TLS and mTLS

TLS And mTLS

Wirecat uses OpenSSL for TLS client and server support.

TLS Client

Connect with TLS:

wcat connect --tls example.com 443

TLS peer verification is enabled by default for clients. Use --sni when the certificate hostname should be checked against a specific name:

wcat connect --tls --sni service.example service.example 443

Use a private CA bundle:

wcat connect --tls --ca-file ./ca.pem --sni service.example service.example 443

TLS Client Certificates

Present a client certificate:

wcat connect --tls --ca-file ./ca.pem --sni service.example --client-cert client.crt --client-key client.key service.example 443

TLS Server

Listen with TLS:

wcat listen --tls --cert server.crt --key server.key 0.0.0.0 8443

Require client certificates:

wcat listen --tls --require-client-cert --ca-file ./clients-ca.pem --cert server.crt --key server.key 0.0.0.0 8443

Insecure Mode

--tls-insecure disables peer verification. Use it only for local testing, throwaway labs, or controlled private environments.

wcat connect --tls --tls-insecure 127.0.0.1 8443

Do not use --tls-insecure for production trust decisions.

ALPN

Set an ALPN value for TLS or QUIC:

wcat connect --tls --alpn wcat/1 service.example 443

The default ALPN is wcat/1.