\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n put_https4<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n The above mentioned functions actually return the response headers as a list, which only gets converted to hash upon assignment (this assignment looses information if the same header occurs twice, as may be the case with cookies). There are also other variants of the functions that return unprocessed headers and that return a reference to a hash.<\/p>\n ($page, $response, @headers) = get_https(‘www.bacus.pt’, 443, ‘\/’);
for ($i = 0; $i < $#headers; $i+=2) {
print “$headers[$i] = ” . $headers[$i+1] . “n”;
}
($page, $response, $headers, $server_cert)
= get_https3(‘www.bacus.pt’, 443, ‘\/’);
print “$headersn”;
($page, $response, $headers_ref)
= get_https4(‘www.bacus.pt’, 443, ‘\/’);
for $k (sort keys %{$headers_ref}) {
for $v (@{$$headers_ref{$k}}) {
print “$k = $vn”;
}
}<\/p>\n All of the above code fragments accomplish the same thing: display all values of all headers. The API<\/small> functions ending in “3” return the headers simply as a scalar string and it is up to the application to split them up. The functions ending in “4” return a reference to a hash of arrays (see perlref and perllol if you are not familiar with complex perl data structures). To access a single value of such a header hash you would do something like<\/p>\n print $$headers_ref{COOKIE}[0];<\/p>\n Variants 3 and 4 also allow you to discover the server certificate in case you would like to store or display it, e.g.<\/p>\n ($p, $resp, $hdrs, $server_cert) = get_https3(‘www.bacus.pt’, 443, ‘\/’);
if (!defined($server_cert) || ($server_cert == 0)) {
warn “Subject Name: undefined, Issuer Name: undefined”;
} else {
warn ‘Subject Name: ‘
. Net::SSLeay::X509_NAME_oneline(
Net::SSLeay::X509_get_subject_name($server_cert))
. ‘Issuer Name: ‘
. Net::SSLeay::X509_NAME_oneline(
Net::SSLeay::X509_get_issuer_name($server_cert));
}<\/p>\n Beware that this method only allows after the fact verification of the certificate: by the time “get_https3()” has returned the https request has already been sent to the server, whether you decide to trust it or not. To do the verification correctly you must either employ the OpenSSL certificate verification framework or use the lower level API<\/small> to first connect and verify the certificate and only then send the http data. See the implementation of “ds_https3()” for guidance on how to do this.<\/p>\n Using client certificates<\/i><\/p>\n Secure web communications are encrypted using symmetric crypto keys exchanged using encryption based on the certificate of the server. Therefore in all SSL<\/small> connections the server must have a certificate. This serves both to authenticate the server to the clients and to perform the key exchange.<\/p>\n Sometimes it is necessary to authenticate the client as well. Two options are available: HTTP<\/small> basic authentication and a client side certificate. The basic authentication over HTTPS<\/small> is actually quite safe because HTTPS<\/small> guarantees that the password will not travel in the clear. Never-the-less, problems like easily guessable passwords remain. The client certificate method involves authentication of the client at the SSL<\/small> level using a certificate. For this to work, both the client and the server have certificates (which typically are different) and private keys.<\/p>\n The API<\/small> functions outlined above accept additional arguments that allow one to supply the client side certificate and key files. The format of these files is the same as used for server certificates and the caveat about encrypting private keys applies.<\/p>\n ($page, $result, %headers) = # 2c
= get_https(‘www.bacus.pt’, 443, ‘\/protected.html’,
make_headers(Authorization =>
‘Basic ‘ . MIME::Base64::encode(“$user:$pass”,”)),
”, $mime_type6, $path_to_crt7, $path_to_key8);
($page, $response, %reply_headers)
= post_https(‘www.bacus.pt’, 443, ‘\/foo.cgi’, # 3b
make_headers(‘Authorization’ =>
‘Basic ‘ . MIME::Base64::encode(“$user:$pass”,”)),
make_form(OK => ‘1’, name => ‘Sampo’),
$mime_type6, $path_to_crt7, $path_to_key8);<\/p>\n Case 2c (in SYNOPSIS<\/small> )<\/b> demonstrates getting a password protected page that also requires a client certificate, i.e. it is possible to use both authentication methods simultaneously.<\/p>\n Case 3b (in SYNOPSIS<\/small> )<\/b> is a full blown POST<\/small> to a secure server that requires both password authentication and a client certificate, just like in case 2c.<\/p>\n Note: The client will not send a certificate unless the server requests one. This is typically achieved by setting the verify mode to “VERIFY_PEER” on the server:<\/p>\n Net::SSLeay::set_verify(ssl, Net::SSLeay::VERIFY_PEER, 0);<\/p>\n See “perldoc ~openssl\/doc\/ssl\/SSL_CTX_set_verify.pod” for a full description.<\/p>\n Working through a web proxy<\/i><\/p>\n\n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n set_proxy<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n “Net::SSLeay” can use a web proxy to make its connections. You need to first set the proxy host and port using “set_proxy()” and then just use the normal API<\/small> functions, e.g:<\/p>\n Net::SSLeay::set_proxy(‘gateway.myorg.com’, 8080);
($page) = get_https(‘www.bacus.pt’, 443, ‘\/’);<\/p>\n If your proxy requires authentication, you can supply a username and password as well<\/p>\n Net::SSLeay::set_proxy(‘gateway.myorg.com’, 8080, ‘joe’, ‘salainen’);
($page, $result, %headers) =
= get_https(‘www.bacus.pt’, 443, ‘\/protected.html’,
make_headers(Authorization =>
‘Basic ‘ . MIME::Base64::encode(“susie:pass”,”))
