported)

-type sha2() :: sha512 | sha384 | sha256.

SHA2 hash algorithms.

sign_algo()

-type sign_algo() :: eddsa | ecdsa | rsa | legacy_sign_algo().

Signature algorithms.

sign_scheme()

-type sign_scheme() ::
          eddsa_ed25519 | eddsa_ed448 | ecdsa_secp521r1_sha512 | ecdsa_secp384r1_sha384 |
          ecdsa_secp256r1_sha256 | ecdsa_brainpoolP512r1tls13_sha512 |
          ecdsa_brainpoolP384r1tls13_sha384 | ecdsa_brainpoolP256r1tls13_sha256 |
          post_quantum_schemes() |
          rsassa_pss_scheme() |
          legacy_sign_scheme().

Signature schemes, defined by TLS-1.3, and replacing signature algorithms from TLS-1.2.

Explicitly list acceptable signature schemes in the preferred order.

Overrides the algorithms supplied in signature_algs option for certificates. In addition to the signature_algorithms extension from TLS 1.2, TLS 1.3 (RFC 5246 Section 4.2.3) adds the signature_algorithms_cert extension which enables having special requirements on the signatures used in the certificates that differs from the requirements on digital signatures as a whole. If this is not required this extension is not needed.

The client will send a signature_algorithms_cert extension (in the client hello message), if TLS version 1.2 (back-ported to TLS 1.2 in 24.1) or later is used, and the signature_algs_cert option is explicitly specified. By default, only the signature_algs extension is sent with the exception of when signature_algs option is not explicitly specified, in which case it will append the rsa_pkcs1_sha1 algorithm to the default value of signature_algs and use it as value for signature_algs_cert to allow certificates to have this signature but still disallow sha1 use in the TLS protocol, since 27.0.1 and 26.2.5.2.

Note

Note that supported signature schemes for TLS-1.2 are legacy_sign_scheme() and rsassa_pss_scheme().

signature_algs()

-type signature_algs() :: [{hash(), sign_algo()} | sign_scheme()].

Explicitly list acceptable signature algorithms for certificates and handshake messages in the preferred order.

The client will send its list as the client hello signature_algorithm extension introduced in TLS-1.2; see Section 7.4.1.4.1 in RFC 5246. Before TLS-1.2, these algorithms where implicitly chosen and partly derived from the cipher suite.

In TLS-1.2 a somewhat more explicit negotiation is made possible using a list of {HashAlgo, SignAlgo} tuples.

In TLS-1.3, these algorithm pairs are replaced by signature schemes that are completely decoupled from the cipher suite.

Signature algorithms used for certificates can be overridden by the signature schemes supplied by the signature_algs_cert option.

The TLS-1.2 default is Default_TLS_12_Alg_Pairs interleaved with rsa_pss_schemes since ssl-11.0 (Erlang/OTP 25). pss_pss is preferred over pss_rsae, which in turn is preferred over rsa.

The list for Default_TLS_12_Alg_Pairs is defined as follows:

[
{sha512, ecdsa},
{sha512, rsa},
{sha384, ecdsa},
{sha384, rsa},
{sha256, ecdsa},
{sha256, rsa}
]

Change

Support for {md5, rsa} was removed from the TLS-1.2 default in ssl-8.0 (Erlang/OTP 22).

Support for {sha, _} (SHA1) and {sha224, _} was removed from the TLS-1.2 default in ssl-11.0 (Erlang/OTP 26).

The list for rsa_pss_schemes is defined as follows:

[rsa_pss_pss_sha512,
rsa_pss_pss_sha384,
rsa_pss_pss_sha256,
rsa_pss_rsae_sha512,
rsa_pss_rsae_sha384,
rsa_pss_rsae_sha256]

The list of TLS_13_Legacy_Schemes is defined as follows:

[
%% Legacy algorithms only applicable to certificate signatures
rsa_pkcs1_sha512, %% Corresponds to {sha512, rsa}
rsa_pkcs1_sha384, %% Corresponds to {sha384, rsa}
rsa_pkcs1_sha256, %% Corresponds to {sha256, rsa}
]

The list of Default_TLS_13_Schemes is defined as follows:

[
%% EDDSA
eddsa_ed25519,
eddsa_ed448

%% ECDSA
ecdsa_secp521r1_sha512,
ecdsa_secp384r1_sha384,
ecdsa_secp256r1_sha256] ++

%% RSASSA-PSS
rsa_pss_schemes()

Change

EDDSA was made highest priority in ssl-10.8 (Erlang/OTP 25).

The TLS-1.3 default is Default_TLS_13_Schemes.

If both TLS-1.3 and TLS-1.2 are supported the default is:

Default_TLS_13_Schemes ++ TLS_13_Legacy_Schemes ++
Default_TLS_12_Alg_Pairs %% not represented in TLS_13_Legacy_Schemes

to ensure that appropriate algorithms can be chosen for the negotiated version.

Note

TLS-1.2 algorithms will not be negotiated for TLS-1.3, but the TLS-1.3 RSASSA-PSS (rsassa_pss_scheme()) signature schemes can be negotiated also for TLS-1.2 from Erlang/OTP 24.1 (fully working from Erlang/OTP 24.1.3). However, if both TLS 1.3 and TLS 1.2 are supported using defaults, and TLS 1.3 is negotiated, the corresponding TLS 1.2 algorithms for TLS 1.3 legacy signature schemes will be treated as legacy schemes and applied only to certificate signatures.

srp_param_type()

-type srp_param_type() :: srp_8192 | srp_6144 | srp_4096 | srp_3072 | srp_2048 | srp_1536 | srp_1024.

SRP cipher suite configuration prior to TLS-1.3.

Types: Algorithms Legacy

legacy_cipher()

(not exported)

-type legacy_cipher() :: '3des_ede_cbc' | des_cbc | rc4_128.

Cipher algorithms that are no longer supported by default for security reasons.

legacy_hash()

(not exported)

-type legacy_hash() :: sha224 | sha | md5.

Hash algorithms that are no longer supported by default for security reasons.

legacy_named_curve()

(not exported)

-type legacy_named_curve() ::
          sect571r1 | sect571k1 | sect409k1 | sect409r1 | sect283k1 | sect283r1 | secp256k1 |
          sect239k1 | sect233k1 | sect233r1 | secp224k1 | secp224r1 | sect193r1 | sect193r2 |
          secp192k1 | secp192r1 | sect163k1 | sect163r1 | sect163r2 | secp160k1 | secp160r1 | secp160r2.

Key exchange configuration prior to TLS-1.3.

These curves have been deprecated by RFC 8422.

legacy_sign_algo()

(not exported)

-type legacy_sign_algo() :: dsa.

Signature algorithms that are no longer supported by default for security reasons.

legacy_sign_scheme()

(not exported)

-type legacy_sign_scheme() ::
          rsa_pkcs1_sha512 | rsa_pkcs1_sha384 | rsa_pkcs1_sha256 | ecdsa_sha1 | rsa_pkcs1_sha1.

This is only used for certificate signatures if TLS-1.2 is negotiated, meaning that the peer only supports TLS-1.2, but we also support TLS-1.3.

old_cipher_suite()

-type old_cipher_suite() ::
          {kex_algo(), cipher(), hash()} | {kex_algo(), cipher(), hash() | aead, hash()}.

For backwards compatibility only; do not use.

Types: Certificates

anchor_fun()

(not exported)

-type anchor_fun() :: fun().

Claim an intermediate CA in the chain as trusted.

fun(Chain::[public_key:der_encoded()]) ->
      {trusted_ca, DerCert::public_key:der_encoded()} | unknown_ca.

TLS then uses public_key:pkix_path_validation/3 with the selected CA as the trusted anchor and verifies the rest of the chain.

cert_key_conf()

-type cert_key_conf() ::
          #{cert => public_key:der_encoded() | [public_key:der_encoded()],
            key => key(),
            certfile => file:filename(),
            keyfile => file:filename(),
            password => iodata() | fun(() -> iodata())}.

Configuration of the entity certificate and its corresponding key.

A certificate (or possibly a list including the certificate and its chain certificates, where the entity certificate must be the first element in the list or the first entry in the file) and its associated key. For the PEM file format, there can also be a password associated with the file containing the key.

For maximum interoperability, the certificates in the chain should be in the correct order, as the chain will be sent as-is to the peer. If chain certificates are not provided, certificates from the configured trusted CA certificates will be used to construct the chain. See client_option_cert() and server_option_cert() for more information.

crl_cache_opts()

(not exported)

-type crl_cache_opts() :: {Module :: atom(), {DbHandle :: internal | term(), Args :: list()}}.

Options for using built-in CRL cache support.

Specify how to perform lookup and caching of certificate revocation lists (CRLs). Module defaults to ssl_crl_cache with DbHandle being internal, and Args being [].

There are two implementations available:

ssl_crl_cache - Implementation 1

This module maintains a cache of CRLs. CRLs can be added to the cache using ssl_crl_cache:insert/1, and can optionally be automatically fetched through HTTP if the following argument is specified:

{http, timeout()}

Enables fetching of CRLs specified as http URIs in X.509 certificate extensions. Requires the Inets application.

ssl_crl_hash_dir - Implementation 2

This module makes use of a directory where CRLs are stored in files named by the hash of the issuer name.

The file names consist of eight hexadecimal digits followed by .rN, where N is an integer, for example 1a2b3c4d.r0. For the first version of the CRL, N starts at zero, and for each new version, N is incremented by one. The OpenSSL utility c_rehash creates symlinks according to this pattern.

For a given hash value, this module finds all consecutive .r* files starting from zero, and those files taken together make up the revocation list. CRL files with nextUpdate fields in the past or issued by a different CA that happens to have the same name hash are excluded.

The following argument is required:

{dir, string()}

Specifies the directory in which the CRLs can be found.

key()

-type key() ::
          {'RSAPrivateKey' | 'DSAPrivateKey' | 'ECPrivateKey' | 'PrivateKeyInfo',
           public_key:der_encoded()} |
          #{algorithm := sign_algo(),
            engine := crypto:engine_ref(),
            key_id := crypto:key_id(),
            password => crypto:password()} |
          #{algorithm := sign_algo(),
            sign_fun := fun(),
            sign_opts => list(),
            encrypt_fun => fun(),
            encrypt_opts => list()}.

The user's private key.

The key can be provided either directly as a DER-encoded entity, indirectly using a crypto engine/provider (with key reference information), or as an Erlang fun (with possible custom options). The latter two options can be used for customized signing with hardware security modules (HSM) or trusted platform modules (TPM).

A DER encoded key will need to specify the ASN-1 type used to create the encoding.

An engine/provider needs to specify specific information to support this concept and can optionally be password protected; see also crypto:engine_load/3 and Crypto User's Guide.

A fun option should include a fun that mimics public_key:sign/4 and possibly public_key:private_encrypt/4 if legacy versions TLS-1.0 and TLS-1.1 must be supported.

Types: Client Options

client_option()

(not exported)

-type client_option() ::
          client_option_cert() |
          common_option_cert() |
          {psk_groups, [group()]} |
          {alpn_advertised_protocols, AppProtocols :: [AppProto :: binary()]} |
          {max_fragment_length, MaxLen :: undefined | 512 | 1024 | 2048 | 4096} |
          client_option_tls13() |
          common_option_tls13() |
          client_option_pre_tls13() |
          common_option_pre_tls13() |
          common_option_dtls() |
          client_option_legacy() |
          common_option_legacy().

The following options are specific to the client side, or have different semantics for the client and server:

{psk_groups, Groups} - key exchange groups that the client will send pre shared keys for, defaults to the first group in supported_groups. Must be a subset of supported_groups and will be sent in the same order as they appear in supported_groups.

{alpn_advertised_protocols, AppProtocols} - Application layer protocol

The list of protocols supported by the client to be sent to the server to be used for an Application-Layer Protocol Negotiation (ALPN). If the server supports ALPN, it will choose a protocol from this list; otherwise it will fail the connection with a no_application_protocol alert. A server that does not support ALPN will ignore this value. The list of protocols must not contain an empty binary.

{max_fragment_length, MaxLen} - Max fragment length extension

Specifies the maximum fragment length the client is prepared to accept from the server. See RFC 6066.

client_option_cert()

-type client_option_cert() ::
          {cacerts, CACerts :: [public_key:der_encoded()] | [public_key:combined_cert()]} |
          {cacertfile, CACertFile :: file:filename()} |
          {server_name_indication, SNI :: inet:hostname() | disable} |
          {customize_hostname_check, HostNameCheckOpts :: list()} |
          {certificate_authorities, boolean()} |
          {stapling, Stapling :: staple | no_staple | map()}.

