class OpenSSL::SSL::Context::Server
Defined in:
openssl/ssl/context.crConstructors
-
.from_hash(params) : self
Configures a server from a hash-like interface.
-
.insecure(method : LibSSL::SSLMethod = Context.default_method) : self
Returns a new TLS server context with only the given method set.
-
.new(method : LibSSL::SSLMethod = Context.default_method)
Generates a new TLS server context with sane defaults for a server connection.
Instance methods inherited from class OpenSSL::SSL::Context
add_modes(mode : OpenSSL::SSL::Modes)
add_modes,
add_options(options : OpenSSL::SSL::Options)
add_options,
add_x509_verify_flags(flags : OpenSSL::X509VerifyFlags)
add_x509_verify_flags,
alpn_protocol=(protocol : String)
alpn_protocol=,
ca_certificates=(file_path : String)
ca_certificates=,
ca_certificates_path=(dir_path : String)
ca_certificates_path=,
certificate_chain=(file_path : String)
certificate_chain=,
ciphers=(ciphers : String)
ciphers=,
default_verify_param=(name : String)
default_verify_param=,
finalize
finalize,
modes
modes,
options
options,
private_key=(file_path : String)
private_key=,
remove_modes(mode : OpenSSL::SSL::Modes)
remove_modes,
remove_options(options : OpenSSL::SSL::Options)
remove_options,
set_default_verify_paths
set_default_verify_paths,
set_tmp_ecdh_key(curve = LibCrypto::NID_X9_62_prime256v1)
set_tmp_ecdh_key,
to_unsafe : LibSSL::SSLContext
to_unsafe,
verify_mode
verify_mode,
verify_mode=(mode : OpenSSL::SSL::VerifyMode)
verify_mode=
Constructor methods inherited from class OpenSSL::SSL::Context
new(method : LibSSL::SSLMethod)
new
Instance methods inherited from class Reference
==(other : self)==(other : JSON::Any)
==(other : YAML::Any)
==(other) ==, dup dup, hash(hasher) hash, inspect(io : IO) : Nil inspect, object_id : UInt64 object_id, pretty_print(pp) : Nil pretty_print, same?(other : Reference)
same?(other : Nil) same?, to_s(io : IO) : Nil to_s
Constructor methods inherited from class Reference
new
new
Instance methods inherited from class Object
!=(other)
!=,
!~(other)
!~,
==(other)
==,
===(other : JSON::Any)===(other : YAML::Any)
===(other) ===, =~(other) =~, class class, dup dup, hash(hasher)
hash hash, inspect(io : IO)
inspect inspect, itself itself, not_nil! not_nil!, pretty_inspect(width = 79, newline = "\n", indent = 0) : String pretty_inspect, pretty_print(pp : PrettyPrint) : Nil pretty_print, tap(&block) tap, to_json(io : IO)
to_json to_json, to_pretty_json(indent : String = " ")
to_pretty_json(io : IO, indent : String = " ") to_pretty_json, to_s
to_s(io : IO) to_s, to_yaml(io : IO)
to_yaml to_yaml, try(&block) try, unsafe_as(type : T.class) forall T unsafe_as
Constructor methods inherited from class Object
from_json(string_or_io, root : String) : selffrom_json(string_or_io) : self from_json, from_yaml(string_or_io : String | IO) : self from_yaml
Constructor Detail
Configures a server from a hash-like interface.
require "openssl"
context = OpenSSL::SSL::Context::Client.from_hash({"key" => "private.key", "cert" => "certificate.crt", "ca" => "ca.pem"})
Params:
key
(required): Path to private key file. See#private_key=
.cert
(required): Path to the file containing the public certificate chain. See#certificate_chain=
.verify_mode
: Eitherpeer
,force-peer
,none
or empty (default:none
). Seeverify_mode=
.ca
: Path to a file containing the CA certificate chain or a directory containing all CA certificates. See#ca_certificates=
and#ca_certificates_path=
, respectively. Required ifverify_mode
ispeer
orforce-peer
.
Returns a new TLS server context with only the given method set.
For everything else this uses the defaults of your OpenSSL.
Use this only if undoing the defaults that new
sets is too much hassle.
Generates a new TLS server context with sane defaults for a server connection.
Defaults to TLS_method
or SSLv23_method
(depending on OpenSSL version)
which tells OpenSSL to negotiate the TLS or SSL protocol with the remote
endpoint.
Don't change the method unless you must restrict a specific protocol to be used (eg: TLSv1.2) and nothing else. You should specify options to disable specific protocols, yet allow to negotiate from various other ones. For example the following snippet will enable the TLSv1, TLSv1.1 and TLSv1.2 protocols but disable the deprecated SSLv2 and SSLv3 protocols:
context = OpenSSL::SSL::Context::Server.new
context.add_options(OpenSSL::SSL::Options::NO_SSL_V2 | OpenSSL::SSL::Options::NO_SSL_V3)