);<\/p>\n This example demonstrates the case where we authenticate to the proxy as “joe” and to the final web server as “susie”. Proxy authentication requires the “MIME::Base64” module to work.<\/p>\n HTTP<\/small> (without S) API<\/small><\/i><\/p>\n\n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n get_http<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n | \n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n post_http<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n | \n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n tcpcat<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n | \n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n get_httpx<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n | \n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n post_httpx<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n | \n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n tcpxcat<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n Over the years it has become clear that it would be convenient to use the light-weight flavour API<\/small> of “Net::SSLeay” for normal HTTP<\/small> as well (see “LWP” for the heavy-weight object-oriented approach). In fact it would be nice to be able to flip https on and off on the fly. Thus regular HTTP<\/small> support was evolved.<\/p>\n use Net::SSLeay qw(get_http post_http tcpcat
get_httpx post_httpx tcpxcat
make_headers make_form);
($page, $result, %headers)
= get_http(‘www.bacus.pt’, 443, ‘\/protected.html’,
make_headers(Authorization =>
‘Basic ‘ . MIME::Base64::encode(“$user:$pass”,”))
);
($page, $response, %reply_headers)
= post_http(‘www.bacus.pt’, 443, ‘\/foo.cgi’, ”,
make_form(OK => ‘1’,
name => ‘Sampo’
));
($reply, $err) = tcpcat($host, $port, $request);
($page, $result, %headers)
= get_httpx($usessl, ‘www.bacus.pt’, 443, ‘\/protected.html’,
make_headers(Authorization =>
‘Basic ‘ . MIME::Base64::encode(“$user:$pass”,”))
);
($page, $response, %reply_headers)
= post_httpx($usessl, ‘www.bacus.pt’, 443, ‘\/foo.cgi’, ”,
make_form(OK => ‘1’, name => ‘Sampo’ ));
($reply, $err, $server_cert) = tcpxcat($usessl, $host, $port, $request);<\/p>\n As can be seen, the “x” family of APIs takes as the first argument a flag which indicates whether SSL<\/small> is used or not.<\/p>\n Certificate verification and Certificate Revocation Lists (CRLs)<\/b>
OpenSSL supports the ability to verify peer certificates. It can also optionally check the peer certificate against a Certificate Revocation List ( CRL<\/small> ) from the certificates issuer. A CRL<\/small> is a file, created by the certificate issuer that lists all the certificates that it previously signed, but which it now revokes. CRLs are in PEM<\/small> format.<\/p>\n You can enable “Net::SSLeay CRL” checking like this:<\/p>\n &Net::SSLeay::X509_STORE_set_flags
(&Net::SSLeay::CTX_get_cert_store($ssl),
&Net::SSLeay::X509_V_FLAG_CRL_CHECK);<\/p>\n After setting this flag, if OpenSSL checks a peer\u2019s certificate, then it will attempt to find a CRL<\/small> for the issuer. It does this by looking for a specially named file in the search directory specified by CTX_load_verify_locations. CRL<\/small> files are named with the hash of the issuer\u2019s subject name, followed by “.r0”, “.r1” etc. For example “ab1331b2.r0”, “ab1331b2.r1”. It will read all the .r files for the issuer, and then check for a revocation of the peer certificate in all of them. (You can also force it to look in a specific named CRL<\/small> file., see below). You can find out the hash of the issuer subject name in a CRL<\/small> with<\/p>\n openssl crl \u2212in crl.pem \u2212hash \u2212noout<\/p>\n If the peer certificate does not pass the revocation list, or if no CRL<\/small> is found, then the handshaking fails with an error.<\/p>\n You can also force OpenSSL to look for CRLs in one or more arbitrarily named files.<\/p>\n my $bio = Net::SSLeay::BIO_new_file($crlfilename, ‘r’);
my $crl = Net::SSLeay::PEM_read_bio_X509_CRL($bio);
if ($crl) {
Net::SSLeay::X509_STORE_add_crl(
Net::SSLeay::CTX_get_cert_store($ssl, $crl)
);
} else {
error reading CRL….
}<\/p>\n Usually the URLs where you can download the CRLs is contained in the certificate itself and you can extract them with<\/p>\n my @url = Net::SSLeay::P_X509_get_crl_distribution_points($cert)<\/p>\n But there is no automatic downloading of the CRLs and often these CRLs are too huge to just download them to verify a single certificate. Also, these CRLs are often in DER<\/small> format which you need to convert to PEM<\/small> before you can use it:<\/p>\n openssl crl \u2212in crl.der \u2212inform der \u2212out crl.pem<\/p>\n So as an alternative for faster and timely revocation checks you better use the Online Status Revocation Protocol ( OCSP<\/small> ).<\/p>\n Certificate verification and Online Status Revocation Protocol ( OCSP<\/small> )<\/b>
While checking for revoked certificates is possible and fast with Certificate Revocation Lists, you need to download the complete and often huge list before you can verify a single certificate.<\/p>\n A faster way is to ask the CA<\/small> to check the revocation of just a single or a few certificates using OCSP.<\/small> Basically you generate for each certificate an OCSP_CERTID<\/small> based on the certificate itself and its issuer, put the ids togetether into an OCSP_REQUEST<\/small> and send the request to the URL<\/small> given in the certificate.<\/p>\n As a result you get back an OCSP_RESPONSE<\/small> and need to check the status of the response, check that it is valid (e.g. signed by the CA<\/small> ) and finally extract the information about each OCSP_CERTID<\/small> to find out if the certificate is still valid or got revoked.<\/p>\n With Net::SSLeay this can be done like this:<\/p>\n # get id(s) for given certs, like from get_peer_certificate
# or get_peer_cert_chain. This will croak if
# \u2212 one tries to make an OCSP_CERTID for a self\u2212signed certificate
# \u2212 the issuer of the certificate cannot be found in the SSL objects
# store, nor in the current certificate chain
my $cert = Net::SSLeay::get_peer_certificate($ssl);
my $id = eval { Net::SSLeay::OCSP_cert2ids($ssl,$cert) };
die “failed to make OCSP_CERTID: $@” if $@;
# create OCSP_REQUEST from id(s)
# Multiple can be put into the same request, if the same OCSP responder
# is responsible for them.
my $req = Net::SSLeay::OCSP_ids2req($id);
# determine URI of OCSP responder
my $uri = Net::SSLeay::P_X509_get_ocsp_uri($cert);