Certificate-related options specific to the client side, or with different semantics for the client and server.

{cacerts, CACerts} - Trusted certificates

The DER-encoded trusted certificates. If this option is supplied it overrides option cacertfile.

Function public_key:cacerts_get/0 can be used to retrieve to the trusted CA certificates provided by the operating system.

{cacertfile, CertFile} - End entity certificate

Path to a file containing PEM-encoded CA certificates. The CA certificates are used during server authentication and when building the client certificate chain.

Note

When PEM caching is enabled, files provided with this option will be checked for updates at fixed time intervals specified by the ssl_pem_cache_clean environment parameter.

{server_name_indication, SNI} - Server Name Indication extension

Specify the hostname to be used in TLS Server Name Indication extension. If not specified it will default to the Host argument of connect/3,4 unless it is of type inet:ip_address(). The hostname will also be used in the hostname verification of the peer certificate using public_key:pkix_verify_hostname/2. The special value disable prevents the Server Name Indication extension from being sent and disables the hostname verification check.

{customize_hostname_check, HostNameCheckOpts} - Customization option

Customizes the hostname verification of the peer certificate, as various protocols that use TLS, such as HTTP or LDAP, may require different approaches. For example, here is how to use standard hostname checking for HTTPS implemented in Public_Key:

{customize_hostname_check, [{match_fun, public_key:pkix_verify_hostname_match_fun(https)}]}

For futher description of the customize options, see public_key:pkix_verify_hostname/3.

{client_certificate_authorities, UseCertAuth} - Inter-op hint option

If UseCertAuth is set to true, sends the certificate authorities extension in the TLS-1.3 client hello. The default is false. Note that setting UseCertAuth to true can result in a significant overhead if there exists many trusted CA certificates. (Since Erlang/OTP 24.3.)

{stapling, Stapling} - Certificate revocation check option

If Stapling is atom staple or a map, OCSP stapling will be enabled, meaning that an extension of type "status_request" will be included in the client hello to indicate the desire to receive certificate status information.

If Stapling is set to no_staple (the default), OCSP stapling will be disabled.

Note

Even if requested by the client, the OCSP response might not be provided by the server. In such event, the certificate validation will fail with reason missing_ocsp_staple. Capturing this failure with a custom verify_fun enables the user to implement their own fallback validation, for example by performing a direct OCSP query or a CRL check. Note however that accepting {bad_cert, missing_ocsp_staple} without performing alternative revocation checking is insecure, as it allows a MITM attacker to suppress revocation information by omitting the OCSP staple.

{verify_fun, {fun(_, _, {bad_cert, missing_ocsp_staple} = R, _St) ->
                      %% Implement fallback revocation check here,
                      %% e.g. a direct OCSP query or CRL check.
                      %% Simply returning {valid, St} skips
                      %% revocation checking entirely.
                      {fail, R};
                 (_, _, {bad_cert, _} = R, _) ->
                      {fail, R};
                 (_, _, {extension, _}, St) ->
                      {unknown, St};
                 (_, _, valid, St) ->
                      {valid, St};
                 (_, _, valid_peer, St) ->
                      {valid, St}
              end, []}}

When Stapling is given as a map, boolean ocsp_nonce key can indicate whether an OCSP nonce should be requested by the client (default is false).

Note

The OCSP response can be provided without a nonce value — even if it was requested by the client. In such cases SSL will proceed with the handshake and generate a {missing, ocsp_nonce} logger event.

client_option_legacy()

(not exported)

-type client_option_legacy() ::
          {verify, Verify :: verify_peer | verify_none} |
          {client_preferred_next_protocols,
           NextAppProtocols ::
               {Precedence :: server | client, ClientPrefs :: [AppProto :: binary()]} |
               {Precedence :: server | client,
                ClientPrefs :: [AppProto :: binary()],
                Default :: (AppProto :: binary())}}.

Legacy client options.

{verify, Verify} - Verification of certificates

Clients should always verify the servers certificate, this legacy option should only be used for test or debug purposes.

This option specifies whether certificates are to be verified.

If Verify is verify_peer, which is the default, it is required to also provide one of the options cacerts or cacertfile in order for the certificate verification to succeed. For example, an HTTPS client can use option {cacerts, public_key:cacerts_get()} to use the trusted CA certificates provided by the operating system.

If Verify is verify_none, all X.509-certificate path validation errors will be ignored.

Change

The default for Verify was changed to verify_peer in Erlang/OTP 26.0.

{client_preferred_next_protocols, NextAppProtocols} - Next Protocol Negotiation

ALPN (Application-Layer Protocol Negotiation) deprecates NPN (Next Protocol Negotiation) and this option.

Indicates that the client wants to perform Next Protocol Negotiation.

If Precedence is server, the negotiated protocol is the first protocol to be shown on the server advertised list that is also on the client preference list.

If Precedence is client, the negotiated protocol is the first protocol to be shown on the client preference list that is also on the server advertised list.

If the client does not support any of the server advertised protocols or the server does not advertise any protocols, the client falls back to the first protocol in its list or to the default protocol (if a default is supplied). If the server does not support Next Protocol Negotiation, the connection terminates if no default protocol is supplied.

client_option_pre_tls13()

(not exported)

-type client_option_pre_tls13() ::
          {reuse_session, SessionRef :: session_id() | {session_id(), SessionData :: binary()}} |
          {reuse_sessions, Reuse :: boolean() | save} |
          {psk_identity, PskID :: string()} |
          {srp_identity, SrpID :: {Username :: string(), Password :: string()}} |
          {fallback, LegacyFallback :: boolean()}.

Options only relevant to TLS versions prior to TLS-1.3.

{reuse_session, SessionRef} - Explicit session reuse

Reuses a specific session.

Since Erlang/OTP 21.3, if the session was saved earlier using option {reuse_sessions, save}, the session can be referred by its session ID.

Since Erlang/OTP 22.3, the session can be explicitly specified by its session ID and associated data.

See also SSL User's Guide, Session Reuse pre TLS 1.3.

{reuse_sessions, Reuse} - Enables later session reuse

When Reuse is set to save, a new connection will be negotiated and saved for later reuse. The session ID can be fetched with connection_information/2 and used with the client option reuse_session.

When Reuse is set to true, automated session reuse will be performed, if possible. If a new session is created, and is unique in regard to previous stored sessions, it will be saved for possible later reuse.

Since: OTP 21.3.

{psk_identity, PskID} - Option for use with PSK cipher suites

Specifies the identity the client presents to the server. The matching secret is found by the fun given in the user_lookup_fun option.

{srp_identity, SrpID} - Option for use SRP cipher suites

Specifies the username and password to use to authenticate to the server.

{fallback, LegacyFallback} - Inter-op legacy client option

Send special cipher suite TLS_FALLBACK_SCSV to avoid an undesired TLS version downgrade. Defaults to false.

Warning

This option is not needed in normal TLS usage and must not be used to implement new clients. However, legacy clients that retries connections in the following manner:

ssl:connect(Host, Port, [...{versions, ['tlsv2', 'tlsv1.1', 'tlsv1']}])

ssl:connect(Host, Port, [...{versions, [tlsv1.1', 'tlsv1']}, {fallback, true}])

ssl:connect(Host, Port, [...{versions, ['tlsv1']}, {fallback, true}])

can use it to avoid undesired TLS version downgrade. Note that TLS_FALLBACK_SCSV must also be supported by the server for the prevention to work.

client_option_tls13()

(not exported)

-type client_option_tls13() ::
          {session_tickets, SessionTickets :: disabled | manual | auto} |
          {use_ticket, Tickets :: [session_ticket()]} |
          {early_data, binary()} |
          {middlebox_comp_mode, MiddleBoxMode :: boolean()}.

Options only relevant for TLS-1.3.

{session_tickets, SessionTickets} - Use of session tickets

Configures the session ticket functionality. Allowed values are disabled, manual, and auto. If it is set to manual the client will send the ticket information to user process in a 3-tuple:

{ssl, session_ticket, `Ticket::`(`t:session_ticket/0`)}

where Ticket is a map with information about the created TLS-1.3 session ticket. The only key that the user needs to consider is sni key to be able to provide it as a value in the use_ticket option list of possible tickets to use it to attempt session resumption to a server identified by the server name indication in manual session ticket mode.

If it is set to auto, the client automatically handles received tickets and tries to use them when making new TLS connections (session resumption with pre-shared keys).

Ticket lifetime, the number of tickets sent by the server, and the maximum number of tickets stored by the server in stateful mode are configured by application variables.

See also SSL User's Guide, Session Tickets and Session Resumption in TLS 1.3.

{use_ticket, Tickets}

Configures the session tickets to be used for session resumption. It is a mandatory option in manual mode ({session_tickets, manual}).

Note

Session tickets are only sent to the user if option session_tickets is set to manual

This option is supported by TLS-1.3. See also SSL User's Guide, Session Tickets and Session Resumption in TLS 1.3.

{early_data, EarlyData}

Configures the early data to be sent by the client.

To verify that the server has the intention to process the early data, the following tuple is sent to the user process:

{ssl, SslSocket, {early_data, Result}}

where Result is either accepted or rejected.

Warning

It is the responsibility of the user to handle rejected EarlyData and to resend when appropriate.

{middlebox_comp_mode, MiddleBoxMode}

Configures the middlebox compatibility mode for a TLS-1.3 connection.

A significant number of middleboxes misbehave when a TLS-1.3 connection is negotiated. Implementations can increase the chance of making connections through those middleboxes by adapting the TLS-1.3 handshake to resemble that of a TLS-1.2 handshake.

The middlebox compatibility mode is enabled (true) by default.

session_ticket()

-nominal session_ticket() :: #{sni := inet:hostname()}.

Types: Client and Server Options

common_option()

(not exported)

-type common_option() ::
          {protocol, tls | dtls} |
          {handshake, hello | full} |
          {ciphers, cipher_suites()} |
          {signature_algs, signature_algs()} |
          {signature_algs_cert, [sign_scheme()]} |
          {keep_secrets,
           KeepSecrets ::
               boolean() |
               {keylog_hs, fun((Info :: keylog_info()) -> any())} |
               {keylog, fun((Info :: keylog_info()) -> any())}} |
          {max_handshake_size, HandshakeSize :: pos_integer()} |
          {versions, [protocol_version()]} |
          {log_level, Level :: logger:level() | none | all} |
          {hibernate_after, HibernateTimeout :: timeout()} |
          {receiver_spawn_opts, SpawnOpts :: [erlang:spawn_opt_option()]} |
          {sender_spawn_opts, SpawnOpts :: [erlang:spawn_opt_option()]}.

Options common to both client and server side.

{protocol, Protocol} - Choose TLS or DTLS protocol for the transport layer security.

Defaults to tls.

{handshake, Completion} - Possibly pause handshake at hello stage.

Defaults to full. If hello is specified the handshake will pause after the hello message, allowing the user to make decisions based on hello extensions before continuing or aborting the handshake by calling handshake_continue/3 or handshake_cancel/1.

{keep_secrets, KeepSecrets} - Configures a TLS connection for keylogging.

In order to be able retrieve all keylog information on a TLS connection, it must be configured in advance.

Warning

The keylog information defeats the purpose of the protocol and enabling it makes the user responsible for the information not ending up compromising security, it is intended for debugging.

The keep_secrets functionality is disabled (false) by default. If set to legacy value true keylog information can be retrieved from the connection using connection_information/2.

Added in OTP 23.2.

Note

Note that having to ask the connection has some drawbacks as for instance you can not get keylog information for failed connections, and other keylog items have to be retrieved in a polling manner and are not correctly formatted for key_updates.

Since OTP 27.3.1 you may instead of true provide a callback fun providing keylog information for either just failing handshakes or for entire connections, by setting keep_secrets option to {keylog_hs, fun()} or {keylog, fun()}. The fun is of arity one and will be called with keylog information keylog_info() as an argument. keylog_hs fun will only be called if the handshake fails, and is only relevant for TLS-1.3 that has encrypted messages before the first handshake is complete.keylog fun will be called every time some secrets are updated and provide keylog for that update that is during the connection establishment and after that at renegotiation or key update (depending on TLS protocol version). When a fun is used the connection_information/2 can not be used to retrieve key log information. For more information see NSS keylog.

