SecureBlackbox Lite 2020 iOS Edition

Questions / Feedback?

TLSClient Class

Properties   Methods   Events   Configuration Settings   Errors  

The TLSClient class provides client-side functionality of the TLS protocol.

Syntax

SecureBlackboxLiteTLSClient
SecureBlackboxLiteTLSClientSwift

Remarks

Use this component to set up secure connections from your application.

TLSClient offers comprehensive support for all versions of the TLS protocol, including the most popular TLS 1.2 and the newest TLS 1.3. Among other features this component can offer are:

  • Certificate-based and PSK authentication types are supported, making this component the ideal fit for all sorts of Internet environments.
  • Support for efficient reconnections using TLS session resume approach.
  • Comprehensive support for all existing cipher suites.
  • DH and Elliptic Curve key exchange algorithms.
  • Support for SNI, Extended Master Secret, Cookie, and other protocol extensions included as standard.
  • Support for secure renegotiation.
  • Resistant to all known TLS attacks (heartbleed, POODLE, BEAST, and others).

With TLS mode switched off, this component turns to an efficient TCP socket client.

Property List


The following is the full list of the properties of the class with short descriptions. Click on the links for further details.

- blockedCertCountThe number of records in the BlockedCert arrays.
- blockedCertBytes:(int)blockedCertIndexReturns raw certificate data in DER format.
- blockedCertHandle:(int)blockedCertIndexAllows to get or set a 'handle', a unique identifier of the underlying property object.
- clientCertCountThe number of records in the ClientCert arrays.
- clientCertBytes:(int)clientCertIndexReturns raw certificate data in DER format.
- clientCertHandle:(int)clientCertIndexAllows to get or set a 'handle', a unique identifier of the underlying property object.
- connectedIndicates whether the connection is active.
- connInfoAEADCipherIndicates whether the encryption algorithm used is an AEAD cipher.
- connInfoChainValidationDetailsThe details of a certificate chain validation outcome.
- connInfoChainValidationResultThe outcome of a certificate chain validation routine.
- connInfoCiphersuiteThe cipher suite employed by this connection.
- connInfoClientAuthenticatedSpecifies whether client authentication was performed during this connection.
- connInfoClientAuthRequestedSpecifies whether client authentication was requested during this connection.
- connInfoConnectionEstablishedIndicates whether the connection has been established fully.
- connInfoConnectionIDThe unique identifier assigned to this connection.
- connInfoDigestAlgorithmThe digest algorithm used in a TLS-enabled connection.
- connInfoEncryptionAlgorithmThe symmetric encryption algorithm used in a TLS-enabled connection.
- connInfoExportableIndicates whether a TLS connection uses a reduced-strength exportable cipher.
- connInfoKeyExchangeAlgorithmThe key exchange algorithm used in a TLS-enabled connection.
- connInfoKeyExchangeKeyBitsThe length of the key exchange key of a TLS-enabled connection.
- connInfoNamedECCurveThe elliptic curve used in this connection.
- connInfoPFSCipherIndicates whether the chosen ciphersuite provides perfect forward secrecy (PFS).
- connInfoPreSharedIdentityHintA hint professed by the server to help the client select the PSK identity to use.
- connInfoPublicKeyBitsThe length of the public key.
- connInfoResumedSessionIndicates whether a TLS-enabled connection was spawned from another TLS connection.
- connInfoSecureConnectionIndicates whether TLS or SSL is enabled for this connection.
- connInfoServerAuthenticatedIndicates whether server authentication was performed during a TLS-enabled connection.
- connInfoSignatureAlgorithmThe signature algorithm used in a TLS handshake.
- connInfoSymmetricBlockSizeThe block size of the symmetric algorithm used.
- connInfoSymmetricKeyBitsThe key length of the symmetric algorithm used.
- connInfoTotalBytesReceivedThe total number of bytes received over this connection.
- connInfoTotalBytesSentThe total number of bytes sent over this connection.
- connInfoValidationLogContains the server certificate's chain validation log.
- connInfoVersionIndicates the version of SSL/TLS protocol negotiated during this connection.
- errorOriginIndicates the endpoint where the error originates from.
- errorSeverityThe severity of the error that happened.
- externalCryptoCustomParamsCustom parameters to be passed to the signing service (uninterpreted).
- externalCryptoDataAdditional data to be included in the async state and mirrored back by the requestor.
- externalCryptoExternalHashCalculationSpecifies whether the message hash is to be calculated at the external endpoint.
- externalCryptoHashAlgorithmSpecifies the request's signature hash algorithm.
- externalCryptoKeyIDThe ID of the pre-shared key used for DC request authentication.
- externalCryptoKeySecretThe pre-shared key used for DC request authentication.
- externalCryptoMethodSpecifies the asynchronous signing method.
- externalCryptoModeSpecifies the external cryptography mode.
- externalCryptoPublicKeyAlgorithmProvide public key algorithm here if the certificate is not available on the pre-signing stage.
- knownCertCountThe number of records in the KnownCert arrays.
- knownCertBytes:(int)knownCertIndexReturns raw certificate data in DER format.
- knownCertHandle:(int)knownCertIndexAllows to get or set a 'handle', a unique identifier of the underlying property object.
- knownCRLCountThe number of records in the KnownCRL arrays.
- knownCRLBytes:(int)knownCRLIndexReturns raw CRL data in DER format.
- knownCRLHandle:(int)knownCRLIndexAllows to get or set a 'handle', a unique identifier of the underlying property object.
- knownOCSPCountThe number of records in the KnownOCSP arrays.
- knownOCSPBytes:(int)knownOCSPIndexBuffer containing raw OCSP response data.
- knownOCSPHandle:(int)knownOCSPIndexAllows to get or set a 'handle', a unique identifier of the underlying property object.