# Send stringified OCSP_REQUEST with POST to $uri.
# We can ignore certificate verification for https, because the OCSP
# response itself is signed.
my $ua = HTTP::Tiny\u2212>new(verify_SSL => 0);
my $res = $ua\u2212>request( ‘POST’,$uri, {
headers => { ‘Content\u2212type’ => ‘application\/ocsp\u2212request’ },
content => Net::SSLeay::i2d_OCSP_REQUEST($req)
});
my $content = $res && $res\u2212>{success} && $res\u2212>{content}
or die “query failed”;
# Extract OCSP_RESPONSE.
# this will croak if the string is not an OCSP_RESPONSE
my $resp = eval { Net::SSLeay::d2i_OCSP_RESPONSE($content) };
# Check status of response.
my $status = Net::SSLeay::OCSP_response_status($resp);
if ($status != Net::SSLeay::OCSP_RESPONSE_STATUS_SUCCESSFUL())
die “OCSP response failed: “.
Net::SSLeay::OCSP_response_status_str($status);
}
# Verify signature of response and if nonce matches request.
# This will croak if there is a nonce in the response, but it does not match
# the request. It will return false if the signature could not be verified,
# in which case details can be retrieved with Net::SSLeay::ERR_get_error.
# It will not complain if the response does not contain a nonce, which is
# usually the case with pre\u2212signed responses.
if ( ! eval { Net::SSLeay::OCSP_response_verify($ssl,$resp,$req) }) {
die “OCSP response verification failed”;
}
# Extract information from OCSP_RESPONSE for each of the ids.
# If called in scalar context it will return the time (as time_t), when the
# next update is due (minimum of all successful responses inside $resp). It
# will croak on the following problems:
# \u2212 response is expired or not yet valid
# \u2212 no response for given OCSP_CERTID
# \u2212 certificate status is not good (e.g. revoked or unknown)
if ( my $nextupd = eval { Net::SSLeay::OCSP_response_results($resp,$id) }) {
warn “certificate is valid, next update in “.
($nextupd\u2212time()).” secondsn”;
} else {
die “certificate is not valid: $@”;
}
# But in array context it will return detailed information about each given
# OCSP_CERTID instead croaking on errors:
# if no @ids are given it will return information about all single responses
# in the OCSP_RESPONSE
my @results = Net::SSLeay::OCSP_response_results($resp,@ids);
for my $r (@results) {
print Dumper($r);
# @results are in the same order as the @ids and contain:
# $r\u2212>[0] \u2212 OCSP_CERTID
# $r\u2212>[1] \u2212 undef if no error (certificate good) OR error message as string
# $r\u2212>[2] \u2212 hash with details:
# thisUpdate \u2212 time_t of this single response
# nextUpdate \u2212 time_t when update is expected
# statusType \u2212 integer:
# V_OCSP_CERTSTATUS_GOOD(0)
# V_OCSP_CERTSTATUS_REVOKED(1)
# V_OCSP_CERTSTATUS_UNKNOWN(2)
# revocationTime \u2212 time_t (only if revoked)
# revocationReason \u2212 integer (only if revoked)
# revocationReason_str \u2212 reason as string (only if revoked)
}<\/p>\n To further speed up certificate revocation checking one can use a TLS<\/small> extension to instruct the server to staple the OCSP<\/small> response:<\/p>\n # set TLS extension before doing SSL_connect
Net::SSLeay::set_tlsext_status_type($ssl,
Net::SSLeay::TLSEXT_STATUSTYPE_ocsp());
# setup callback to verify OCSP response
my $cert_valid = undef;
Net::SSLeay::CTX_set_tlsext_status_cb($context,sub {
my ($ssl,$resp) = @_;
if (!$resp) {
# Lots of servers don’t return an OCSP response.
# In this case we must check the OCSP status outside the SSL
# handshake.
warn “server did not return stapled OCSP responsen”;
return 1;
}
# verify status
my $status = Net::SSLeay::OCSP_response_status($resp);
if ($status != Net::SSLeay::OCSP_RESPONSE_STATUS_SUCCESSFUL()) {
warn “OCSP response failure: $statusn”;
return 1;
}
# verify signature \u2212 we have no OCSP_REQUEST here to check nonce
if (!eval { Net::SSLeay::OCSP_response_verify($ssl,$resp) }) {
warn “OCSP response verify failedn”;
return 1;
}
# check if the certificate is valid
# we should check here against the peer_certificate
my $cert = Net::SSLeay::get_peer_certificate();
my $certid = eval { Net::SSLeay::OCSP_cert2ids($ssl,$cert) } or do {
warn “cannot get certid from cert: $@”;
$cert_valid = \u22121;
return 1;
};
if ( $nextupd = eval {
Net::SSLeay::OCSP_response_results($resp,$certid) }) {
warn “certificate not revokedn”;
$cert_valid = 1;
} else {
warn “certificate not valid: $@”;
$cert_valid = 0;
}
});
# do SSL handshake here
….