{max_handshake_size, HandshakeSize} - Limit the acceptable handshake packet size.

Used to limit the size of valid TLS handshake packets to avoid DoS attacks.

Integer (24 bits, unsigned). Defaults to 262144 since OTP 29.0

{hibernate_after, HibernateTimeout} - Hibernate inactive connection processes.

When an integer-value is specified, the TLS/DTLS connection goes into hibernation after the specified number of milliseconds of inactivity, thus reducing its memory footprint. When not specified the process never goes into hibernation.

{log_level, Level} - Specifies the log level for a TLS/DTLS connection.

Alerts are logged on notice level, which is the default level. The level debug triggers verbose logging of TLS/DTLS protocol messages. See also SSL Application

{receiver|sender_spawn_opts, SpawnOpts} - Configure erlang spawn opts.

Configures spawn options of TLS sender and receiver processes.

Setting up garbage collection options can be helpful for trade-offs between CPU usage and memory usage. See erlang:spawn_opt/2.

For connections using Erlang distribution, the default sender option is [...{priority, max}]; this priority option cannot be changed. For all connections, ...link is added to receiver and cannot be changed.

common_option_cert()

(not exported)

-type common_option_cert() ::
          {certs_keys, CertsKeys :: [cert_key_conf()]} |
          {depth, AllowedCertChainLen :: pos_integer()} |
          {verify_fun, Verify :: {Verifyfun :: fun(), InitialUserState :: any()}} |
          {cert_policy_opts,
           PolicyOpts ::
               [{policy_set, [public_key:oid()]} |
                {explicit_policy, boolean()} |
                {inhibit_policy_mapping, boolean()} |
                {inhibit_any_policy, boolean()}]} |
          {allow_any_ca_purpose, Allow :: boolean()} |
          {crl_check, Check :: boolean() | peer | best_effort} |
          {crl_cache, crl_cache_opts()} |
          {partial_chain, anchor_fun()}.

Common certificate related options to both client and server.

{certs_keys, CertsKeys} - At least one certificate and key pair.

A list of a certificate (or possible a certificate and its chain) and the associated key of the certificate that can be used to authenticate the client or the server. The certificate key pair that is considered best and matches negotiated parameters for the connection will be selected.

The different signature algorithms are prioritized in the following order: mldsa, slhdsa, eddsa, ecdsa, rsa_pss_pss, rsa, and dsa. If more than one key is supplied for the same signature algorithm, they will be prioritized by strength (except for engine keys; see the next paragraph). This offers flexibility to, for instance, configure a newer certificate that is expected to be used in most cases, and an older but acceptable certificate that will only be used to communicate with legacy systems. Note that there is a trade off between the induced overhead and the flexibility; thus, alternatives should be chosen for good reasons.

Engine keys will be favored over other keys. As engine keys cannot be inspected, supplying more than one engine key makes no sense.

When this option is specified it overrides all single certificate and key options. For examples, see the User's Guide.

Note

mldsa, slhdsa, eddsa certificates are only supported by TLS-1.3 implementations that do not support dsa certificates. rsa_pss_pss (RSA certificates using Probabilistic Signature Scheme) are supported in TLS-1.2 and TLS-1.3, but some TLS-1.2 implementations do not support rsa_pss_pss.

{depth, AllowedCertChainLen} - Limits the accepted number of certificates in the certificate chain.

Maximum number of non-self-issued intermediate certificates that can follow the peer certificate in a valid certification path. So, if depth is 0 the PEER must be signed by the trusted ROOT-CA directly; if 1 the path can be PEER, CA, ROOT-CA; if 2 the path can be PEER, CA, CA, ROOT-CA, and so on. The default value is 10. Used to mitigate DoS attack possibilities.

{verify_fun, Verify} - Customize certificate path validation

The verification fun is to be defined as follows:

fun(OtpCert :: #'OTPCertificate'{},
    Event, InitialUserState :: term()) ->
  {valid, UserState :: term()} |
  {fail, Reason :: term()} | {unknown, UserState :: term()}.

fun(OtpCert :: #'OTPCertificate'{}, DerCert :: public_key:der_encoded(),
    Event, InitialUserState :: term()) ->
  {valid, UserState :: term()} |
  {fail, Reason :: term()} | {unknown, UserState :: term()}.

Types:
      Event = {bad_cert, Reason :: atom() |
              {revoked, atom()}} |
      {extension, #'Extension'{}} |
              valid |
              valid_peer

The verification fun is called during the X.509-path validation when an error occurs or an extension unknown to the SSL application is encountered. It is also called when a certificate is considered valid by the path validation to allow access to each certificate in the path to the user application. It differentiates between the peer certificate and the CA certificates by using valid_peer or valid as Event argument to the verification fun. See the Public_Key User's Guide for definition of #'OTPCertificate'{} and #'Extension'{}.

If the verify callback fun returns {fail, Reason}, the verification process is immediately stopped, an alert is sent to the peer, and the TLS/DTLS handshake terminates.

If the verify callback fun returns {valid, UserState}, the verification process continues.

If the verify callback fun always returns {valid, UserState}, the TLS/DTLS handshake does not terminate regardless of verification failures, and the connection is established.

If called with an extension unknown to the user application, the fun is to return {unknown, UserState}.

Note that if the fun returns unknown for an extension marked as critical, validation will fail.

Default option verify_fun in verify_peer mode:

{fun(_, _, {bad_cert, _} = Reason, _) ->
   {fail, Reason};
    (_, _, {extension, _}, UserState) ->
   {unknown, UserState};
    (_, _, valid, UserState) ->
   {valid, UserState};
    (_, _, valid_peer, UserState) ->
       {valid, UserState}
 end, []}

Default option verify_fun in mode verify_none:

 {fun(_, _, {bad_cert, _}, UserState) ->
   {valid, UserState};
    (_, _, {extension, #'Extension'{critical = true}}, UserState) ->
   {valid, UserState};
    (_, _, {extension, _}, UserState) ->
   {unknown, UserState};
    (_, _, valid, UserState) ->
   {valid, UserState};
    (_, _, valid_peer, UserState) ->
       {valid, UserState}
 end, []}

The possible path validation errors are given in the form {bad_cert, Reason}, where Reason is:

unknown_ca

No trusted CA was found in the trusted store. The trusted CA is normally a so-called ROOT CA, which is a self-signed certificate. Trust can be claimed for an intermediate CA (the trusted anchor does not have to be self-signed according to X-509) by using option partial_chain.

selfsigned_peer

The chain consisted only of one self-signed certificate.

{invalid_ext_keyusage, [public_key:oid()]}

If the peer certificate specifies the extended keyusage extension and does not include the purpose for either being a TLS server (id-kp-ServerAuth) or TLS client (id-kp-ClientAuth) depending on the peers role.

{ca_invalid_ext_keyusage, [public_key:oid()]}

If a CA certificate specifies the extended keyusage extension and does not include the purpose for either being a TLS server (id-kp-ServerAuth) or TLS client (id-kp-ClientAuth) depending on the role of the peer chained with this CA, or the option allow_any_ca_purpose is set to true but the special any-value (anyExtendedKeyUsage) is not included in the CA cert purposes.

PKIX X-509-path validation error

For possible reasons, see public_key:pkix_path_validation/3.

{cert_policy_opts, PolicyOpts} - Handle certificate policies.

Configure X.509 certificate policy handling for the certificate path validation process; see public_key:pkix_path_validation/3 for more details.

{allow_any_ca_purpose, boolean()} - Handle certificate extended key usages extension

If a CA certificate has an extended key usage extension but it does not want to restrict the usages of the key it can include a special anyExtendedKeyUsage purpose. If this is option is set to true all key usage purposes is automatically accepted for a CA that include that purpose, the options default to false.

{crl_check, Check} - Handle certificate revocation lists.

Perform CRL (Certificate Revocation List) verification (public_key:pkix_crls_validate/3) on all the certificates during the path validation (public_key:pkix_path_validation/3) of the certificate chain. Check defaults to false.

The meaning of Check is as follows:

false

No checks are performed.

peer

Check is only performed on the peer certificate.

best_effort

The best_effort check is a legacy behavior and must be considered insecure!

If certificate revocation status cannot be determined it will be accepted as valid.

The CA certificates specified for the connection will be used to construct the certificate chain validating the CRLs.

The CRLs will be fetched from a local or external cache. See ssl_crl_cache_api.

common_option_dtls()

(not exported)

-type common_option_dtls() ::
          {use_srtp, UseSrtp :: #{protection_profiles := [binary()], mki => binary()}}.

Common options to client and server only valid for DTLS.

{use_srtp, UseSrtp} - Configures the use_srtp DTLS hello extension.

In order to negotiate the use of SRTP data protection, clients include an extension of type "use_srtp" in the DTLS extended client hello. This extension MUST only be used when the data being transported is RTP or RTCP.

The value is a map with a mandatory protection_profiles parameter and an optional mki parameter.

protection_profiles configures the list of the client's acceptable SRTP Protection Profiles. Each profile is a 2-byte binary. Example: #{protection_profiles => [<<0,2>>, <<0,5>>]}

mki configures the SRTP Master Key Identifier chosen by the client.

The srtp_mki field contains the value of the SRTP MKI which is associated with the SRTP master keys derived from this handshake. Each SRTP session MUST have exactly one master key that is used to protect packets at any given time. The client MUST choose the MKI value so that it is distinct from the last MKI value that was used, and it SHOULD make these values unique for the duration of the TLS session.

Note

OTP does not handle SRTP, so an external implementations of SRTP encoder/decoder and a packet demultiplexer are needed to make use of the use_srtp extension. See also option transport_option.

Servers that receive an extended hello containing a "use_srtp" extension can agree to use SRTP by including an extension of type "use_srtp", with the chosen protection profile in the extended server hello. This extension MUST only be used when the data being transported is RTP or RTCP.

common_option_legacy()

(not exported)

-type common_option_legacy() ::
          {cert, Cert :: public_key:der_encoded() | [public_key:der_encoded()]} |
          {certfile, CertPem :: file:filename()} |
          {key, Key :: key()} |
          {keyfile, KeyPem :: file:filename()} |
          {password, KeyPemPasswd :: iodata() | fun(() -> iodata())} |
          {log_alert, LogAlert :: boolean()} |
          {padding_check, PaddingCheck :: boolean()} |
          {beast_mitigation, one_n_minus_one | zero_n | disabled} |
          {ssl_imp, Imp :: new | old}.

Legacy options considered deprecated in favor of other options, insecure to use, or plainly not relevant anymore.

{cert, Certs}

Use option certs_keys instead.

{certfile, CertPem}

Use option certs_keys instead.

{keyfile, KeyPem}

Use option certs_keys instead.

{password, KeyPemPasswd}

Use option certs_keys instead.

{log_alert, LogAlert}

If LogAlert is false, TLS/DTLS Alert reports are not displayed. Deprecated in OTP 22; use {log_level, Level} instead.

{padding_check, PaddingCheck} - Inter-op trade-off option

Affects TLS-1.0 connections only. If set to false, it disables the block cipher padding check to be able to interoperate with legacy software.

Warning

Using {padding_check, false} makes TLS vulnerable to the Poodle attack.

{beast_mitigation, BeastMitigation} - Inter-op trade-off option

Affects TLS-1.0 connections only. Used to change the BEAST mitigation strategy to interoperate with legacy software. Defaults to one_n_minus_one.

one_n_minus_one - Perform 1/n-1 BEAST mitigation.

zero_n - Perform 0/n BEAST mitigation.

disabled - Disable BEAST mitigation.

Warning

Using {beast_mitigation, disabled} makes TLS-1.0 vulnerable to the BEAST attack.

{ssl_imp, Imp}

Deprecated since OTP 17; has no effect.

common_option_pre_tls13()

(not exported)

-type common_option_pre_tls13() ::
          {eccs, NamedCurves :: [named_curve()]} |
          {secure_renegotiate, SecureRenegotiate :: true} |
          {user_lookup_fun, {Lookupfun :: fun(), UserState :: any()}}.

Options common to client and server side prior to TLS-1.3.

{eccs, NamedCurves} - Named Elliptic Curves

Elliptic curves that can be used in pre TLS-1.3 key exchange.

{secure_renegotiate, SecureRenegotiate} - Previous interoperability option

Since OTP 29.0 setting this option to false will fail, that is accepting possible fallback to insecure behavior preceding implementation of RFC 5746 is no longer supported. Setting it to true will continue to work but is not necessary, as the default of true will now always be enforced.

