# TinyGsmSSL.tpp (file) **Module:** **[src](dir_68267d1309a1af8e8297ef4c3efbcdba.html)** **/** **[TinyGsmSSL.tpp](_tiny_gsm_s_s_l_8tpp.html)** TLS/SSL connection helper mixin for secure clients. **Author** Volodymyr Shymanskyy **License** LGPL-3.0 **Copyright** Copyright (c) 2016 Volodymyr Shymanskyy **Date** Nov 2016 ## Classes | | Name | | --- | --- | | struct | **TinyGsmSslConfigPreset** | | class | **TinyGsmSSL** | | class | **GsmSecureContext** | | class | **GsmSecureClient** | ## Types | | Name | | --- | --- | | enum class int8_t | [CertificateType](#a6e82b467d34d0e9d9706525ace1db58a) { CA_CERTIFICATE = 0, CLIENT_CERTIFICATE = 1, CLIENT_KEY = 2, CLIENT_PSK = 3, CLIENT_PSK_IDENTITY = 4, UNKNOWN = -1 }
Enum for different types of SSL/TLS certificates. | | enum class int8_t | [SSLAuthMode](#ae4aaaef78c1c56ea03b96c5d9fbc7de6) { NO_VALIDATION = 0, CLIENT_VALIDATION = 1, CA_VALIDATION = 2, MUTUAL_AUTHENTICATION = 3, PRE_SHARED_KEYS = 4 }
Enum for different SSL/TLS authentication modes (auth_mode). | | enum class int8_t | [SSLVersion](#a4cec5319261492fb0afbc8c3aded7055) { NO_SSL = -1, SSL3_0 = 0, TLS1_0 = 1, TLS1_1 = 2, TLS1_2 = 3, ALL_SSL = 4, TLS1_3 = 5 }
Enum for different SSL/TLS versions. | ## Defines | | Name | | --- | --- | | | **[TINY_GSM_MODEM_CAN_SPECIFY_CERTS](#ad3d91380e642a96af1f95a4580f4abbd)**
flag to indicate that the modem can specify certificates for SSL connections | | | **[TINY_GSM_MODEM_CAN_LOAD_CERTS](#aac0fce881342482cf800e2f6a5bef80f)**
flag to indicate that the modem can load certificates for SSL connections | | | **[TINY_GSM_CERT_NAME_LENGTH](#a41943b3703fca063cbe79f5b66b0e6b0)**
The maximum length of a certificate file name - 32 characters plus a null terminator. | | | **[TINY_GSM_PSK_IDENTITY_LENGTH](#a2d5fd77c95a0d2bef09d07517a9be413)**
The maximum length of the pre-shared key (PSK) identity (identifier/hint) - 32 characters plus a null terminator. | | | **[TINY_GSM_PSK_LENGTH](#ae6d84603af7b7b9268401e39e28c2f8d)**
The maximum length of the pre-shared key (PSK) - 32 characters plus a null terminator. | | | **[TINY_GSM_DEFAULT_SSL_CTX](#a10d35708942586581bbce94e1838039f)**
The default SSL context to use for SSL connections. | ### CertificateType ​ | Enumerator | Value | Description | | --- | --- | --- | | ​CA_CERTIFICATE | 0 | The CA certificate is used to verify the server's certificate. This is the most common type of certificate used in SSL connections. | | ​CLIENT_CERTIFICATE | 1 | The client certificate is used to authenticate the client to the server. This is less common and is typically used in mutual authentication scenarios. | | ​CLIENT_KEY | 2 | The client key is used in conjunction with the client certificate for mutual authentication. It is a private key that should be kept secure and not shared. | | ​CLIENT_PSK | 3 | The client pre-shared key is used for authentication in TLS-PSK connections. It is a secret key shared between the client and the server. | | ​CLIENT_PSK_IDENTITY | 4 | The client pre-shared key identity is used in conjunction with the client PSK for authentication in TLS-PSK connections. | | ​UNKNOWN | -1 | The UNKNOWN type is used to indicate that the certificate type is not recognized or is not specified. It is a placeholder for error handling or default cases. | ### SSLAuthMode ​ | Enumerator | Value | Description | | --- | --- | --- | | ​NO_VALIDATION | 0 | 0: no validation
- SRGD Note: Very insecure! You do not need to load any certificates onto your device for this. Not all servers will accept it. | | ​CLIENT_VALIDATION | 1 | 1: the client provides the client certificate for the server to verify.