# check if certificate revocation was checked already
if ( ! defined $cert_valid) {
# check revocation outside of SSL handshake by asking OCSP responder
…
} elsif ( ! $cert_valid ) {
die “certificate not valid \u2212 closing SSL connection”;
} elsif ( $cert_valid<0 ) {
die “cannot verify certificate revocation \u2212 self\u2212signed ?”;
} else {
# everything fine
…
}<\/p>\n Using Net::SSLeay in multi-threaded applications
IMPORTANT:<\/small> versions 1.42 or earlier are not thread-safe!<\/b><\/p>\n Net::SSLeay module implements all necessary stuff to be ready for multi-threaded environment \u2212 it requires openssl\u22120.9.7 or newer. The implementation fully follows thread safety related requirements of openssl library(see ).<\/p>\nIf you are about to use Net::SSLeay (or any other module based on Net::SSLeay) in multi-threaded perl application it is recommended to follow this best-practice:<\/p>\n Initialization<\/i><\/p>\n Load and initialize Net::SSLeay module in the main thread:<\/p>\n use threads;
use Net::SSLeay;
Net::SSLeay::load_error_strings();
Net::SSLeay::SSLeay_add_ssl_algorithms();
Net::SSLeay::randomize();
sub do_master_job {
#… call whatever from Net::SSLeay
}
sub do_worker_job {
#… call whatever from Net::SSLeay
}
#start threads
my $master = threads\u2212>new(&do_master_job, ‘param1’, ‘param2’);
my @workers = threads\u2212>new(&do_worker_job, ‘arg1’, ‘arg2’) for (1..10);
#waiting for all threads to finish
$_\u2212>join() for (threads\u2212>list);<\/p>\n NOTE:<\/small> Openssl\u2019s “int SSL_library_init(void)” function (which is also aliased as “SSLeay_add_ssl_algorithms”, “OpenSSL_add_ssl_algorithms” and “add_ssl_algorithms”) is not re-entrant and multiple calls can cause a crash in threaded application. Net::SSLeay implements flags preventing repeated calls to this function, therefore even multiple initialization via Net::SSLeay::SSLeay_add_ssl_algorithms()<\/b> should work without trouble.<\/p>\n Using callbacks<\/i><\/p>\n Do not use callbacks across threads (the module blocks cross-thread callback operations and throws a warning). Always do the callback setup, callback use and callback destruction within the same thread.<\/p>\n Using openssl elements<\/i><\/p>\n All openssl elements (X509, SSL_CTX, …<\/small> ) can be directly passed between threads.<\/p>\n use threads;
use Net::SSLeay;
Net::SSLeay::load_error_strings();
Net::SSLeay::SSLeay_add_ssl_algorithms();
Net::SSLeay::randomize();
sub do_job {
my $context = shift;
Net::SSLeay::CTX_set_default_passwd_cb($context, sub { “secret” });
#…
}
my $c = Net::SSLeay::CTX_new();
threads\u2212>create(&do_job, $c);<\/p>\n Or:<\/p>\n use threads;
use Net::SSLeay;
my $context; #does not need to be ‘shared’
Net::SSLeay::load_error_strings();
Net::SSLeay::SSLeay_add_ssl_algorithms();
Net::SSLeay::randomize();
sub do_job {
Net::SSLeay::CTX_set_default_passwd_cb($context, sub { “secret” });
#…
}
$context = Net::SSLeay::CTX_new();
threads\u2212>create(&do_job);<\/p>\n Using other perl modules based on Net::SSLeay<\/i><\/p>\n It should be fine to use any other module based on Net::SSLeay (like IO::Socket::SSL) in multi-threaded applications. It is generally recommended to do any global initialization of such a module in the main thread before calling “threads\u2212>new(..)” or “threads\u2212>create(..)” but it might differ module by module.<\/p>\n To be safe you can load and init Net::SSLeay explicitly in the main thread:<\/p>\n use Net::SSLeay;
use Other::SSLeay::Based::Module;
Net::SSLeay::load_error_strings();
Net::SSLeay::SSLeay_add_ssl_algorithms();
Net::SSLeay::randomize();<\/p>\n Or even safer:<\/p>\n use Net::SSLeay;
use Other::SSLeay::Based::Module;
BEGIN {
Net::SSLeay::load_error_strings();
Net::SSLeay::SSLeay_add_ssl_algorithms();
Net::SSLeay::randomize();
}<\/p>\n Combining Net::SSLeay with other modules linked with openssl<\/i><\/p>\n BEWARE:<\/small> This might be a big trouble! This is not guaranteed be thread-safe!<\/b><\/p>\n There are many other ( XS<\/small> ) modules linked directly to openssl library (like Crypt::SSLeay).<\/p>\n As it is expected that also “another” module will call “SSLeay_add_ssl_algorithms” at some point we have again a trouble with multiple openssl initialization by Net::SSLeay and “another” module.<\/p>\n As you can expect Net::SSLeay is not able to avoid multiple initialization of openssl library called by “another” module, thus you have to handle this on your own (in some cases it might not be possible at all to avoid this).<\/p>\n Threading with get_https and friends<\/i><\/p>\n The convenience functions get_https, post_https etc all initialize the SSL<\/small> library by calling Net::SSLeay::initialize which does the conventional library initialization:<\/p>\n Net::SSLeay::load_error_strings();
Net::SSLeay::SSLeay_add_ssl_algorithms();
Net::SSLeay::randomize();<\/p>\n Net::SSLeay::initialize initializes the SSL<\/small> library at most once. You can override the Net::SSLeay::initialize function if you desire some other type of initialization behaviour by get_https and friends. You can call Net::SSLeay::initialize from your own code if you desire this conventional library initialization.<\/p>\n Convenience routines<\/b>
To be used with Low level API<\/small><\/p>\n Net::SSLeay::randomize($rn_seed_file,$additional_seed);
Net::SSLeay::set_cert_and_key($ctx, $cert_path, $key_path);
$cert = Net::SSLeay::dump_peer_certificate($ssl);
Net::SSLeay::ssl_write_all($ssl, $message) or die “ssl write failure”;
$got = Net::SSLeay::ssl_read_all($ssl) or die “ssl read failure”;
$got = Net::SSLeay::ssl_read_CRLF($ssl [, $max_length]);
$got = Net::SSLeay::ssl_read_until($ssl [, $delimit [, $max_length]]);
Net::SSLeay::ssl_write_CRLF($ssl, $message);<\/p>\n \n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n randomize<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n seeds the openssl PRNG<\/small> with “\/dev\/urandom” (see the top of “SSLeay.pm” for how to change or configure this) and optionally with user provided data. It is very important to properly seed your random numbers, so do not forget to call this. The high level API<\/small> functions automatically call “randomize()” so it is not needed with them. See also caveats.<\/p>\n\n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n set_cert_and_key<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n takes two file names as arguments and sets the certificate and private key to those. This can be used to set either server certificates or client certificates.<\/p>\n \n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n dump_peer_certificate<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n allows you to get a plaintext description of the certificate the peer (usually the server) presented to us.<\/p>\n \n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n ssl_read_all<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n see ssl_write_all (below)<\/p>\n \n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n ssl_write_all<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n “ssl_read_all()” and “ssl_write_all()” provide true blocking semantics for these operations (see limitation, below, for explanation). These are much preferred to the low level API<\/small> equivalents (which implement BSD<\/small> blocking semantics). The message argument to “ssl_write_all()” can be a reference. This is helpful to avoid unnecessary copying when writing something big, e.g:<\/p>\n $data = ‘A’ x 1000000000;