{user_lookup_fun, {LookupFun, UserState}} - PSK/SRP cipher suite option

The lookup fun is to be defined as follows:

fun(psk, PSKIdentity :: binary(), UserState :: term()) ->
  {ok, SharedSecret :: binary()} | error;
fun(srp, Username :: binary(), UserState :: term()) ->
  {ok, {SRPParams :: srp_param_type(), Salt :: binary(),
        DerivedKey :: binary()}} | error.

For Pre-Shared Key (PSK) cipher suites, the lookup fun is called by the client and server to determine the shared secret. When called by the client, PSKIdentity is the hint presented by the server or undefined. When called by the server, PSKIdentity is the identity presented by the client.

For Secure Remote Password (SRP), the fun is only used by the server to obtain parameters that it uses to generate its session keys. DerivedKey is to be derived according to RFC 2945 and RFC 5054: crypto:sha([Salt, crypto:sha([Username, <<$:>>, Password])])

common_option_tls13()

-type common_option_tls13() ::
          {supported_groups, [group()]} | {key_update_at, KeyUpdateAt :: pos_integer()}.

Common options to both client and server for TLS-1.3.

{supported_groups, Groups} - Key exchange option

TLS 1.3 introduces the "supported_groups" extension, which is used for negotiating the key-exchange parameters in a TLS 1.3 handshake. Both client and server can specify a list of parameters that they are willing to use.

If not specified it will use a default list that can be obtained by calling ssl:groups(default). that is filtered based on the installed crypto library version.

{key_update_at, KeyUpdateAt} - Session key renewal

Configures the maximum amount of bytes that can be sent on a TLS 1.3 connection before an automatic key update is performed.

There are cryptographic limits on the amount of plaintext which can be safely encrypted under a given set of keys. The current default ensures that data integrity will not be breached with probability greater than 1/2^57. For more information see Limits on Authenticated Encryption Use in TLS.

Types: Deprecated

prf_random()

This type is deprecated. the type ssl:prf_random() is deprecated; Only used in deprecated function prf/5 and will no longer be needed..

-type prf_random() :: client_random | server_random.

Types: Info

connection_info()

-type connection_info() ::
          [{protocol, protocol_version()} |
           {session_resumption, boolean()} |
           {selected_cipher_suite, erl_cipher_suite()} |
           {sni_hostname, term()} |
           {ciphers, [erl_cipher_suite()]}] |
          connection_info_pre_tls13() |
          security_info().

Key value list convening some information about the established connection.

connection_info_keys()

-type connection_info_keys() ::
          [protocol | selected_cipher_suite | sni_hostname | session_resumption | ciphers |
           client_random | server_random | master_secret | keylog | session_id | session_data | ecc |
           srp_username].

TLS connection keys for which information can be retrieved.

connection_info_pre_tls13()

(not exported)

-type connection_info_pre_tls13() ::
          [{session_id, session_id()} |
           {session_data, binary()} |
           {ecc, {named_curve, term()}} |
           {srp_username, term()}].

TLS connection information relevant prior to TLS-1.3.

security_info()

(not exported)

-type security_info() ::
          [{client_random, binary()} |
           {server_random, binary()} |
           {master_secret, binary()} |
           {keylog, [keylog_item()]}].

TLS connection information that can be used for NSS key logging.

Types: Server Options

server_option()

(not exported)

-type server_option() ::
          server_option_cert() |
          common_option_cert() |
          {honor_cipher_order, HonorServerCipherOrder :: boolean()} |
          {alpn_preferred_protocols, AppProtocols :: [binary()]} |
          {sni_hosts, SNIHosts :: [{inet:hostname(), [server_option() | common_option()]}]} |
          {sni_fun,
           SNIFun :: fun((string()) -> [server_option() | common_option()] | unrecognized | undefined)} |
          server_option_pre_tls13() |
          common_option_pre_tls13() |
          server_option_tls13() |
          common_option_tls13() |
          common_option_dtls() |
          server_option_legacy() |
          common_option_legacy().

Options specific to the server side, or with different semantics for the client and server.

{alpn_preferred_protocols, AppProtocols} - Application Layer Protocol Negotiation

Indicates that the server will try to perform Application-Layer Protocol Negotiation (ALPN).

The list of protocols is in order of preference. The protocol negotiated will be the first in the list that matches one of the protocols advertised by the client. If no protocol matches, the server will fail the connection with a no_application_protocol alert.

The negotiated protocol can be retrieved using the negotiated_protocol/1 function.

{honor_cipher_order, HonorServerCipherOrder} - Trade-off option alters protocol defined behavior

If true, use the server's preference for cipher suite selection. If false (the default), use the client's preference.

{sni_fun, SNIFun}

If the server receives a SNI (Server Name Indication) from the client, the given fun SNIFun will be called to retrieve server_option() for the indicated server. These options will override previously specified server options. The sni_fun can indicate that it does not recognize the server name by returning unrecognized in which case the connection will be closed with an unrecognized_name alert. If the sni_fun returns undefined the connection will be attempted with the default options supplied to listen/2 or handshake/2,3.

Note

The options sni_fun and sni_hosts are mutually exclusive.

{sni_hosts, SNIHosts}

If the server receives a SNI (Server Name Indication) from the client matching a host listed in the sni_hosts option, the specific options for that host will override previously specified options. If no match is found it behaves as option sni_fun that returns undefined.

Note

The options sni_fun and sni_hosts are mutually exclusive.

server_option_cert()

-type server_option_cert() ::
          {cacerts, CACerts :: [public_key:der_encoded()] | [public_key:combined_cert()]} |
          {cacertfile, CACertFile :: file:filename()} |
          {verify, Verify :: verify_none | verify_peer} |
          {certificate_authorities, ServerCertAuth :: boolean()}.

Certificate related options for a server.

{cacerts, CACerts} - Trusted certificates.

The DER-encoded trusted certificates. If this option is supplied, it overrides the cacertfile option.

{verify, Verify} - Verify certificates.

Client certificates are an optional part of the TLS protocol. A server performs X.509 certificate path validation only in verify_peer mode. By default the server is in verify_none mode and, hence, will not send an certificate request to the client. When using verify_peer you may also want to specify the options fail_if_no_peer_cert and certificate_authorities.

{certificate_authorities, ServerCertAuth} - Inter-operate hint option

Determines whether a TLS-1.3 server should include the authorities extension in its certificate request message that is sent when the option verify is set to verify_peer. Defaults to true.

If set to false for older TLS versions its corresponding certificate authorities definition in its certificate request will be set to the empty list instead of including the appropriate certificate authorities. This has the same affect as excluding the TLS-1.3 extension.

A reason to exclude the extension would be if the server wants to communicate with clients incapable of sending complete certificate chains that adhere to the extension, but the server still has the capability to recreate a chain that it can verify.

server_option_legacy()

(not exported)

-type server_option_legacy() ::
          {fail_if_no_peer_cert, FailNoPeerCert :: boolean()} |
          {next_protocols_advertised, NextAppProtocols :: [binary()]}.

Legacy server options.

{next_protocols_advertised, NextAppProtocols}

ALPN (Application-Layer Protocol Negotiation) deprecates NPN (Next Protocol Negotiation) described here.

List of protocols to send to the client if the client indicates that it supports the Next Protocol extension. The client can select a protocol that is not on this list. The list of protocols must not contain an empty binary. If the server negotiates a Next Protocol, it can be accessed using the negotiated_protocol/1 method.

{fail_if_no_peer_cert, FailNoPeerCert} - Legacy trade-off option

Used together with {verify, verify_peer} by an TLS/DTLS server. If set to true, the server fails if the client does not have a certificate to send, that is, sends an empty certificate. If set to false, it fails only if the client sends an invalid certificate (an empty certificate is considered valid). Defaults to true, the default value was changed in OTP 26.0.

server_option_pre_tls13()

(not exported)

-type server_option_pre_tls13() ::
          {client_renegotiation, ClientRengotiation :: boolean()} |
          {reuse_sessions, ReuseSessions :: boolean()} |
          {reuse_session, ReuseSession :: fun()} |
          {honor_ecc_order, HonorServerECCOrder :: boolean()} |
          {dh, DHDer :: public_key:der_encoded()} |
          {dhfile, DhFile :: file:filename()} |
          {psk_identity, PSKHint :: string()}.

Options only relevant to TLS versions prior to TLS-1.3.

{client_renegotiation, ClientRengotiation} - DoS attack avoidance option

In protocols that support client-initiated renegotiation, the resource cost of such an operation is higher for the server than the client. This can act as a vector for denial-of-service (DoS) attacks. The SSL application already takes measures to counter-act such attempts, but client-initiated renegotiation can be completely disabled by setting this option to false. The default value is true. Note that disabling renegotiation can result in long-lived connections becoming unusable due to limits on the number of messages the underlying cipher suite can encipher.

{reuse_sessions, ReuseSessions} - Enable session reuse

The boolean value true specifies that the server will agree to reuse sessions. Setting it to false will result in an empty session table, meaning that no sessions will be reused.

{reuse_session, ReuseSession} - Local server reuse policy

Enables the TLS/DTLS server to have a local policy for deciding whether a session is to be reused. Meaningful only if reuse_sessions is set to true.

ReuseSession should be a fun:

fun(SuggestedSessionId, PeerCert, Compression, CipherSuite)

SuggestedSessionId is a binary(), PeerCert is a DER-encoded certificate, Compression is an enumeration integer, and CipherSuite is of type erl_cipher_suite().

{psk_identity, PSKHint} - Inter-operate hint option

Specifies the server identity hint that the server presents to the client.

{honor_ecc_order, HonorServerECCOrder} - Trade-off option alters protocol defined behavior

If true, use the server's preference for ECC curve selection. If false (the default), use the client's preference.

{dh, DHder} - Affects DH key exchange cipher suites

The DER-encoded Diffie-Hellman parameters. If specified, it overrides option dhfile.

{dh_file, DHfile} - Affects DH key exchange cipher suites

Path to a file containing PEM-encoded Diffie Hellman parameters to be used by the server if a cipher suite using Diffie Hellman key exchange is negotiated. If not specified, default parameters are used.

server_option_tls13()

(not exported)

-type server_option_tls13() ::
          {session_tickets,
           SessionTickets :: disabled | stateful | stateless | stateful_with_cert | stateless_with_cert} |
          {stateless_tickets_seed, TicketSeed :: binary()} |
          {anti_replay,
           '10k' | '100k' |
           {BloomFilterWindowSize :: pos_integer(),
            BloomFilterHashFunctions :: pos_integer(),
            BloomFilterBits :: pos_integer()}} |
          {cookie, Cookie :: boolean()} |
          {early_data, EarlyData :: enabled | disabled}.

Options only relevant for TLS-1.3.

{session_tickets, SessionTickets}

Configures the session ticket functionality. Allowed values for SessionTickets are:

disabled

stateful

stateless

stateful_with_cert

stateless_with_cert

If SessionTickets is not set to disabled, session resumption with pre-shared keys is enabled and the server will send stateful or stateless session tickets to the client after successful connections.

Note

In pre-shared key session ticket resumption, there is no certificate exchange involved. Therefore, ssl:peercert/1 will not return the peer certificate, as it is only communicated during the initial handshake. To associate the client certificate from the original handshake with the tickets it issues, the server options stateful_with_cert or stateless_with_cert can be used.

A stateful session ticket is a database reference to internal state information. A stateless session ticket is a self-encrypted binary that contains both cryptographic keying material and state data.

Warning

When SessionTickets is set to stateful_with_cert, the client certificate is stored along with the internal state information, leading to increased memory consumption. Conversely, when it is set to stateless_with_cert, the client certificate is encoded in the self-encrypted binary sent to the client, resulting in an increase in payload size.

See also SSL User's Guide, Session Tickets and Session Resumption in TLS 1.3.

{stateless_tickets_seed, TicketSeed} - Option for statless tickets

Configures the seed used for the encryption of stateless session tickets. Allowed values are any randomly generated binary/0. If this option is not configured, an encryption seed will be randomly generated.

Warning

Reusing the ticket encryption seed between multiple server instances enables stateless session tickets to work across multiple server instances, but it breaks anti-replay protection across instances.

Inaccurate time synchronization between server instances can also affect session ticket freshness checks, potentially causing false negatives as well as false positives.

