The tls family of functions establishes a secure communications channel using the TLS socket protocol. Both clients and servers are supported.

The () function initializes global data structures. It is no longer necessary to call this function directly, since it is invoked internally when needed. It may be called more than once, and may be called concurrently.

Before a connection is created, a configuration must be created. The () function allocates, initializes, and returns a new default configuration object that can be used for future connections. Several functions exist to change the options of the configuration; see tls_config_set_protocols(3), tls_load_file(3), tls_config_ocsp_require_stapling(3), and tls_config_verify(3).

The () function may be used to retrieve a string containing more information about the most recent error relating to a configuration.

A TLS connection object is created by tls_client(3) or tls_server(3) and configured with tls_configure(3).

A client connection is initiated after configuration by calling tls_connect(3). A server can accept a new client connection by calling tls_accept_socket(3) on an already established socket connection.

Two functions are provided for input and output, tls_read(3) and tls_write(3). Both automatically perform the tls_handshake(3) when needed.

The properties of established TLS connections can be inspected with the functions described in tls_conn_version(3) and tls_ocsp_process_response(3).

After use, a TLS connection should be closed with tls_close(3) and then freed by calling tls_free(3).