Net::SSLeay::ssl_write_all($ssl, $data) or die “ssl write failed”;<\/p>\n \n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n ssl_read_CRLF<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n uses “ssl_read_all()” to read in a line terminated with a carriage return followed by a linefeed ( CRLF<\/small> ). The CRLF<\/small> is included in the returned scalar.<\/p>\n\n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n ssl_read_until<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n uses “ssl_read_all()” to read from the SSL<\/small> input stream until it encounters a programmer specified delimiter. If the delimiter is undefined, $\/ is used. If $\/ is undefined, “n” is used. One can optionally set a maximum length of bytes to read from the SSL<\/small> input stream.<\/p>\n\n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n ssl_write_CRLF<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n writes $message and appends CRLF<\/small> to the SSL<\/small> output stream.<\/p>\n Initialization<\/b>
In order to use the low level API<\/small> you should start your programs with the following incantation:<\/p>\n use Net::SSLeay qw(die_now die_if_ssl_error);
Net::SSLeay::load_error_strings();
Net::SSLeay::SSLeay_add_ssl_algorithms(); # Important!
Net::SSLeay::ENGINE_load_builtin_engines(); # If you want built\u2212in engines
Net::SSLeay::ENGINE_register_all_complete(); # If you want built\u2212in engines
Net::SSLeay::randomize();<\/p>\n Error handling functions<\/b>
I can not emphasize the need to check for error enough. Use these functions even in the most simple programs, they will reduce debugging time greatly. Do not ask questions on the mailing list without having first sprinkled these in your code.<\/p>\n\n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n die_now<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n | \n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n die_if_ssl_error<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n “die_now()” and “die_if_ssl_error()” are used to conveniently print the SSLeay error stack when something goes wrong:<\/p>\n Net::SSLeay::connect($ssl) or die_now(“Failed SSL connect ($!)”);
Net::SSLeay::write($ssl, “foo”) or die_if_ssl_error(“SSL write ($!)”);<\/p>\n \n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n print_errs<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n You can also use “Net::SSLeay::print_errs()” to dump the error stack without exiting the program. As can be seen, your code becomes much more readable if you import the error reporting functions into your main name space.<\/p>\n Sockets<\/b>
Perl uses file handles for all I\/O. While SSLeay has a quite flexible BIO<\/small> mechanism and perl has an evolved PerlIO mechanism, this module still sticks to using file descriptors. Thus to attach SSLeay to a socket you should use “fileno()” to extract the underlying file descriptor:<\/p>\n Net::SSLeay::set_fd($ssl, fileno(S)); # Must use fileno<\/p>\n You should also set $| to 1 to eliminate STDIO<\/small> buffering so you do not get confused if you use perl I\/O functions to manipulate your socket handle.<\/p>\n If you need to select(2) on the socket, go right ahead, but be warned that OpenSSL does some internal buffering so SSL_read does not always return data even if the socket selected for reading (just keep on selecting and trying to read). “Net::SSLeay” is no different from the C language OpenSSL in this respect.<\/p>\n Callbacks<\/b>
You can establish a per-context verify callback function something like this:<\/p>\n sub verify {
my ($ok, $x509_store_ctx) = @_;
print “Verifying certificate…n”;
…
return $ok;
}<\/p>\n It is used like this:<\/p>\n Net::SSLeay::set_verify ($ssl, Net::SSLeay::VERIFY_PEER, &verify);<\/p>\n Per-context callbacks for decrypting private keys are implemented.<\/p>\n Net::SSLeay::CTX_set_default_passwd_cb($ctx, sub { “top\u2212secret” });
Net::SSLeay::CTX_use_PrivateKey_file($ctx, “key.pem”,
Net::SSLeay::FILETYPE_PEM)
or die “Error reading private key”;
Net::SSLeay::CTX_set_default_passwd_cb($ctx, undef);<\/p>\n If Hello Extensions are supported by your OpenSSL, a session secret callback can be set up to be called when a session secret is set by openssl.<\/p>\n Establish it like this:
Net::SSLeay::set_session_secret_cb($ssl, &session_secret_cb, $somedata);<\/p>\n It will be called like this:<\/p>\n sub session_secret_cb
{
my ($secret, @cipherlist, $preferredcipher, $somedata) = @_;
}<\/p>\n No other callbacks are implemented. You do not need to use any callback for simple (i.e. normal) cases where the SSLeay built-in verify mechanism satisfies your needs.<\/p>\n It is required to reset these callbacks to undef immediately after use to prevent memory leaks, thread safety problems and crashes on exit that can occur if different threads set different callbacks.<\/p>\n If you want to use callback stuff, see examples\/callback.pl! It\u2019s the only one I am able to make work reliably.<\/p>\n Low level API<\/small><\/b>
In addition to the high level functions outlined above, this module contains straight-forward access to CRYPTO<\/small> and SSL<\/small> parts of OpenSSL C API.<\/small><\/p>\n See the “*.h” headers from OpenSSL C distribution for a list of low level SSLeay functions to call (check SSLeay.xs to see if some function has been implemented). The module strips the initial “SSL_” off of the SSLeay names. Generally you should use “Net::SSLeay::” in its place.<\/p>\n Note that some functions are prefixed with “P_” \u2212 these are very close to the original API<\/small> however contain some kind of a wrapper making its interface more perl friendly.<\/p>\n For example:<\/p>\n In C:<\/p>\n #include
err = SSL_set_verify (ssl, SSL_VERIFY_CLIENT_ONCE,
&your_call_back_here);<\/p>\nIn Perl:<\/p>\n use Net::SSLeay;
$err = Net::SSLeay::set_verify ($ssl,
Net::SSLeay::VERIFY_CLIENT_ONCE,
&your_call_back_here);<\/p>\n If the function does not start with “SSL_” you should use the full function name, e.g.:<\/p>\n $err = Net::SSLeay::ERR_get_error;<\/p>\n The following new functions behave in perlish way:<\/p>\n $got = Net::SSLeay::read($ssl);