{anti_replay, AntiReplay} - Option for statless tickets

Configures the server's built-in anti replay feature based on Bloom filters.

Allowed values for AntiReplay are the pre-defined '10k', '100k', or a custom 3-tuple that defines the properties of the bloom filters: {WindowSize, HashFunctions, Bits}. WindowSize is the number of seconds after the current Bloom filter is rotated and also the window size used for freshness checks of ClientHello. HashFunctions is the number hash functions and Bits is the number of bits in the bit vector. '10k' and '100k' are simple defaults with the following properties:

'10k': Bloom filters can hold 10000 elements with 3% probability of false positives. WindowSize: 10, HashFunctions: 5, Bits: 72985 (8.91 KiB).

'100k': Bloom filters can hold 100000 elements with 3% probability of false positives. WindowSize: 10, HashFunctions: 5, Bits: 729845 (89.09 KiB).

See also SSL User's Guide, Anti-Replay Protection in TLS 1.3.

{cookie, Cookie} - Option for HelloRetryRequest behavior

If Cookie is true, which is the default, the server sends a cookie extension in its HelloRetryRequest messages.

The cookie extension has two main purposes. It allows the server to force the client to demonstrate reachability at their apparent network address (thus providing a measure of DoS protection). This is primarily useful for non-connection-oriented transports. It also allows offloading the server's state to the client. The cookie extension is enabled by default as it is a mandatory extension in RFC8446.

{early_data, EarlyData} - Option for accepting or rejecting Early Data

Configures if the server accepts (enabled) or rejects (disabled) early data sent by a client. The default value is disabled.

Types: Socket

active_msgs()

-type active_msgs() ::
          {ssl, sslsocket(), Data :: binary() | list()} |
          {ssl_closed, sslsocket()} |
          {ssl_error, sslsocket(), Alert :: error_alert() | (Reason :: any())} |
          {ssl_passive, sslsocket()}.

The type for the messages that are delivered to the owner of a TLS/DTLS socket in active mode.

The ssl_error reason may convey a TLS protocol alert if such an event occurs after the connection has been established. The most common case when this will happen is on the client side when a TLS-1.3 server requests a client certificate and the provided certificate is not accepted by the server, as it will be verified after the server has sent its last handshake message.

The ssl_passive message is sent only when the socket is in {active, N} mode and the counter has dropped to 0. It indicates that the socket has transitioned to passive ({active, false}) mode.

dtls_legacy_version()

(not exported)

-type dtls_legacy_version() :: dtlsv1.

A DTLS protocol version that are no longer supported by default for security reasons and scheduled for removal in OTP 30.

dtls_version()

(not exported)

-type dtls_version() :: 'dtlsv1.2' | dtls_legacy_version().

DTLS protocol version.

error_alert()

-type error_alert() :: {tls_alert, {tls_alert(), Description :: string()}}.

If a TLS connection fails a TLS protocol ALERT will be sent/received.

An atom reflecting the raised alert, according to the TLS protocol, and a description string with some further details will be returned.

host()

-type host() :: inet:hostname() | inet:ip_address().

A name or address to a host.

protocol_extensions()

-type protocol_extensions() ::
          #{renegotiation_info => binary(),
            signature_algs => signature_algs(),
            alpn => binary(),
            srp => binary(),
            next_protocol => binary(),
            max_frag_enum => 1..4,
            ec_point_formats => [0..2],
            elliptic_curves => [public_key:oid()],
            sni => inet:hostname()}.

Client hello extensions.

protocol_version()

-type protocol_version() :: tls_version() | dtls_version().

TLS or DTLS protocol version.

reason()

-type reason() :: term().

Error reason for debug purposes.

Not to be matched.

session_id()

-type session_id() :: binary().

Identifies a TLS session prior to TLS-1.3.

socket()

-type socket() :: gen_tcp:socket() | socket:socket().

A socket that can be used to perform a so-called "START-TLS", which means using an already connected socket previously used for plain TCP traffic and upgrading it to use TLS.

Both sides needs to agree on the upgrade.

socket_option()

-type socket_option() :: gen_tcp:connect_option() | gen_tcp:listen_option() | gen_udp:option().

Options for the transport socket.

The default socket options are [{mode, list}, {packet, 0}, {header, 0}, {active, true}].

For valid options, see inet, gen_tcp, and gen_udp in Kernel. Note that stream-oriented options such as packet are only relevant for TLS and not DTLS.

sslsocket()

-type sslsocket() :: any().

An opaque reference to the TLS/DTLS connection.

Note that despite being opaque, matching sslsocket() instances is allowed.

tls_alert()

-type tls_alert() ::
          close_notify | unexpected_message | bad_record_mac | record_overflow | handshake_failure |
          bad_certificate | unsupported_certificate | certificate_revoked | certificate_expired |
          certificate_unknown | illegal_parameter | unknown_ca | access_denied | decode_error |
          decrypt_error | export_restriction | protocol_version | insufficient_security |
          internal_error | inappropriate_fallback | user_canceled | no_renegotiation |
          unsupported_extension | certificate_unobtainable | unrecognized_name |
          bad_certificate_status_response | bad_certificate_hash_value | unknown_psk_identity |
          no_application_protocol.

TLS Alert Protocol reasons.

tls_client_option()

-type tls_client_option() :: client_option() | common_option() | socket_option() | transport_option().

An option that can be supplied to a TLS client.

tls_legacy_version()

(not exported)

-type tls_legacy_version() :: tlsv1 | 'tlsv1.1'.

A TLS protocol version that are no longer supported by default for security reasons and scheduled for removal in OTP 30.

tls_option()

-type tls_option() :: tls_client_option() | tls_server_option().

An option related to the TLS/DTLS protocol.

tls_server_option()

-type tls_server_option() :: server_option() | common_option() | socket_option() | transport_option().

An option that can be supplied to a TLS server.

tls_version()

(not exported)

-type tls_version() :: 'tlsv1.2' | 'tlsv1.3' | tls_legacy_version().

TLS protocol version.

transport_option()

(not exported)

-type transport_option() ::
          {cb_info,
           {CallbackModule :: atom(), DataTag :: atom(), ClosedTag :: atom(), ErrTag :: atom()}} |
          {cb_info,
           {CallbackModule :: atom(),
            DataTag :: atom(),
            ClosedTag :: atom(),
            ErrTag :: atom(),
            PassiveTag :: atom()}}.

Transport option defines a callback module and message tags to handle the underlying transport socket.

Can be used to customize the transport layer. The tag values should be the values used by the underlying transport in its active mode messages.

Defaults to {gen_tcp, tcp, tcp_closed, tcp_error, tcp_passive} for TLS.

Note

For backward compatibility a tuple of size four will be converted to a tuple of size five, where PassiveTag is the DataTag element with _passive appended.

For TLS the callback module must implement a reliable transport protocol, behave as gen_tcp, and have functions corresponding to inet:setopts/2, inet:getopts/2, inet:peername/1, inet:sockname/1, and inet:port/1. The callback gen_tcp is treated specially and calls inet directly. For DTLS this feature is considered experimental.

Types

keylog_info()

-type keylog_info() :: #{items => [keylog_item()], client_random => binary()}.

keylog_item()

(not exported)

-type keylog_item() :: unicode:chardata().

Client API

connect(TCPSocket, TLSOptions)

(since OTP R14B)

-spec connect(TCPSocket, TLSOptions) -> {ok, sslsocket()} | {error, Reason}
                 when
                     TCPSocket :: socket(),
                     TLSOptions :: [tls_client_option()],
                     Reason :: closed | {options, any()} | error_alert() | reason().

Equivalent to connect(TCPSocket, TLSOptions, infinity).

connect(TCPSocketOrHost, TLSOptionsOrPort, TimeoutOrTLSOptions)

-spec connect(TCPSocketOrHost, TLSOptionsOrPort, TimeoutOrTLSOptions) ->
                 {ok, sslsocket()} | {ok, sslsocket(), Ext :: protocol_extensions()} | {error, Reason}
                 when
                     TCPSocketOrHost :: socket() | host(),
                     TLSOptionsOrPort :: [tls_client_option()] | inet:port_number(),
                     TimeoutOrTLSOptions :: [tls_client_option()] | timeout(),
                     Reason :: closed | timeout | {options, any()} | error_alert() | reason().

Opens a TLS/DTLS connection.

connect(TCPSocket, TLSOptions, Timeout).

Upgrades a gen_tcp (or equivalent) connected socket to a TLS socket by performing the client-side TLS handshake.

connect(Host, Port, TLSOptions).

Opens a TLS/DTLS connection to Host, Port. This call is equivalent to:

connect(Host, Port, TLSOptions, infinity).

connect(Host, Port, TLSOptions, Timeout)

-spec connect(Host, Port, TLSOptions, Timeout) ->
                 {ok, sslsocket()} | {ok, sslsocket(), Ext :: protocol_extensions()} | {error, Reason}
                 when
                     Host :: host(),
                     Port :: inet:port_number(),
                     TLSOptions :: [tls_client_option()],
                     Timeout :: timeout(),
                     Reason :: closed | timeout | {options, any()} | error_alert() | reason().

Opens a TLS/DTLS connection to Host, Port.

When the verify option is set to verify_peer, the public_key:pkix_verify_hostname/2 check will be performed in addition to the usual X.509-path validation checks. If the check fails, the error {bad_cert, hostname_check_failed} will be propagated to the path validation fun, where it is possible to do customized checks by using the full possibilities of the public_key:pkix_verify_hostname/3 API. When the server_name_indication option is provided, its value (the DNS name) will be used as ReferenceID to public_key:pkix_verify_hostname/2. When no server_name_indication option is given, the Host argument will be used as Server Name Indication extension. The Host argument will also be used for the public_key:pkix_verify_hostname/2 check. If the Host argument is an inet:ip_address() the ReferenceID used for the check will be {ip, Host}; otherwise dns_id will be assumed with a fallback to ip if that fails.

Note

According to good practices, certificates should not use IP addresses as "server names", especially outside a closed network.

If the {handshake, hello} option is used, the handshake is paused after receiving the server hello message and the success response is {ok, SslSocket, Ext} instead of {ok, SslSocket}. Thereafter the handshake is continued or canceled by calling handshake_continue/3 or handshake_cancel/1.

If the active option is set to once, true, or an integer value, the process owning the SSL socket will receive messages of type active_msgs().

Client and Server API

close(SslSocket)

-spec close(SslSocket) -> ok | {error, Reason} when SslSocket :: sslsocket(), Reason :: any().

Closes a TLS/DTLS connection.

close(SslSocket, How)

(since OTP 18.1)

-spec close(SslSocket, How) -> ok | {ok, port()} | {ok, port(), Data} | {error, Reason}
               when
                   SslSocket :: sslsocket(),
                   How :: timeout() | {NewController :: pid(), timeout()},
                   Data :: binary(),
                   Reason :: any().

Closes or downgrades a TLS connection.

In the latter case the transport connection will be handed over to the NewController process after receiving the TLS close alert from the peer. The returned transport socket will have the following options set: [{active, false}, {packet, 0}, {mode, binary}].

In case of downgrade, the close function might return some binary data that should be treated by the user as the first bytes received on the downgraded connection.

controlling_process(SslSocket, NewController)

-spec controlling_process(SslSocket, NewController) -> ok | {error, Reason}
                             when SslSocket :: sslsocket(), NewController :: pid(), Reason :: any().

Assigns a new controlling process to the SSL socket.

A controlling process is the owner of an SSL socket and receives all messages from the socket.

handshake_cancel(Socket)

(since OTP 21.0)

-spec handshake_cancel(#sslsocket{socket_handle :: term(),
                                  connection_handler :: term(),
                                  payload_sender :: term(),
                                  transport_cb :: term(),
                                  connection_cb :: term(),
                                  tab :: term(),
                                  listener_config :: term()}) ->
                          any().

Cancel the handshake with a fatal USER_CANCELED alert.

handshake_continue(HsSocket, Options)

(since OTP 21.0)

-spec handshake_continue(HsSocket, Options) -> {ok, SslSocket} | {error, Reason}
                            when
                                HsSocket :: sslsocket(),
                                Options :: [client_option() | server_option() | common_option()],
                                SslSocket :: sslsocket(),
                                Reason :: closed | timeout | error_alert().