- SRGD Note: I do not believe this is commonly used. To use this, you must load a client certificate and a client key onto your device. | | ​CA_VALIDATION | 2 | 2: the client loads CA certificate to verify the server’s certificate.
- SRGD Note: This is a common authentication type used by browsers, where the browser verifies the server's certificate. For this to work, you must load either the server's intermediate or parent CA certificate onto your device. | | ​MUTUAL_AUTHENTICATION | 3 | 3: mutual authentication.
- SRGD Note: This is used by AWS IoT Core and other IoT services. In this case you must load 3 certs to your device: The server's CA cert, the client cert, and the client key. | | ​PRE_SHARED_KEYS | 4 | 4: pre-shared key encryption | ### SSLVersion ​ | Enumerator | Value | Description | | --- | --- | --- | | ​NO_SSL | -1 | No SSL/TLS, plain TCP connection. | | ​SSL3_0 | 0 | SSL 3.0. | | ​TLS1_0 | 1 | TLS 1.0. | | ​TLS1_1 | 2 | TLS 1.1. | | ​TLS1_2 | 3 | TLS 1.2. | | ​ALL_SSL | 4 | Try all SSL/TLS versions, the modem will negotiate the best version. | | ​TLS1_3 | 5 | TLS 1.3. | ## Macros Documentation ### TINY_GSM_MODEM_CAN_SPECIFY_CERTS ​ ```cpp #define TINY_GSM_MODEM_CAN_SPECIFY_CERTS ``` ### TINY_GSM_MODEM_CAN_LOAD_CERTS ​ ```cpp #define TINY_GSM_MODEM_CAN_LOAD_CERTS ``` ### TINY_GSM_CERT_NAME_LENGTH ​ ```cpp #define TINY_GSM_CERT_NAME_LENGTH 33 ``` This is the maximum length of a certificate file name used to refer to the certificate in the modems flash memory, not the certificate itself. The file name length limit varies by modem; some list a limit of 64 characters others don't list one. Increase this value if you want to use longer file names. ### TINY_GSM_PSK_IDENTITY_LENGTH ​ ```cpp #define TINY_GSM_PSK_IDENTITY_LENGTH 33 ``` This is the maximum length of the identity value itself, not a reference or file name. There is not a standard for the maximum length of a PSK identity, but 32 characters is a common limit. The null terminator is added to the end of the string to indicate the end of the string. Increase this value if you need a longer hint value ### TINY_GSM_PSK_LENGTH ​ ```cpp #define TINY_GSM_PSK_LENGTH 33 ``` This is the maximum length of the key itself, not a reference or file name. 32 characters is a common limit for the length of a PSK, though 64-255 characters can be used in IPsec PSK (Palo Alto). Increase this value if you need to use a longer key. ### TINY_GSM_DEFAULT_SSL_CTX ​ ```cpp #define TINY_GSM_DEFAULT_SSL_CTX 0 ``` This applies to **all** modems using the [GsmSecureClient](class_gsm_secure_client.md) class. The SSL context is a collection of SSL settings, not the connection identifier. This library uses SSL context 0 by default. At this time, all modems that support SSL via contexts show using context 0 in their documentation. If you find a modem that uses a different context, please let us know and we will add it to the list of modems that use a different default context. --- Generated by [Doxygen](https://www.doxygen.nl) and [m.css](https://mcss.mosra.cz/) with templates from [doxybook2](https://github.com/matusnovak/doxybook2)