# Performs SSL_read, but returns $got
# resized according to data received.
# Returns undef on failure.
Net::SSLeay::write($ssl, $foo) || die;
# Performs SSL_write, but automatically
# figures out the size of $foo<\/p>\n Low level API:<\/small> Version related functions<\/i><\/p>\n\n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n SSLeay<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n COMPATIBILITY:<\/small><\/b> not available in Net\u2212SSLeay\u22121.42 and before<\/p>\n Gives version number (numeric) of underlaying openssl library.<\/p>\n my $ver_number = Net::SSLeay::SSLeay();
# returns: the number identifying the openssl release
#
# 0x00903100 => openssl\u22120.9.3
# 0x00904100 => openssl\u22120.9.4
# 0x00905100 => openssl\u22120.9.5
# 0x0090600f => openssl\u22120.9.6
# 0x0090601f => openssl\u22120.9.6a
# 0x0090602f => openssl\u22120.9.6b
# …
# 0x009060df => openssl\u22120.9.6m
# 0x0090700f => openssl\u22120.9.7
# 0x0090701f => openssl\u22120.9.7a
# 0x0090702f => openssl\u22120.9.7b
# …
# 0x009070df => openssl\u22120.9.7m
# 0x0090800f => openssl\u22120.9.8
# 0x0090801f => openssl\u22120.9.8a
# 0x0090802f => openssl\u22120.9.8b
# …
# 0x0090814f => openssl\u22120.9.8t
# 0x1000000f => openssl\u22121.0.0
# 0x1000004f => openssl\u22121.0.0d
# 0x1000007f => openssl\u22121.0.0g<\/p>\n You can use it like this:<\/p>\n if (Net::SSLeay::SSLeay() < 0x0090800f) {
die “you need openssl\u22120.9.8 or higher”;
}<\/p>\n \n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n SSLeay_version<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n COMPATIBILITY:<\/small><\/b> not available in Net\u2212SSLeay\u22121.42 and before<\/p>\n Gives version number (string) of underlaying openssl library.<\/p>\n my $ver_string = Net::SSLeay::SSLeay_version($type);
# $type
# SSLEAY_VERSION \u2212 e.g. ‘OpenSSL 1.0.0d 8 Feb 2011’
# SSLEAY_CFLAGS \u2212 e.g. ‘compiler: gcc \u2212D_WINDLL \u2212DOPENSSL_USE_APPLINK …..’
# SSLEAY_BUILT_ON \u2212 e.g. ‘built on: Fri May 6 00:00:46 GMT 2011’
# SSLEAY_PLATFORM \u2212 e.g. ‘platform: mingw’
# SSLEAY_DIR \u2212 e.g. ‘OPENSSLDIR: “z:\/….”‘
#
# returns: string
Net::SSLeay::SSLeay_version();
#is equivalent to
Net::SSLeay::SSLeay_version(SSLEAY_VERSION);<\/p>\n Check openssl doc <\/p>\n\n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n OpenSSL_version_num<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n COMPATIBILITY:<\/small><\/b> not available in Net\u2212SSLeay\u22121.82 and before; requires at least OpenSSL 1.1.0<\/p>\n Gives version number (numeric) of underlaying openssl library. See “SSLeay” for interpreting the result.<\/p>\n my $ver_number = Net::SSLeay::OpenSSL_version_num();
# returns: the number identifying the openssl release<\/p>\n \n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n OpenSSL_version<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n COMPATIBILITY:<\/small><\/b> not available in Net\u2212SSLeay\u22121.82 and before; requires at least OpenSSL 1.1.0<\/p>\n Gives version number (string) of underlaying openssl library.<\/p>\n my $ver_string = Net::SSLeay::OpenSSL_version($t);