Equivalent to handshake_continue(HsSocket, Options, infinity).

handshake_continue(HsSocket, Options, Timeout)

(since OTP 21.0)

-spec handshake_continue(HsSocket, Options, Timeout) -> {ok, SslSocket} | {error, Reason}
                            when
                                HsSocket :: sslsocket(),
                                Options :: [client_option() | server_option() | common_option()],
                                Timeout :: timeout(),
                                SslSocket :: sslsocket(),
                                Reason :: closed | timeout | error_alert().

Continue the TLS handshake, possibly with new, additional, or changed options.

recv(SslSocket, Length)

-spec recv(SslSocket, Length) -> {ok, Data} | {error, reason()}
              when
                  SslSocket :: sslsocket(),
                  Length :: non_neg_integer(),
                  Data :: binary() | list() | HttpPacket,
                  HttpPacket :: any().

Equivalent to recv(Socket, Length, infinity).

recv(SslSocket, Length, Timeout)

-spec recv(SslSocket, Length, Timeout) -> {ok, Data} | {error, reason()}
              when
                  SslSocket :: sslsocket(),
                  Length :: non_neg_integer(),
                  Data :: binary() | list() | HttpPacket,
                  Timeout :: timeout(),
                  HttpPacket :: any().

Receives a packet from a socket in passive mode.

A closed socket is indicated by return value {error, closed}. Argument Length is meaningful only when the socket is in mode raw and denotes the number of bytes to read. If Length is zero, all available bytes are returned. If Length is greater than zero, exactly Length bytes are returned, or an error; possibly discarding less than Length bytes of data when the socket gets closed from the other side.

Optional argument Timeout specifies a time-out in milliseconds. The default value is infinity.

send(SslSocket, Data)

-spec send(SslSocket, Data) -> ok | {error, reason()} when SslSocket :: sslsocket(), Data :: iodata().

Writes Data to SslSocket.

A notable return value is {error, closed} indicating that the socket is closed.

setopts(SslSocket, Options)

-spec setopts(SslSocket, Options) -> ok | {error, reason()}
                 when SslSocket :: sslsocket(), Options :: [gen_tcp:option()].

Sets options according to Options for socket SslSocket.

Note

Note that setting low level transport protocol specific options may or may not work in a TLS-environment. And even if they work it may make your code platform specific, or stop working in later version of this application. Such options could make sense for some special corner cases although it is not a general viable option. Such trade-offs must be carefully considered by the user that need to fully understand the consequences of setting such options.

shutdown(SslSocket, How)

(since OTP R14B)

-spec shutdown(SslSocket, How) -> ok | {error, reason()}
                  when SslSocket :: sslsocket(), How :: read | write | read_write.

Immediately closes a socket in one or two directions.

How == write means closing the socket for writing, but reading from it is still possible.

To handle siutations where the peer has performed a shutdown on the write side, option {exit_on_close, false} is useful.

Deprecated API

prf(SslSocket, Secret, Label, Seed, WantedLength)

(since OTP R15B01)

This function is deprecated. ssl:prf/5 is deprecated; Use export_key_materials/4 instead. Note that in OTP 28 the 'testing' way of calling this function will no longer be supported..

-spec prf(SslSocket, Secret, Label, Seed, WantedLength) -> {ok, binary()} | {error, reason()}
             when
                 SslSocket :: sslsocket(),
                 Secret :: binary() | master_secret,
                 Label :: binary(),
                 Seed :: [binary() | prf_random()],
                 WantedLength :: non_neg_integer().

Uses the Pseudo-Random Function (PRF) of a TLS session to generate extra key material.

It either takes user-generated values for Secret and Seed or atoms directing it to use a specific value from the session security parameters.

Note

This function is replaced by export_key_materials/4, the officially documented API function since OTP 27, which is equivalent to prf(TLSSocket, master_secret, Label, [client_random, server_random, Context], WantedLength). Other ways of calling this function were for testing purposes only and has no use case. When called in a TLS-1.3 context it will now behave as export_key_materials(TLSSocket, [Label], [Context], [WantedLength]).

Pre TLS-1.3 API

eccs()

(since OTP 19.2)

-spec eccs() -> NamedCurves when NamedCurves :: [named_curve()].

Returns a list of all supported elliptic curves, including legacy curves, for all TLS/DTLS versions prior to TLS-1.3.

eccs(Version)

(since OTP 19.2)

-spec eccs(Version) -> NamedCurves
              when
                  Version :: 'tlsv1.2' | 'tlsv1.1' | tlsv1 | 'dtlsv1.2' | dtlsv1,
                  NamedCurves :: [named_curve()].

Returns the elliptic curves supported by default for Version.

This is a subset of what eccs/0 returns.

renegotiate(SslSocket)

(since OTP R14B)

-spec renegotiate(SslSocket) -> ok | {error, reason()} when SslSocket :: sslsocket().

Initiates a new handshake.

A notable return value is {error, renegotiation_rejected} indicating that the peer refused to go through with the renegotiation, but the connection is still active using the previously negotiated session.

TLS-1.3 has removed the renegotiation feature from earlier TLS versions and instead adds a new feature called key update, which replaces the most important part of renegotiation: the refreshing of session keys. This is triggered automatically after reaching a plaintext limit and can be configured using the key_update_at option in common_option_tls13/0.

Server API

handshake(HsSocket)

(since OTP 21.0)

-spec handshake(HsSocket) -> {ok, SslSocket} | {ok, SslSocket, Ext} | {error, Reason}
                   when
                       HsSocket :: sslsocket(),
                       SslSocket :: sslsocket(),
                       Ext :: protocol_extensions(),
                       Reason :: closed | timeout | error_alert().

Equivalent to handshake(HsSocket, infinity).

handshake(HsSocket, OptionsOrTimeout)

(since OTP 21.0)

-spec handshake(HsSocket, OptionsOrTimeout) -> {ok, SslSocket} | {ok, SslSocket, Ext} | {error, Reason}
                   when
                       HsSocket :: sslsocket(),
                       OptionsOrTimeout :: timeout() | [server_option()],
                       SslSocket :: sslsocket(),
                       Ext :: protocol_extensions(),
                       Reason :: closed | timeout | error_alert().

Performs the TLS/DTLS server-side handshake.

If the second argument is a timeout value:

handshake(HsSocket, Timeout).

this call is equivalent to:

handshake(HsSocket, [], Timeout).

Otherwise, if the second argument is a list of options:

handshake(HsSocket, Options).

this call is equivalent to:

handshake(HsSocket, Options, infinity).

handshake(Socket, Options, Timeout)

(since OTP 21.0)

-spec handshake(Socket, Options, Timeout) -> {ok, SslSocket} | {ok, SslSocket, Ext} | {error, Reason}
                   when
                       Socket :: socket() | sslsocket(),
                       SslSocket :: sslsocket(),
                       Options :: [server_option() | common_option()],
                       Timeout :: timeout(),
                       Ext :: protocol_extensions(),
                       Reason :: closed | timeout | {options, any()} | error_alert().

Performs the TLS/DTLS server-side handshake.

Returns a new TLS/DTLS socket if the handshake is successful.

If Socket is a ordinary socket(), upgrades a gen_tcp or equivalent socket to an SSL socket by performing the TLS server-side handshake and returning a TLS socket.

Note

The ordinary Socket must be in passive mode ({active, false}) before calling this function and before the client tries to connect with TLS; otherwise, the behavior of this function is undefined. The best way to ensure this is to create the ordinary listen socket in passive mode.

If Socket is an sslsocket(), provides extra TLS/DTLS options to those specified in listen/2 and then performs the TLS/DTLS handshake. Returns a new TLS/DTLS socket if the handshake is successful.

Warning

Not setting the timeout makes the server more vulnerable to Denial of Service (DoS) attacks.

If option {handshake, hello} is specified the handshake is paused after receiving the client hello message and the success response is {ok, SslSocket, Ext} instead of {ok, SslSocket}. Thereafter the handshake is continued or canceled by calling handshake_continue/3 or handshake_cancel/1.

If option active is set to once, true, or an integer value, the process owning the sslsocket() will receive messages of type active_msgs().

listen(Port, Options)

-spec listen(Port, Options) -> {ok, ListenSocket} | {error, Reason}
                when
                    Port :: inet:port_number(),
                    Options :: [tls_server_option()],
                    ListenSocket :: sslsocket(),
                    Reason :: {options, any()} | reason().

Creates an SSL listen socket.

transport_accept(ListenSocket)

-spec transport_accept(ListenSocket) -> {ok, SslSocket} | {error, Reason}
                          when ListenSocket :: sslsocket(), SslSocket :: sslsocket(), Reason :: reason().

Equivalent to transport_accept(ListenSocket, infinity).

transport_accept(ListenSocket, Timeout)

-spec transport_accept(ListenSocket, Timeout) -> {ok, SslSocket} | {error, Reason}
                          when
                              ListenSocket :: sslsocket(),
                              Timeout :: timeout(),
                              SslSocket :: sslsocket(),
                              Reason :: reason().

Accepts an incoming connection request on a listen socket.

ListenSocket must be a socket returned from listen/2. The socket returned is to be passed to handshake/1,2,3 to complete the handshake and establish the TLS/DTLS connection.

Warning

Most API functions require that the TLS/DTLS connection is established to work as expected.

The accepted socket inherits the options set for ListenSocket in listen/2.

The default value for Timeout is infinity. If Timeout is specified and no connection is accepted within the given time, {error, timeout} is returned.

TLS-1.3 Only API

groups()

(since OTP 27.0)

-spec groups() -> [group()].

Returns all supported groups in TLS 1.3.

Existed since OTP 22.0; documented as of OTP 27.0.

groups(Description)

(since OTP 27.0)

-spec groups(Description) -> [group()] when Description :: default.

Returns default supported groups in TLS 1.3.

Existed since OTP 22.0; documented as of OTP 27.0.

update_keys(SslSocket, Type)

(since OTP 22.3)

-spec update_keys(SslSocket, Type) -> ok | {error, reason()}
                     when SslSocket :: sslsocket(), Type :: write | read_write.

Create new session keys.

There are cryptographic limits on the amount of plaintext which can be safely encrypted under a given set of keys. If the amount of data surpasses those limits, a key update is triggered and a new set of keys are installed. See also the key_update_at option in common_option_tls13/0.

This function can be used to explicitly start a key update on a TLS-1.3 connection. There are two types of key updates: if Type is write, only the writing key is updated; if Type is read_write, both the reading and writing keys are updated.

Utility Functions

append_cipher_suites(Deferred, Suites)

(since OTP 20.3)

-spec append_cipher_suites(Deferred, Suites) -> ciphers()
                              when Deferred :: ciphers() | cipher_filters(), Suites :: ciphers().

Make Deferred suites become the least preferred suites.

The Deferred suites will be put at the end of the cipher suite list Suites after removing them from Suites if present. Deferred can be a list of cipher suites or a list of filters in which case the filters are used on Suites to extract the deferred cipher list.

cipher_suites(Description, Version)

(since OTP 20.3)

-spec cipher_suites(Description, Version) -> ciphers()
                       when
                           Description :: default | all | exclusive | anonymous | exclusive_anonymous,
                           Version :: protocol_version().

Lists all available cipher suites corresponding to Description.

The exclusive and exclusive_anonymous option will exclusively list cipher suites first supported in Version, whereas the other options are inclusive from the lowest possible version to Version. The all option includes all suites except anonymous suites. No anonymous suites are supported by default.

Note

TLS-1.3 has no overlapping cipher suites with previous TLS versions, meaning that the result of cipher_suites(all, 'tlsv1.3') contains a separate set of suites that can be used with TLS-1.3 and another set that can be used if a lower version is negotiated. The so-called PSK and SRP suites (prior to TLS-1.3) need extra configuration to work; namely the option user_lookup_function. No anonymous suites are supported by TLS-1.3.

Also note that the cipher suites returned by this function are the cipher suites that the OTP SSL application can support provided that they are supported by the crypto library linked with the OTP Crypto application. Use ssl:filter_cipher_suites(Suites, []) to filter the list for the current crypto library. Note that cipher suites may be filtered out because they are too old or too new depending on the crypto library.

cipher_suites(Description, Version, StringType)

(since OTP 22.0)

-spec cipher_suites(Description, Version, StringType) -> [string()]
                       when
                           Description :: default | all | exclusive | anonymous,
                           Version :: protocol_version(),
                           StringType :: rfc | openssl.

Equivalent to cipher_suites/2, but lists RFC or OpenSSL string names instead of erl_cipher_suite().

clear_pem_cache()

(since OTP 17.5)

-spec clear_pem_cache() -> ok.

