local tls = require'libtls'

libtls ffi binding. Use it with libtls_bearssl or with your own LibreSSL binary.

Rationale

libtls has a sane API as opposed to OpenSSL. libtls doesn’t force us to do I/O in its callbacks which allows us to yield in I/O. libtls works on user-provided I/O as opposed to LuaSec which only works on sockets.

API

tls.config(opt) -> conf	create a shared config object
conf:free()	free the config object
tls.client(conf) -> cts	create and configure a client context
tls.server(conf) -> sts	create and configure a server context
ts:reset(conf)	reset and re-configure a context
sts:accept(read_cb, write_cb, cb_arg) -> cts	accept a connection
cts:connect(vhost, read_cb, write_cb, cb_arg)	connect to a server
cts:recv(buf, maxsz) -> sz	receive data
cts:send(s|buf, [sz])	send data
ts:close()	close a connection
ts:free()	free a context

Config options

alpn
ca	CA certificate
key	server key
cert	server certificate
ocsp_staple	ocsp staple
crl	CRL data
keypairs	{{cert=, key=, ocsp_staple=},...}
ticket_keys	{{keyrev=, key=},...}
ciphers	cipher list
dheparams	DHE params
ecdhecurve	ECDHE curve
ecdhecurves	ECDHE curves
protocols	protocols (‘tlsv1.0’..’tlsv1.3’)
verify_depth	certificate verification depth
prefer_ciphers_client	prefer client’s cipher list
prefer_ciphers_server	prefer server’s cipher list
insecure_noverifycert	don’t verify server’s certificate
insecure_noverifyname	don’t verify server’s name
insecure_noverifytime	disable cert and OSCP validation
ocsp_require_stapling	require OCSP stapling
verify_client	check client certificate
verify_client_optional	check client certificate if provided
session_id	session id
session_lifetime	session lifetime

Last updated: 22 months ago | Edit on GitHub