- outputBytesA memory buffer where the incoming data is collected.
- outputStringA string where the incoming data is collected.
- proxyAddressThe IP address of the proxy server.
- proxyAuthenticationThe authentication type used by the proxy server.
- proxyPasswordThe password to authenticate to the proxy server.
- proxyPortThe port on the proxy server to connect to.
- proxyProxyTypeThe type of the proxy server.
- proxyRequestHeadersContains HTTP request headers for WebTunnel and HTTP proxy.
- proxyResponseBodyContains the HTTP or HTTPS (WebTunnel) proxy response body.
- proxyResponseHeadersContains response headers received from an HTTP or HTTPS (WebTunnel) proxy server.
- proxyUseIPv6Specifies whether IPv6 should be used when connecting through the proxy.
- proxyUseProxyEnables or disables proxy-driven connection.
- proxyUsernameSpecifies the username credential for proxy authentication.
- serverCertCountThe number of records in the ServerCert arrays.
- serverCertBytes:(int)serverCertIndexReturns raw certificate data in DER format.
- serverCertCAKeyID:(int)serverCertIndexA unique identifier (fingerprint) of the CA certificate's private key.
- serverCertFingerprint:(int)serverCertIndexContains the fingerprint (a hash imprint) of this certificate.
- serverCertHandle:(int)serverCertIndexAllows to get or set a 'handle', a unique identifier of the underlying property object.
- serverCertIssuer:(int)serverCertIndexThe common name of the certificate issuer (CA), typically a company name.
- serverCertIssuerRDN:(int)serverCertIndexA collection of information, in the form of [OID, Value] pairs, uniquely identifying the certificate issuer.
- serverCertKeyAlgorithm:(int)serverCertIndexSpecifies the public key algorithm of this certificate.
- serverCertKeyBits:(int)serverCertIndexReturns the length of the public key.
- serverCertKeyFingerprint:(int)serverCertIndexReturns a fingerprint of the public key contained in the certificate.
- serverCertKeyUsage:(int)serverCertIndexIndicates the purposes of the key contained in the certificate, in the form of an OR'ed flag set.
- serverCertPublicKeyBytes:(int)serverCertIndexContains the certificate's public key in DER format.
- serverCertSelfSigned:(int)serverCertIndexIndicates whether the certificate is self-signed (root) or signed by an external CA.
- serverCertSerialNumber:(int)serverCertIndexReturns the certificate's serial number.
- serverCertSigAlgorithm:(int)serverCertIndexIndicates the algorithm that was used by the CA to sign this certificate.
- serverCertSubject:(int)serverCertIndexThe common name of the certificate holder, typically an individual's name, a URL, an e-mail address, or a company name.
- serverCertSubjectKeyID:(int)serverCertIndexContains a unique identifier (fingerprint) of the certificate's private key.
- serverCertSubjectRDN:(int)serverCertIndexA collection of information, in the form of [OID, Value] pairs, uniquely identifying the certificate holder (subject).
- serverCertValidFrom:(int)serverCertIndexThe time point at which the certificate becomes valid, in UTC.
- serverCertValidTo:(int)serverCertIndexThe time point at which the certificate expires, in UTC.
- socketDNSModeSelects the DNS resolver to use: the class's (secure) built-in one, or the one provided by the system.
- socketDNSPortSpecifies the port number to be used for sending queries to the DNS server.
- socketDNSQueryTimeoutThe timeout (in milliseconds) for each DNS query.
- socketDNSServersThe addresses of DNS servers to use for address resolution, separated by commas or semicolons.
- socketDNSTotalTimeoutThe timeout (in milliseconds) for the whole resolution process.
- socketIncomingSpeedLimitThe maximum number of bytes to read from the socket, per second.
- socketLocalAddressThe local network interface to bind the socket to.
- socketLocalPortThe local port number to bind the socket to.
- socketOutgoingSpeedLimitThe maximum number of bytes to write to the socket, per second.
- socketTimeoutThe maximum period of waiting, in milliseconds, after which the socket operation is considered unsuccessful.
- socketUseIPv6Enables or disables IP protocol version 6.
- TLSAutoValidateCertificatesSpecifies whether server-side TLS certificates should be validated automatically using internal validation rules.
- TLSBaseConfigurationSelects the base configuration for the TLS settings.
- TLSCiphersuitesA list of ciphersuites separated with commas or semicolons.
- TLSECCurvesDefines the elliptic curves to enable.
- TLSForceResumeIfDestinationChangesWhether to force TLS session resumption when the destination address changes.
- TLSPreSharedIdentityDefines the identity used when the PSK (Pre-Shared Key) key-exchange mechanism is negotiated.
- TLSPreSharedKeyContains the pre-shared for the PSK (Pre-Shared Key) key-exchange mechanism, encoded with base16.
- TLSPreSharedKeyCiphersuiteDefines the ciphersuite used for PSK (Pre-Shared Key) negotiation.
- TLSRenegotiationAttackPreventionModeSelects renegotiation attack prevention mechanism.
- TLSRevocationCheckSpecifies the kind(s) of revocation check to perform.
- TLSSSLOptionsVarious SSL (TLS) protocol options, set of cssloExpectShutdownMessage 0x001 Wait for the close-notify message when shutting down the connection cssloOpenSSLDTLSWorkaround 0x002 (DEPRECATED) Use a DTLS version workaround when talking to very old OpenSSL versions cssloDisableKexLengthAlignment 0x004 Do not align the client-side PMS by the RSA modulus size.
- TLSTLSModeSpecifies the TLS mode to use.
- TLSUseExtendedMasterSecretEnables Extended Master Secret Extension, as defined in RFC 7627.
- TLSUseSessionResumptionEnables or disables TLS session resumption capability.
- TLSVersionsTh SSL/TLS versions to enable by default.
- trustedCertCountThe number of records in the TrustedCert arrays.
- trustedCertBytes:(int)trustedCertIndexReturns raw certificate data in DER format.
- trustedCertHandle:(int)trustedCertIndexAllows to get or set a 'handle', a unique identifier of the underlying property object.