Clears the PEM cache.

PEM files, used by SSL API-functions, are cached for performance reasons. The cache is automatically checked at regular intervals to determine whether any cache entries should be invalidated.

This function provides a way to unconditionally clear the entire cache, thereby forcing a reload of previously cached PEM files.

connection_information(SslSocket)

(since OTP 18.0)

-spec connection_information(SslSocket) -> {ok, Result} | {error, reason()}
                                when SslSocket :: sslsocket(), Result :: connection_info().

Returns the most relevant information about the connection.

Some items that are undefined will be filtered out. No values that affect the security of the connection will be returned.

Note

The legacy cipher_suite item was removed in OTP 23. Previously it returned the cipher suite in its (undocumented) legacy format. It is replaced by selected_cipher_suite.

connection_information(SslSocket, Items)

(since OTP 18.0)

-spec connection_information(SslSocket, Items) -> {ok, Result} | {error, reason()}
                                when
                                    SslSocket :: sslsocket(),
                                    Items :: connection_info_keys(),
                                    Result :: connection_info().

Returns the requested information items about the connection if they are defined.

Note that the values for client_random, server_random, master_secret, and keylog affect the security of connection.

In order to retrieve keylog information from a TLS connection, the keep_secrets option must be configured in advance.

Note

If only undefined options are requested the resulting list can be empty.

export_key_materials(SslSocket, Labels, Contexts, WantedLengths)

(since OTP 27.0)

-spec export_key_materials(SslSocket, Labels, Contexts, WantedLengths) ->
                              {ok, ExportKeyMaterials} | {error, reason()}
                              when
                                  SslSocket :: sslsocket(),
                                  Labels :: [binary()],
                                  Contexts :: [binary() | no_context],
                                  WantedLengths :: [non_neg_integer()],
                                  ExportKeyMaterials :: [binary()].

Equivalent to export_key_materials(TLSSocket, Labels, Contexts, WantedLengths, true).

export_key_materials(SslSocket, Labels, Contexts, WantedLengths, ConsumeSecret)

(since OTP 27.0)

-spec export_key_materials(SslSocket, Labels, Contexts, WantedLengths, ConsumeSecret) ->
                              {ok, ExportKeyMaterials} |
                              {error, exporter_master_secret_already_consumed | bad_input}
                              when
                                  SslSocket :: sslsocket(),
                                  Labels :: [binary()],
                                  Contexts :: [binary() | no_context],
                                  WantedLengths :: [non_neg_integer()],
                                  ConsumeSecret :: boolean(),
                                  ExportKeyMaterials :: [binary()].

Uses a Pseudo-Random Function (PRF prior to TLS-1.3) or a Key Derivation Function (HKDF in TLS-1.3) for a TLS connection to generate and export keying materials.

In TLS-1.3, using no_context is equivalent to specifying an empty context (an empty binary). Prior to TLS-1.3, no_context and an empty context will produce different results.

The ConsumeSecret argument is relevant only in TLS-1.3, causing the TLS-1.3 exporter_master_secret to be consumed, thereby making it unavailable and increasing security. Further attempts to call this function will fail.

filter_cipher_suites(Suites, Filters)

(since OTP 20.3)

-spec filter_cipher_suites(Suites, Filters) -> Ciphers
                              when
                                  Suites :: ciphers(), Filters :: cipher_filters(), Ciphers :: ciphers().

Removes cipher suites if any of the filter functions returns false for any part of the cipher suite.

If no filter function is supplied for some part, the default behavior treats it as a filter function that returns true. For examples, see Customizing cipher suites . Additionally, this function also filters the cipher suites to exclude cipher suites not supported by the crypto library used by the OTP Crypto application, meaning that ssl:filter_cipher_suites(Suites, []) is equivalent to applying only the filters for crypto library support.

format_error(Error)

-spec format_error(Error) -> ReasonStr when Error :: {error, reason()} | reason(), ReasonStr :: string().

Presents the error returned by an SSL function as a printable string.

getopts(SslSocket, OptionNames)

-spec getopts(SslSocket, OptionNames) -> {ok, [gen_tcp:option()]} | {error, reason()}
                 when SslSocket :: sslsocket(), OptionNames :: [gen_tcp:option_name()].

Gets the values of the specified socket options.

getstat(SslSocket)

(since OTP 19.0)

-spec getstat(SslSocket) -> {ok, OptionValues} | {error, inet:posix()}
                 when SslSocket :: sslsocket(), OptionValues :: [{inet:stat_option(), integer()}].

Get statistics for the underlying socket.

getstat(SslSocket, Options)

(since OTP 19.0)

-spec getstat(SslSocket, Options) -> {ok, OptionValues} | {error, inet:posix()}
                 when
                     SslSocket :: sslsocket(),
                     Options :: [inet:stat_option()],
                     OptionValues :: [{inet:stat_option(), integer()}].

Get one or more statistic values for the underlying socket.

See inet:getstat/2 for further details.

negotiated_protocol(SslSocket)

(since OTP 18.0)

-spec negotiated_protocol(SslSocket) -> {ok, Protocol} | {error, Reason}
                             when
                                 SslSocket :: sslsocket(),
                                 Protocol :: binary(),
                                 Reason :: protocol_not_negotiated | closed.

Returns the protocol negotiated through ALPN or NPN extensions.

peercert(SslSocket)

-spec peercert(SslSocket) -> {ok, Cert} | {error, reason()}
                  when SslSocket :: sslsocket(), Cert :: public_key:der_encoded().

The peer certificate is returned as a DER-encoded binary.

The certificate can be decoded with public_key:pkix_decode_cert/2. Suggested further reading about certificates is Public_Key User's Guide and SSL User's Guide.

peername(SslSocket)

-spec peername(SslSocket) -> {ok, {Address, Port}} | {error, reason()}
                  when
                      SslSocket :: sslsocket(), Address :: inet:ip_address(), Port :: inet:port_number().

Returns the address and port number of the peer.

prepend_cipher_suites(Preferred, Suites)

(since OTP 20.3)

-spec prepend_cipher_suites(Preferred, Suites) -> ciphers()
                               when Preferred :: ciphers() | cipher_filters(), Suites :: ciphers().

Make Preferred suites become the most preferred suites.

The Preferred suites will be put at the head of the cipher suite list Suites after removing them from Suites if present. Preferred can be a list of cipher suites or a list of filters in which case the filters are used on Suites to extract the preferred cipher list.

signature_algs(Description, Version)

(since OTP 26.0)

-spec signature_algs(Description, Version) -> signature_algs()
                        when Description :: default | all | exclusive, Version :: protocol_version().

Lists all available signature algorithms corresponding to Description.

The exclusive option will exclusively list algorithms or algorithm schemes for that protocol version, whereas the default and all options lists the combined list to support the range of protocols from (D)TLS-1.2, the first version to support configuration of the signature algorithms, to Version.

Example:

1> ssl:signature_algs(default, 'tlsv1.3').
[mldsa87,mldsa65,mldsa44,slh_dsa_shake_256f,slh_dsa_shake_256s,
 slh_dsa_sha2_256f,slh_dsa_sha2_256s,slh_dsa_shake_192f,slh_dsa_shake_192s,
 slh_dsa_sha2_192f,slh_dsa_sha2_192s,slh_dsa_shake_128f,slh_dsa_shake_128s,
 slh_dsa_sha2_128f,slh_dsa_sha2_128s,eddsa_ed25519,eddsa_ed448,
 ecdsa_secp521r1_sha512,ecdsa_secp384r1_sha384,ecdsa_secp256r1_sha256,
 ecdsa_brainpoolP512r1tls13_sha512,ecdsa_brainpoolP384r1tls13_sha384,
 ecdsa_brainpoolP256r1tls13_sha256,rsa_pss_pss_sha512,rsa_pss_pss_sha384,
 rsa_pss_pss_sha256,rsa_pss_rsae_sha512,rsa_pss_rsae_sha384,
 rsa_pss_rsae_sha256,rsa_pkcs1_sha512,rsa_pkcs1_sha384,rsa_pkcs1_sha256,
 {sha512,ecdsa},
 {sha384,ecdsa},
 {sha256,ecdsa}].

2> ssl:signature_algs(all, 'tlsv1.3').
[mldsa87,mldsa65,mldsa44,slh_dsa_shake_256f,slh_dsa_shake_256s,
 slh_dsa_sha2_256f,slh_dsa_sha2_256s,slh_dsa_shake_192f,slh_dsa_shake_192s,
 slh_dsa_sha2_192f,slh_dsa_sha2_192s,slh_dsa_shake_128f,slh_dsa_shake_128s,
 slh_dsa_sha2_128f,slh_dsa_sha2_128s,eddsa_ed25519,eddsa_ed448,
 ecdsa_secp521r1_sha512,ecdsa_secp384r1_sha384,ecdsa_secp256r1_sha256,
 ecdsa_brainpoolP512r1tls13_sha512,ecdsa_brainpoolP384r1tls13_sha384,
 ecdsa_brainpoolP256r1tls13_sha256,rsa_pss_pss_sha512,rsa_pss_pss_sha384,
 rsa_pss_pss_sha256,rsa_pss_rsae_sha512,rsa_pss_rsae_sha384,
 rsa_pss_rsae_sha256,rsa_pkcs1_sha512,rsa_pkcs1_sha384,rsa_pkcs1_sha256,
 {sha512,ecdsa},
 {sha384,ecdsa},
 {sha256,ecdsa},
 slh_dsa_shake_256f,slh_dsa_shake_256s,slh_dsa_sha2_256f,slh_dsa_sha2_256s,
 slh_dsa_shake_192f,slh_dsa_shake_192s,slh_dsa_sha2_192f,slh_dsa_sha2_192s,
 slh_dsa_shake_128f,slh_dsa_shake_128s,slh_dsa_sha2_128f,slh_dsa_sha2_128s,
 ecdsa_sha1,rsa_pkcs1_sha1,
 {sha224,ecdsa},
 {sha224,rsa},
 {sha,dsa}]

3> [ssl:signature_algs(exclusive, 'tlsv1.3').
[mldsa87,mldsa65,mldsa44,slh_dsa_shake_256f,slh_dsa_shake_256s,
 slh_dsa_sha2_256f,slh_dsa_sha2_256s,slh_dsa_shake_192f,slh_dsa_shake_192s,
 slh_dsa_sha2_192f,slh_dsa_sha2_192s,slh_dsa_shake_128f,slh_dsa_shake_128s,
 slh_dsa_sha2_128f,slh_dsa_sha2_128s,eddsa_ed25519,eddsa_ed448,
 ecdsa_secp521r1_sha512,ecdsa_secp384r1_sha384,ecdsa_secp256r1_sha256,
 ecdsa_brainpoolP512r1tls13_sha512,ecdsa_brainpoolP384r1tls13_sha384,
 ecdsa_brainpoolP256r1tls13_sha256,rsa_pss_pss_sha512,rsa_pss_pss_sha384,
 rsa_pss_pss_sha256,rsa_pss_rsae_sha512,rsa_pss_rsae_sha384,
 rsa_pss_rsae_sha256,rsa_pkcs1_sha512,rsa_pkcs1_sha384,rsa_pkcs1_sha256]

Note

Some TLS-1-3 scheme names overlap with TLS-1.2 algorithm-tuple-pair-names and then TLS-1.3 names will be used, for example rsa_pkcs1_sha256 instead of {sha256, rsa}. These are legacy algorithms in TLS-1.3 that apply only to certificate signatures in this version of the protocol.

sockname(SslSocket)

-spec sockname(SslSocket) -> {ok, {Address, Port}} | {error, reason()}
                  when
                      SslSocket :: sslsocket(), Address :: inet:ip_address(), Port :: inet:port_number().

Returns the local address and port number of socket SslSocket.

start()

(since OTP R14B)

-spec start() -> ok | {error, reason()}.

Equivalent to start(temporary).

start(Type)

(since OTP R14B)

-spec start(permanent | transient | temporary) -> ok | {error, reason()}.

Starts the SSL application.

stop()

(since OTP R14B)

-spec stop() -> ok.

Stops the SSL application.

str_to_suite(CipherSuiteName)

(since OTP 22.0)

-spec str_to_suite(CipherSuiteName) -> erl_cipher_suite() | {error, {not_recognized, CipherSuiteName}}
                      when CipherSuiteName :: string().

