TLS_SERVER¶

6.114.1. type tls_server¶

A `tls_server` is a factory of server side TLS connections.

A `tls_server` holds various data which live longer than single TLS connections, such as key pairs, certificates, and data for session resumption.

`connect` makes a new `tls` connection, and performs the initial handshake.

Config methods:

• C.need_cert

• C.on_success($success): default = VAL.identity

• C.on_error($error): default = {(:Exc) Exc.raise }

If the connection is made and the initial handshake succeeds, `connect` tail-calls $success with the created `tls` value.

If the connection is not made, or the initial handshake fails, `connect` tail-calls $error with an `exception`.

Client authentication

If C.need_cert is called, the TLS connection desires certificate-based client authentications, and verifies the returned certificate.

If no certificate is returned from the client, or verification fails, `connect` results in an error.

If the `tls_server` desires client authentication, usually the `tls_server` also needs to be configured with the a non-empty `trust_anchor`.

Preconditions

`Tcp` must be a `tcp`, which the TLS connection uses.

The protocol family of `Tcp` must be IPv4 or IPv6.

`Tcp` must be open.

$success must be a function which takes a `tls`.

$error must be a function which takes an `exception`.

`new` makes a new `tls_server`.

Config methods:

• C.trust_anchor(Ta): default = empty `trust_anchor`

• C.on_success($success): default = VAL.identity

• C.on_error($error): default = {(:Exc) Exc.raise }

`Ta` is used to verify certificates of TLS clients.

If successful, `new` tails-calls $success with the created `tls_server`.

On an error, `new` tail-calls $error with an `exception`.

Preconditions

`Key_pair_set` must be a `key_pair_set`, which contains the server key pairs.

`Ta` must be a `trust_anchor`.

$success must be a function which takes a `tls_server`.

$error must be a function which takes an `exception`.

`is?` returns whether `Val` is a `tls_server`.