# $t
# OPENSSL_VERSION \u2212 e.g. ‘OpenSSL 1.1.0g 2 Nov 2017’
# OPENSSL_CFLAGS \u2212 e.g. ‘compiler: cc \u2212DDSO_DLFCN \u2212DHAVE_DLFCN_H …..’
# OPENSSL_BUILT_ON \u2212 e.g. ‘built on: reproducible build, date unspecified’
# OPENSSL_PLATFORM \u2212 e.g. ‘platform: darwin64\u2212x86_64\u2212cc’
# OPENSSL_DIR \u2212 e.g. ‘OPENSSLDIR: “\/opt\/openssl\u22121.1.0g”‘
# OPENSSL_ENGINES_DIR \u2212 e.g. ‘ENGINESDIR: “\/opt\/openssl\u22121.1.0g\/lib\/engines\u22121.1″‘
#
# returns: string
Net::SSLeay::OpenSSL_version();
#is equivalent to
Net::SSLeay::OpenSSL_version(OPENSSL_VERSION);<\/p>\n Check openssl doc <\/p>\nLow level API:<\/small> Initialization related functions<\/i><\/p>\n\n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n library_init<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n Initialize SSL<\/small> library by registering algorithms.<\/p>\n my $rv = Net::SSLeay::library_init();<\/p>\n Check openssl doc <\/p>\nWhile the original function from OpenSSL always returns 1, Net::SSLeay adds a wrapper around it to make sure that the OpenSSL function is only called once. Thus the function will return 1 if initialization was done and 0 if not, i.e. if initialization was done already before.<\/p>\n \n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n add_ssl_algorithms<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n The alias for “library_init”<\/p>\n Net::SSLeay::add_ssl_algorithms();<\/p>\n \n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n OpenSSL_add_ssl_algorithms<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n The alias for “library_init”<\/p>\n Net::SSLeay::OpenSSL_add_ssl_algorithms();<\/p>\n \n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n SSLeay_add_ssl_algorithms<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n The alias for “library_init”<\/p>\n Net::SSLeay::SSLeay_add_ssl_algorithms();<\/p>\n \n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n load_error_strings<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n Registers the error strings for all libcrypto + libssl related functions.<\/p>\n Net::SSLeay::load_error_strings();
#
# returns: no return value<\/p>\n Check openssl doc <\/p>\n\n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n ERR_load_crypto_strings<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n Registers the error strings for all libcrypto functions. No need to call this function if you have already called “load_error_strings”.<\/p>\n Net::SSLeay::ERR_load_crypto_strings();
#
# returns: no return value<\/p>\n Check openssl doc <\/p>\n\n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n ERR_load_RAND_strings<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n Registers the error strings for RAND<\/small> related functions. No need to call this function if you have already called “load_error_strings”.<\/p>\n Net::SSLeay::ERR_load_RAND_strings();
#
# returns: no return value<\/p>\n \n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n ERR_load_SSL_strings<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n Registers the error strings for SSL<\/small> related functions. No need to call this function if you have already called “load_error_strings”.<\/p>\n Net::SSLeay::ERR_load_SSL_strings();
#
# returns: no return value<\/p>\n \n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n OpenSSL_add_all_algorithms<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n COMPATIBILITY:<\/small><\/b> not available in Net\u2212SSLeay\u22121.45 and before<\/p>\n Add algorithms to internal table.<\/p>\n Net::SSLeay::OpenSSL_add_all_algorithms();
#
# returns: no return value<\/p>\n Check openssl doc <\/p>\n\n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n OPENSSL_add_all_algorithms_conf<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n COMPATIBILITY:<\/small><\/b> not available in Net\u2212SSLeay\u22121.45 and before<\/p>\n Similar to “OpenSSL_add_all_algorithms” \u2212 will ALWAYS<\/small> load the config file<\/p>\n Net::SSLeay::OPENSSL_add_all_algorithms_conf();
#
# returns: no return value<\/p>\n \n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n OPENSSL_add_all_algorithms_noconf<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n COMPATIBILITY:<\/small><\/b> not available in Net\u2212SSLeay\u22121.45 and before<\/p>\n Similar to “OpenSSL_add_all_algorithms” \u2212 will NEVER<\/small> load the config file<\/p>\n Net::SSLeay::OPENSSL_add_all_algorithms_noconf();
#
# returns: no return value<\/p>\n Low level API:<\/small> ERR_* and SSL_alert_* related functions<\/i><\/p>\n NOTE:<\/small><\/b> Please note that SSL_alert_* function have ” SSL_”<\/small> part stripped from their names.<\/p>\n\n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n ERR_clear_error<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n Clear the error queue.<\/p>\n Net::SSLeay::ERR_clear_error();
#
# returns: no return value<\/p>\n Check openssl doc <\/p>\n\n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n ERR_error_string<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n Generates a human-readable string representing the error code $error.<\/p>\n my $rv = Net::SSLeay::ERR_error_string($error);
# $error \u2212 (unsigned integer) error code
#
# returns: string<\/p>\n Check openssl doc <\/p>\n\n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n ERR_get_error<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n Returns the earliest error code from the thread\u2019s error queue and removes the entry. This function can be called repeatedly until there are no more error codes to return.<\/p>\n my $rv = Net::SSLeay::ERR_get_error();
#
# returns: (unsigned integer) error code<\/p>\n Check openssl doc <\/p>\n\n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n ERR_peek_error<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n Returns the earliest error code from the thread\u2019s error queue without modifying it.<\/p>\n my $rv = Net::SSLeay::ERR_peek_error();
#
# returns: (unsigned integer) error code<\/p>\n Check openssl doc <\/p>\n\n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n ERR_put_error<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n Adds an error code to the thread\u2019s error queue. It signals that the error of $reason code reason occurred in function $func of library $lib, in line number $line of $file.