Converts an RFC or OpenSSL name string to an erl_cipher_suite/0

Returns an error if the cipher suite is not supported or the name is not a valid cipher suite name.

suite_to_openssl_str(CipherSuite)

(since OTP 22.0)

-spec suite_to_openssl_str(CipherSuite) -> string() when CipherSuite :: erl_cipher_suite().

Converts an erl_cipher_suite() value to an OpenSSL name string.

PRE TLS-1.3 these names differ for RFC names

suite_to_str(CipherSuite)

(since OTP 21.0)

-spec suite_to_str(CipherSuite) -> string() when CipherSuite :: erl_cipher_suite().

Converts an erl_cipher_suite() value to an RFC name string.

versions()

(since OTP R14B)

-spec versions() -> [VersionInfo]
                  when
                      VersionInfo ::
                          {ssl_app, string()} |
                          {supported | available | implemented, [tls_version()]} |
                          {supported_dtls | available_dtls | implemented_dtls, [dtls_version()]}.

Lists information, mainly concerning TLS/DTLS versions, in runtime for debugging and testing purposes.

app_vsn - The application version of the SSL application.

supported - TLS versions supported with current application environment and crypto library configuration. Overridden by a version option on connect/2,3,4, listen/2, and handshake/2,3. For the negotiated TLS version, see connection_information/1.

supported_dtls - DTLS versions supported with current application environment and crypto library configuration. Overridden by a version option on connect/2,3,4, listen/2, and handshake/2,3. For the negotiated DTLS version, see connection_information/1.

available - All TLS versions supported with the linked crypto library.

available_dtls - All DTLS versions supported with the linked crypto library.

implemented - All TLS versions supported by the SSL application if linked with a crypto library with the necessary support.

implemented_dtls - All DTLS versions supported by the SSL application if linked with a crypto library with the necessary support.

ssl_crl_cache

CRL cache

Implements an internal CRL (Certificate Revocation List) cache. In addition to implementing the ssl_crl_cache_api behaviour the following functions are available.

Summary

Types

crl_src()

A source to input CRLs

Functions

delete(Entries)

Delete CRLs from the ssl applications local cache.

insert(CRLSrc)

Equivalent to insert/2.

insert(DistPointURI, CRLSrc)

Insert CRLs into the ssl applications local cache, with or without a distribution point reference URI

Types

crl_src()

(since OTP 18.0)

-type crl_src() :: {file, file:filename()} | {der, public_key:der_encoded()}.

A source to input CRLs

Functions

delete(Entries)

(since OTP 18.0)

-spec delete(Entries) -> ok | {error, Reason}
                when Entries :: crl_src() | uri_string:uri_string(), Reason :: ssl:reason().

Delete CRLs from the ssl applications local cache.

insert(CRLSrc)

(since OTP 18.0)

-spec insert(CRLSrc) -> ok | {error, Reason} when CRLSrc :: crl_src(), Reason :: ssl:reason().

Equivalent to insert/2.

insert(DistPointURI, CRLSrc)

(since OTP 18.0)

-spec insert(DistPointURI, CRLSrc) -> ok | {error, Reason}
                when
                    DistPointURI :: uri_string:uri_string(), CRLSrc :: crl_src(), Reason :: ssl:reason().

Insert CRLs into the ssl applications local cache, with or without a distribution point reference URI

ssl_crl_cache_api behaviour

API for a TLS CRL (Certificate Revocation List) cache.

When TLS performs certificate path validation according to RFC 5280 it should also perform CRL validation checks. To enable the CRL checks the application needs access to CRLs. A database of CRLs can be set up in many different ways. This module provides the behavior of the API needed to integrate an arbitrary CRL cache with the erlang ssl application. It is also used by the application itself to provide a simple default implementation of a CRL cache.

Summary

Types

crl_cache_ref()

Reference to the CRL cache.

dist_point()

For description see X509 certificates records

logger_info()

Information for ssl applications use of Logger(3)

Callbacks

fresh_crl(DistPoint, CRL)

fun fresh_crl/2 will be used as input option update_crl to public_key:pkix_crls_validate/3.

lookup(DistPoint, CacheRef)

Backwards compatibility, replaced by lookup/3

lookup(Distpoint, Issuer, CacheRef)

Lookup the CRLs belonging to the distribution point Distributionpoint. This function may choose to only look in the cache or to follow distribution point links depending on how the cache is administrated.

select(IssuerOrDPLocations, CacheRef)

Select the CRLs in the cache that are issued by Issuer unless the value is a list of so called general names, see X509 certificates records, originating form #'DistributionPoint'.cRLissuer and representing different mechanism to obtain the CRLs. The cache callback needs to use the appropriate entry to retrieve the CRLs or return an empty list if it does not exist.

Types

crl_cache_ref()

(since OTP 18.0)

-type crl_cache_ref() :: any().

Reference to the CRL cache.

dist_point()

(since OTP 18.0)

-type dist_point() ::
          #'DistributionPoint'{distributionPoint :: term(), reasons :: term(), cRLIssuer :: term()}.

For description see X509 certificates records

logger_info()

(since OTP 18.0)

-type logger_info() ::
          {logger:level(), Report :: #{description => string(), reason => term()}, logger:metadata()}.

Information for ssl applications use of Logger(3)

Callbacks

fresh_crl(DistPoint, CRL)

(since OTP 18.0)

-callback fresh_crl(DistPoint :: dist_point(), CRL :: public_key:der_encoded()) ->
                       public_key:der_encoded() | {logger, logger_info(), public_key:der_encoded()}.

fun fresh_crl/2 will be used as input option update_crl to public_key:pkix_crls_validate/3.

It is possible to return logger info, since OTP 22.2, that will be used by the TLS connection to produce log events.

lookup(DistPoint, CacheRef)

(since OTP 18.0) (optional)

-callback lookup(DistPoint :: dist_point(), CacheRef :: crl_cache_ref()) ->
                    not_available |
                    [public_key:der_encoded()] |
                    {{logger, logger_info()}, [public_key:der_encoded()]}.

Backwards compatibility, replaced by lookup/3

lookup(Distpoint, Issuer, CacheRef)

(since OTP 19.0)

-callback lookup(Distpoint :: dist_point(), Issuer :: public_key:issuer_name(), CacheRef :: crl_cache_ref()) ->
                    not_available |
                    [public_key:der_encoded()] |
                    {{logger, logger_info()}, [public_key:der_encoded()]}.

Lookup the CRLs belonging to the distribution point Distributionpoint. This function may choose to only look in the cache or to follow distribution point links depending on how the cache is administrated.

The Issuer argument contains the issuer name of the certificate to be checked. Normally the returned CRL should be issued by this issuer, except if the cRLIssuer field of DistributionPoint has a value, in which case that value should be used instead.

In an earlier version of this API, the lookup function received two arguments, omitting Issuer. For compatibility, this is still supported: if there is no lookup/3 function in the callback module,lookup/2 is called instead.

It is possible to return logger info, since OTP 22.2, that will be used by the TLS connection to produce log events.

select(IssuerOrDPLocations, CacheRef)

(since OTP 18.0)

-callback select(IssuerOrDPLocations, CacheRef) -> [CRL] | {logger, logger_info(), [CRL]}
                    when
                        CRL :: public_key:der_encoded(),
                        IssuerOrDPLocations :: public_key:issuer_name() | list(),
                        CacheRef :: crl_cache_ref().

Select the CRLs in the cache that are issued by Issuer unless the value is a list of so called general names, see X509 certificates records, originating form #'DistributionPoint'.cRLissuer and representing different mechanism to obtain the CRLs. The cache callback needs to use the appropriate entry to retrieve the CRLs or return an empty list if it does not exist.

It is possible to return logger info, since OTP 22.2, that will be used by the TLS connection to produce log events.

ssl_session_cache_api behaviour

TLS session cache API

Defines the API for the TLS session cache (pre TLS-1.3) so that the data storage scheme can be replaced by defining a new callback module implementing this API.

Summary

Types

partial_key()

The opaque part of the key. Does not need to be handled by the callback.

session()

The session data that is stored for each session.

session_cache_key()

A key to an entry in the session cache.

session_cache_ref()

A term that can be used to reference the cache.

Callbacks

delete(CacheRef, Key)

Deletes a cache entry.

foldl(Fun, Acc0, CacheRef)

Calls Fun(Elem, AccIn) on successive elements of the cache, starting with AccIn == Acc0.

init(InitArgs)

Performs possible initializations of the cache and returns a reference to it that is used as parameter to the other API functions.

lookup(CacheRef, Key)

Looks up a cache entry. Is to be callable from any process.

select_session(CacheRef, Server)

Selects sessions that can be reused, that is sessions that include PartialKey in its key. Is to be callable from any process.

size(CacheRef)

Returns the number of sessions in the cache.

terminate(CacheRef)

Takes care of possible cleanup that is needed when the cache handling process terminates.

update(CacheRef, Key, Session)

Caches a new session or updates an already cached one.

Types

partial_key()

(since OTP R14B)

-opaque partial_key()

The opaque part of the key. Does not need to be handled by the callback.

session()

(since OTP R14B)

-opaque session()

The session data that is stored for each session.

session_cache_key()

(since OTP R14B)

-type session_cache_key() :: {partial_key(), ssl:session_id()}.

A key to an entry in the session cache.

session_cache_ref()

(since OTP R14B)

-type session_cache_ref() :: any().

A term that can be used to reference the cache.

Callbacks

delete(CacheRef, Key)

(since OTP R14B)

-callback delete(CacheRef, Key) -> DoNotCare
                    when CacheRef :: session_cache_ref(), Key :: session_cache_key(), DoNotCare :: any().

Deletes a cache entry.

Is only called from the cache handling process.

foldl(Fun, Acc0, CacheRef)

(since OTP R14B) (optional)

-callback foldl(Fun, Acc0, CacheRef) -> Acc
                   when Fun :: fun(), Acc0 :: term(), CacheRef :: session_cache_ref(), Acc :: term().

Calls Fun(Elem, AccIn) on successive elements of the cache, starting with AccIn == Acc0.

Fun/2 must return a new accumulator, which is passed to the next call. The function returns the final value of the accumulator. Acc0 is returned if the cache is empty.

Note

Since OTP-23.3 this functions is only used on the client side and does not need to implemented for a server cache.

init(InitArgs)

(since OTP 18.0)

-callback init(InitArgs) -> CacheRef when InitArgs :: list(), CacheRef :: session_cache_ref().

Performs possible initializations of the cache and returns a reference to it that is used as parameter to the other API functions.

Is called by the cache handling processes init function, hence putting the same requirements on it as a normal process init function. This function is called twice when starting the SSL application, once with the role client and once with the role server, as the SSL application must be prepared to take on both roles.

Includes property {role, client | server} in init argument list. Currently this is the only predefined property, there can also be user-defined properties. See also application environment variable session_cb_init_args.

lookup(CacheRef, Key)

(since OTP R14B)

-callback lookup(CacheRef, Key) -> Session
                    when
                        CacheRef :: session_cache_ref(),
                        Key :: session_cache_key(),
                        Session :: session() | undefined.

Looks up a cache entry. Is to be callable from any process.

select_session(CacheRef, Server)

(since OTP R14B) (optional)

-callback select_session(CacheRef, Server) -> Sessions
                            when
                                CacheRef :: session_cache_ref(),
                                Server :: {ssl:host(), inet:port_number()} | inet:port_number(),
                                Sessions :: [session()].

Selects sessions that can be reused, that is sessions that include PartialKey in its key. Is to be callable from any process.

Note

Since OTP-23.3 This functions is only used on the client side and does not need to implemented for a server cache.

size(CacheRef)

(since OTP 19.3)

-callback size(CacheRef) -> Size when CacheRef :: session_cache_ref(), Size :: pos_integer().

Returns the number of sessions in the cache.

If size exceeds the maximum number of sessions, the current cache entries will be invalidated regardless of their remaining lifetime. Is to be callable from any process.

terminate(CacheRef)

(since OTP R14B)

-callback terminate(CacheRef) -> DoNotCare when CacheRef :: session_cache_ref(), DoNotCare :: any().

Takes care of possible cleanup that is needed when the cache handling process terminates.

update(CacheRef, Key, Session)

(since OTP R14B)

-callback update(CacheRef, Key, Session) -> DoNotCare
                    when
                        CacheRef :: session_cache_ref(),
                        Key :: session_cache_key(),
                        Session :: session() | undefined,
                        DoNotCare :: any().

Caches a new session or updates an already cached one.

Is only called from the cache handling process.