Method List


The following is the full list of the methods of the class with short descriptions. Click on the links for further details.

- configSets or retrieves a configuration setting.
- connectEstablishes connection to a remote server.
- disconnectDisconnects from the server.
- receiveAllDataReads data from the connection.
- receiveDataReads data from the connection.
- sendDataSends a buffer to the server.
- sendKeepAliveSends a keep-alive packet.
- sendTextSends a text string to the server.

Event List


The following is the full list of the events fired by the class with short descriptions. Click on the links for further details.

- onCertificateValidateFires when the server's TLS certificate has to be validated.
- onErrorInformation about errors during data delivery.
- onExternalSignHandles remote or external signing initiated by the SignExternal method or other source.
- onNotificationThis event notifies the application about an underlying control flow event.

Configuration Settings


The following is a list of configuration settings for the class with short descriptions. Click on the links for further details.

IgnoreSystemTrustWhether trusted Windows Certificate Stores should be treated as trusted.
TolerateMinorChainIssuesWhether to tolerate minor chain issues.
UseMicrosoftCTLEnables or disables automatic use of Microsoft online certificate trust list.
UseSystemCertificatesEnables or disables the use of the system certificates.

Copyright (c) 2022 /n software inc. - All rights reserved.
SecureBlackbox Lite 2020 iOS Edition - Version 20.0 [Build 8166]