<\/p>\n Net::SSLeay::ERR_put_error($lib, $func, $reason, $file, $line);
# $lib \u2212 (integer) library id (check openssl\/err.h for constants e.g. ERR_LIB_SSL)
# $func \u2212 (integer) function id (check openssl\/ssl.h for constants e.g. SSL_F_SSL23_READ)
# $reason \u2212 (integer) reason id (check openssl\/ssl.h for constants e.g. SSL_R_SSL_HANDSHAKE_FAILURE)
# $file \u2212 (string) file name
# $line \u2212 (integer) line number in $file
#
# returns: no return value<\/p>\n Check openssl doc and <\/p>\n\n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n alert_desc_string<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n Returns a two letter string as a short form describing the reason of the alert specified by value.<\/p>\n my $rv = Net::SSLeay::alert_desc_string($value);
# $value \u2212 (integer) allert id (check openssl\/ssl.h for SSL3_AD_* and TLS1_AD_* constants)
#
# returns: description string (2 letters)<\/p>\n Check openssl doc <\/p>\n\n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n alert_desc_string_long<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n Returns a string describing the reason of the alert specified by value.<\/p>\n my $rv = Net::SSLeay::alert_desc_string_long($value);
# $value \u2212 (integer) allert id (check openssl\/ssl.h for SSL3_AD_* and TLS1_AD_* constants)
#
# returns: description string<\/p>\n Check openssl doc <\/p>\n\n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n alert_type_string<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n Returns a one letter string indicating the type of the alert specified by value.<\/p>\n my $rv = Net::SSLeay::alert_type_string($value);
# $value \u2212 (integer) allert id (check openssl\/ssl.h for SSL3_AD_* and TLS1_AD_* constants)
#
# returns: string (1 letter)<\/p>\n Check openssl doc <\/p>\n\n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n alert_type_string_long<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n Returns a string indicating the type of the alert specified by value.<\/p>\n my $rv = Net::SSLeay::alert_type_string_long($value);
# $value \u2212 (integer) allert id (check openssl\/ssl.h for SSL3_AD_* and TLS1_AD_* constants)
#
# returns: string<\/p>\n Check openssl doc <\/p>\nLow level API:<\/small> SSL_METHOD_* related functions<\/i><\/p>\n\n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n SSLv23_method, SSLv23_server_method and SSLv23_client_method<\/p>\n<\/td>\n<\/tr>\n<\/table>\n COMPATIBILITY:<\/small><\/b> not available in Net\u2212SSLeay\u22121.82 and before.<\/p>\n Returns SSL_METHOD<\/small> structure corresponding to general-purpose version-flexible TLS<\/small> method, the return value can be later used as a param of “CTX_new_with_method”.<\/p>\n NOTE:<\/small><\/b> Consider using TLS_method, TLS_server_method or TLS_client_method with new code.<\/p>\n my $rv = Net::SSLeay::SSLv2_method();
#
# returns: value corresponding to openssl’s SSL_METHOD structure (0 on failure)<\/p>\n \n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n SSLv2_method<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n Returns SSL_METHOD<\/small> structure corresponding to SSLv2 method, the return value can be later used as a param of “CTX_new_with_method”. Only available where supported by the underlying openssl.<\/p>\n my $rv = Net::SSLeay::SSLv2_method();
#
# returns: value corresponding to openssl’s SSL_METHOD structure (0 on failure)<\/p>\n \n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n SSLv3_method<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n Returns SSL_METHOD<\/small> structure corresponding to SSLv3 method, the return value can be later used as a param of “CTX_new_with_method”.<\/p>\n my $rv = Net::SSLeay::SSLv3_method();
#
# returns: value corresponding to openssl’s SSL_METHOD structure (0 on failure)<\/p>\n Check openssl doc <\/p>\n\n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n TLSv1_method, TLSv1_server_method and TLSv1_client_method<\/p>\n<\/td>\n<\/tr>\n<\/table>\n COMPATIBILITY:<\/small><\/b> Server and client methods not available in Net\u2212SSLeay\u22121.82 and before.<\/p>\n Returns SSL_METHOD<\/small> structure corresponding to TLSv1 method, the return value can be later used as a param of “CTX_new_with_method”.<\/p>\n my $rv = Net::SSLeay::TLSv1_method();
#
# returns: value corresponding to openssl’s SSL_METHOD structure (0 on failure)<\/p>\n Check openssl doc <\/p>\n\n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n TLSv1_1_method, TLSv1_1_server_method and TLSv1_1_client_method<\/p>\n<\/td>\n<\/tr>\n<\/table>\n COMPATIBILITY:<\/small><\/b> Server and client methods not available in Net\u2212SSLeay\u22121.82 and before.<\/p>\n Returns SSL_METHOD<\/small> structure corresponding to TLSv1_1 method, the return value can be later used as a param of “CTX_new_with_method”. Only available where supported by the underlying openssl.<\/p>\n my $rv = Net::SSLeay::TLSv1_1_method();
#
# returns: value corresponding to openssl’s SSL_METHOD structure (0 on failure)<\/p>\n Check openssl doc <\/p>\n\n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n TLSv1_2_method, TLSv1_2_server_method and TLSv1_2_client_method<\/p>\n<\/td>\n<\/tr>\n<\/table>\n COMPATIBILITY:<\/small><\/b> Server and client methods not available in Net\u2212SSLeay\u22121.82 and before.<\/p>\n Returns SSL_METHOD<\/small> structure corresponding to TLSv1_2 method, the return value can be later used as a param of “CTX_new_with_method”. Only available where supported by the underlying openssl.<\/p>\n my $rv = Net::SSLeay::TLSv1_2_method();
#
# returns: value corresponding to openssl’s SSL_METHOD structure (0 on failure)<\/p>\n Check openssl doc <\/p>\n\n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n TLS_method, TLS_server_method and TLS_client_method<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n COMPATIBILITY:<\/small><\/b> Not available in Net\u2212SSLeay\u22121.82 and before.<\/p>\n Returns SSL_METHOD<\/small> structure corresponding to general-purpose version-flexible TLS<\/small> method, the return value can be later used as a param of “CTX_new_with_method”. Only available where supported by the underlying openssl.<\/p>\n my $rv = Net::SSLeay::TLS_method();
#
# returns: value corresponding to openssl’s SSL_METHOD structure (0 on failure)<\/p>\n Check openssl doc <\/p>\nLow level API:<\/small> ENGINE_* related functions<\/i><\/p>\n\n\n| <\/td>\n | \n \u2022<\/p>\n<\/td>\n | <\/td>\n | \n ENGINE_load_builtin_engines<\/p>\n<\/td>\n | <\/td>\n<\/tr>\n<\/table>\n | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |