<divclass="title"><aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a></div></div>
<p><b><aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a> requires at least 110kb flash and 7kb RAM, and will not compile otherwise. This means that most Arduino boards are not supported. Check your board's specifications before attempting to use this library.</b></p>
<p><aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a> is a simple library to add <ahref="https://www.websecurity.symantec.com/security-topics/what-is-ssl-tls-https">TLS 1.2</a> functionality to any network library implementing the <ahref="https://www.arduino.cc/en/Reference/ClientConstructor">Arduino Client interface</a>, including the Arduino <ahref="https://www.arduino.cc/en/Reference/EthernetClient">EthernetClient</a> and <ahref="https://www.arduino.cc/en/Reference/WiFiClient">WiFiClient</a> classes (though it is better to prefer WiFClient.connectSSL if implemented). In other words, <aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a> implements encrypted communication through SSL on devices that do not otherwise support it.</p>
<p><aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a> has been tested on the SAMD21, ESP32, and STM32 (in progress). SSClient does not currently support the ESP8266 (see <ahref="https://github.com/OPEnSLab-OSU/SSLClient/issues/5#issuecomment-569968546">this issue</a>).</p>
<p>Using <aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a> should be similar to using any other Arduino-based Client class, since this library was developed around compatibility with <ahref="https://www.arduino.cc/en/Reference/EthernetClient">EthernetClient</a>. There are a few extra things, however, that you will need to get started:</p>
<li>A board with a lot of resources (>110kb flash and >7kb RAM), and a network peripheral with a large internal buffer (>7kb). This library was tested with the <ahref="https://www.adafruit.com/product/2772">Adafruit Feather M0</a> (256K flash, 32K RAM) and the <ahref="https://www.adafruit.com/product/3201">Adafruit Ethernet Featherwing</a> (16kb Buffer), and we still had to modify the Arduino Ethernet library to support larger internal buffers per socket (see the <ahref="#sslclient-with-ethernet">Implementation Gotchas</a>).</li>
<li>A header containing array of trust anchors, which will look like <ahref="./readme/cert.h">this file</a>. These are used to verify the SSL connection later on, and without them you will be unable to use this library. Check out <aclass="el"href="_trust_anchors_8md.html">this document</a> on how to generate this file for your project, and for more information about what a trust anchor is.</li>
<li>A Client class associated with a network interface. We tested this library using <ahref="https://www.arduino.cc/en/Reference/EthernetClient">EthernetClient</a>, however in theory it will work for any class implementing Client.</li>
<li>An analog pin, used for generating random data at the start of the connection (see the <ahref="#implementation-gotchas">Implementation Gotchas</a>).</li>
<p>Once all those are ready, you can create a simple <aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a> object like this: </p><divclass="fragment"><divclass="line"> {C++}</div><divclass="line">BaseClientType baseClientInstance;</div><divclass="line">SSLClient client(baseClientInstance, TAs, (size_t)TAs_NUM, AnalogPin);</div></div><!-- fragment --><p> Where:</p><ul>
<li>BaseClientType - The type of baseClientInstance</li>
<li>BaseClientInstance - An instance of the class you are using for <aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a> (the class associated with the network interface, from step 3). It is important that this instance be stored <em>outside</em> the <aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a> declaration (for instance, <code><aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient(BaseClientType() ...)</a></code> wouldn't work).</li>
<li>TAs - The name of the trust anchor array created in step 2. If you generated a header using the tutorial this will probably be <code>TAs</code>.</li>
<li>TAs_NUM - The number of trust anchors in TAs. If you generated a header using the tutorial this will probably be <code>TAs_NUM</code>.</li>
<li><pclass="startli">AnalogPin - The analog pin to pull random data from (step 4).</p>
<pclass="startli">For example, if I am using EthernetClient, a generated array of 2 trust anchors, and the analog pin A7, I would declare an <aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a> instance using: </p><divclass="fragment"><divclass="line"> {C++}</div><divclass="line">EthernetClient baseClient;</div><divclass="line">SSLClient client(baseClient, TAs, 2, A7);</div></div><!-- fragment --><p> Once that is setup, simply use <aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a> as you would the base client class: </p><divclass="fragment"><divclass="line"> {C++}</div><divclass="line">// connect to ardiuino.cc over ssl (port 443 for websites)</div><divclass="line">client.connect("www.arduino.cc", 443);</div><divclass="line">// Make a HTTP request</div><divclass="line">client.println("GET /asciilogo.txt HTTP/1.1");</div><divclass="line">client.println("User-Agent: AdafruitFeatherM0WiFi");</div><divclass="line">client.print("Host: ");</div><divclass="line">client.println(server);</div><divclass="line">client.println("Connection: close");</div><divclass="line">client.println();</div><divclass="line">client.flush();</div><divclass="line">// read and print the data</div><divclass="line">...</div></div><!-- fragment --><p><b>Note</b>: <code>client.connect("www.arduino.cc", 443)</code> can take 5-15 seconds to finish. This an unavoidable consequence of the SSL protocol, and is detailed in <ahref="#resources">Implementation Notes</a>.</p>
<p>For more information on <aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a>, check out the <ahref="./examples">examples</a>, <ahref="https://openslab-osu.github.io/SSLClient/html/index.html">API documentation</a>, or the rest of this README.</p>
<p><aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a> was created to integrate SSL seamlessly with the Arduino infrastructure, and so it does just that: implementing the brilliant <ahref="https://bearssl.org/">BearSSL</a> as a proxy in front of any Arduino socket library. BearSSL is designed with low flash footprint in mind, and as a result does little verification of improper programming, relying on the developer to ensure the code is correct. Since <aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a> is built specifically for the Arduino ecosystem, most of <aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a>'s code adds those programming checks back in, making debugging a fast and simple process.</p>
<p><aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a> also allows for changing the debugging level by adding an additional parameter to the constructor: </p><divclass="fragment"><divclass="line"> {C++}</div><divclass="line">EthernetClient baseClient;</div><divclass="line">SSLClient client(baseClient, TAs, (size_t)2, A7, 1, SSLClient::SSL_INFO);</div></div><!-- fragment --><p> Logging is always outputted through the <ahref="https://www.arduino.cc/reference/en/language/functions/communication/serial/">Arduino Serial interface</a>, so you'll need to setup Serial before you can view the SSL logs. Log levels are enumerated in ::DebugLevel. The log level is set to <code>SSL_WARN</code> by default.</p>
<p>When <aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a> encounters an error, it will attempt to terminate the SSL session gracefully if possible, and then close the socket. Simple error information can be found from SSLClient::getWriteError(), which will return a value from the ::Error enum. For more detailed diagnostics, you can look at the serial logs, which will be displayed if the log level is at <code>SSL_ERROR</code> or lower.</p>
<p>As you may have noticed in the documentation for <aclass="el"href="class_s_s_l_client.html#a03c7926938acd57cfc3b982edf725a86"title="Write some bytes to the SSL connection.">SSLClient::write</a>, calling this function does not actually write to the network. Instead, you must call <aclass="el"href="class_s_s_l_client.html#a0e775669b4a040fbd3f281dcbcd2de78"title="Returns the number of bytes available to read from the data that has been received and decrypted.">SSLClient::available</a> or <aclass="el"href="class_s_s_l_client.html#aaf2192a6621fdf2f89cc26a9a1584f8c"title="Force writing the buffered bytes from SSLClient::write to the network.">SSLClient::flush</a>, which will detect that the buffer is ready and write to the network (see <aclass="el"href="class_s_s_l_client.html#a03c7926938acd57cfc3b982edf725a86"title="Write some bytes to the SSL connection.">SSLClient::write</a> for details).</p>
<p>This was implemented as a buffered function because examples in Arduino libraries will often write to the network like so: </p><divclass="fragment"><divclass="line"> {C++}</div><divclass="line">EthernetClient client;</div><divclass="line">// ...</div><divclass="line">// connect to ardiuino.cc over ssl (port 443 for websites)</div><divclass="line">client.connect("www.arduino.cc", 443);</div><divclass="line">// ...</div><divclass="line">// write an http request to the network</div><divclass="line">client.write("GET /asciilogo.txt HTTP/1.1\r\n");</div><divclass="line">client.write("Host: arduino.cc\r\n");</div><divclass="line">client.write("Connection: close\r\n");</div><divclass="line">// wait for response</div><divclass="line">while (!client.available()) { /* ... */ }</div><divclass="line">// ...</div></div><!-- fragment --><p> Notice that every single write() call immediately writes to the network, which is fine with most network clients. With SSL, however, if we are encrypting and writing to the network every write() call, this will result in a lot of small encryption tasks. Encryption takes a lot of time and code, so to reduce the overhead of an SSL connection, <aclass="el"href="class_s_s_l_client.html#a03c7926938acd57cfc3b982edf725a86"title="Write some bytes to the SSL connection.">SSLClient::write</a> implicitly buffers until the developer states that they are waiting for data to be received with <aclass="el"href="class_s_s_l_client.html#a0e775669b4a040fbd3f281dcbcd2de78"title="Returns the number of bytes available to read from the data that has been received and decrypted.">SSLClient::available</a>. A simple example can be found below:</p>
<divclass="fragment"><divclass="line"> {C++}</div><divclass="line">EthernetClient baseClient;</div><divclass="line">SSLClient client(baseClient, TAs, (size_t)2, A7);</div><divclass="line">// ...</div><divclass="line">// connect to ardiuino.cc over ssl (port 443 for websites)</div><divclass="line">client.connect("www.arduino.cc", 443);</div><divclass="line">// ...</div><divclass="line">// add http request to the buffer</div><divclass="line">client.write("GET /asciilogo.txt HTTP/1.1\r\n");</div><divclass="line">client.write("Host: arduino.cc\r\n");</div><divclass="line">client.write("Connection: close\r\n");</div><divclass="line">// write the bytes to the network, then wait for response</div><divclass="line">while (!client.available()) { /* ... */ }</div><divclass="line">// ...</div></div><!-- fragment --><p>If you would like to trigger a network write manually without using the <aclass="el"href="class_s_s_l_client.html#a0e775669b4a040fbd3f281dcbcd2de78"title="Returns the number of bytes available to read from the data that has been received and decrypted.">SSLClient::available</a>, you can also call <aclass="el"href="class_s_s_l_client.html#aaf2192a6621fdf2f89cc26a9a1584f8c"title="Force writing the buffered bytes from SSLClient::write to the network.">SSLClient::flush</a>, which will write all data and return when finished.</p>
<p>As detailed in the <ahref="#resources">resources section</a>, SSL handshakes take an extended period (1-4sec) to negotiate. To remedy this problem, BearSSL is able to keep a <ahref="https://bearssl.org/api1.html#session-cache">SSL session cache</a> of the clients it has connected to. If BearSSL successfully resumes an SSL session, it can reduce connection time to 100-500ms.</p>
<p>In order to use SSL session resumption:</p><ul>
<li>The website you are connecting to must support it. Support is widespread, but you can verify easily using the <ahref="https://www.ssllabs.com/ssltest/">SSLLabs tool</a>.</li>
<li>You must reuse the same <aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a> object (SSL Sessions are stored in the object itself).</li>
<li>You must reconnect to the exact same server.</li>
<p><aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a> automatically stores an IP address and hostname in each session, ensuring that if you call <code>connect("www.google.com")</code><aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a> will use the SSL session with that hostname. However, because some websites have multiple servers on a single IP address (github.com being an example), you may find that even if you are connecting to the same host the connection does not resume. This is a flaw in the SSL session protocol — though it has been resolved in TLS 1.3, the lack of widespread adoption of the new protocol prevents it from being used here. SSL sessions can also expire based on server criteria, which will result in a standard 4-10 second connection.</p>
<p>You can test whether or not a website can resume SSL Sessions using the <ahref="./examples/Session_Example/Session_Example.ino">Session Example</a> included with this library. Because of all the confounding factors of SSL Sessions, it is generally prudent while programming to assume the session will always fail to resume.</p>
<p>SSL sessions take a lot of memory to store, so by default <aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a> will only store one at a time. You can change this behavior by adding the following to your <aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a> declaration: </p><divclass="fragment"><divclass="line"> {C++}</div><divclass="line">EthernetClient baseClient;</div><divclass="line">SSLClient client(baseClient, TAs, (size_t)2, A7, SomeNumber);</div></div><!-- fragment --><p> Where <code>SomeNumber</code> is the number of sessions you would like to store. For example this declaration can store 3 sessions: </p><divclass="fragment"><divclass="line"> {C++}</div><divclass="line">EthernetClient baseClient;</div><divclass="line">SSLClient client(baseClient, TAs, (size_t)2, A7, 3);</div></div><!-- fragment --><p> Sessions are managed internally using the SSLSession::getSession function. This function will cycle through sessions in a rotating order, allowing the session cache to continually overwrite old sessions. In general, it is a good idea to use a SessionCache size equal to the number of domains you plan on connecting to.</p>
<p>If you are using the <ahref="https://github.com/arduino-libraries/Ethernet">Arduino Ethernet library</a>, you will need to modify the library to support the large buffer sizes required by SSL (detailed in <ahref="#resources">resources</a>). You can either modify the library yourself, or use <ahref="https://github.com/OPEnSLab-OSU/EthernetLarge">this fork of the Ethernet library with the modification</a>. To use the fork, simply install the library using the "add a .zip library" button in Arduino, and replace <code>#include "Ethernet.h"</code> with <code>#include "EthernetLarge.h"</code> in your sketch. Alternatively if for some reason this solution does not work, you can apply the modification using the instructions below.</p>
<h4>Manual Modification</h4>
<p>First find the location of the library in the directory where Arduino is installed (<code>C:\Program Files (x86)\Arduino</code> on Windows). Inside of this directory, navigate to <code>libraries\Ethernet\src</code> (<code>C:\Program Files (x86)\Arduino\libraries\Ethernet\src</code> on Windows). Modify <code>Ethernet.h</code> to replace these lines: </p><divclass="fragment"><divclass="line"> {C++}</div><divclass="line">...</div><divclass="line">// Configure the maximum number of sockets to support. W5100 chips can have</div><divclass="line">// up to 4 sockets. W5200 & W5500 can have up to 8 sockets. Several bytes</div><divclass="line">// of RAM are used for each socket. Reducing the maximum can save RAM, but</div><divclass="line">// you are limited to fewer simultaneous connections.</div><divclass="line">#if defined(RAMEND) && defined(RAMSTART) && ((RAMEND - RAMSTART) <= 2048)</div><divclass="line">#define MAX_SOCK_NUM 4</div><divclass="line">#else</div><divclass="line">#define MAX_SOCK_NUM 8</div><divclass="line">#endif</div><divclass="line"></div><divclass="line">// By default, each socket uses 2K buffers inside the Wiznet chip. If</div><divclass="line">// MAX_SOCK_NUM is set to fewer than the chip's maximum, uncommenting</div><divclass="line">// this will use larger buffers within the Wiznet chip. Large buffers</div><divclass="line">// can really help with UDP protocols like Artnet. In theory larger</div><divclass="line">// buffers should allow faster TCP over high-latency links, but this</div><divclass="line">// does not always seem to work in practice (maybe Wiznet bugs?)</div><divclass="line">//#define ETHERNET_LARGE_BUFFERS</div><divclass="line">...</div></div><!-- fragment --><p> With this: </p><divclass="fragment"><divclass="line"> {C++}</div><divclass="line">...</div><divclass="line">// Configure the maximum number of sockets to support. W5100 chips can have</div><divclass="line">// up to 4 sockets. W5200 & W5500 can have up to 8 sockets. Several bytes</div><divclass="line">// of RAM are used for each socket. Reducing the maximum can save RAM, but</div><divclass="line">// you are limited to fewer simultaneous connections.</div><divclass="line">#define MAX_SOCK_NUM 2</div><divclass="line"></div><divclass="line">// By default, each socket uses 2K buffers inside the Wiznet chip. If</div><divclass="line">// MAX_SOCK_NUM is set to fewer than the chip's maximum, uncommenting</div><divclass="line">// this will use larger buffers within the Wiznet chip. Large buffers</div><divclass="line">// can really help with UDP protocols like Artnet. In theory larger</div><divclass="line">// buffers should allow faster TCP over high-latency links, but this</div><divclass="line">// does not always seem to work in practice (maybe Wiznet bugs?)</div><divclass="line">#define ETHERNET_LARGE_BUFFERS</div><divclass="line">...</div></div><!-- fragment --><p> You may need to use <code>sudo</code> or administrator permissions to make this modification. We change <code>MAX_SOCK_NUM</code> and <code>ETHERNET_LARGE_BUFFERS</code> so the Ethernet hardware can allocate a larger space for <aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a>, however a downside of this modification is we are now only able to have two sockets concurrently. As most microprocessors barely have enough memory for one SSL connection, this limitation will rarely be encountered in practice.</p>
<p>The SSL protocol requires that <aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a> generate some random bits before connecting with a server. BearSSL provides a random number generator but requires a <ahref="https://bearssl.org/apidoc/bearssl__ssl_8h.html#a7d8e8de2afd49d6794eae02f56f81152">some entropy for a seed</a>. Normally this seed is generated by taking the microsecond time using the internal clock, however since most microcontrollers are not build with this feature another source must be found. As a simple solution, <aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a> uses a floating analog pin as an external source of random data, passed through to the constructor in the <code>analog_pin</code> argument. Before every connection, <aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a> will take the bottom byte from 16 analog reads on <code>analog_pin</code>, and combine these bytes into a 16 byte random number, which is used as a seed for BearSSL. To ensure the most random data, it is recommended that this analog pin be either floating or connected to a location not modifiable by the microcontroller (i.e. a battery voltage readout).</p>
<p><aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a> uses BearSSL's <ahref="https://bearssl.org/x509.html#the-minimal-engine">minimal x509 verification engine</a> to verify the certificate of an SSL connection. This engine requires the developer create a trust anchor array using values stored in trusted root certificates. Check out <aclass="el"href="_trust_anchors_8md.html">this document</a> for more details on this component of <aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a>.</p>
<p>BearSSL also features a <ahref="https://bearssl.org/x509.html#the-known-key-engine">known certificate validation engine</a>, which only allows for a single domain in exchange for a significantly reduced resource usage (flash and CPU time). This functionality is planned to be implemented in the future.</p>
<h3>Resources</h3>
<p>The SSL protocol recommends a device support many different encryption algorithms, as well as protocols for SSL itself. The complexity of both of those components results in many medium sized components forming an extremely large whole. Additionally, most embedded processors lack the sophisticated math hardware commonly found in a modern CPU, and as a result require more instructions to create the encryption algorithms SSL requires. This not only increases size but makes the algorithms slow and memory intensive.</p>
<p>To illustrate this, I will run some tests on various domains below. I haven't yet, but I will.</p>
<p>If flash footprint is becoming a problem, there are numerous debugging strings (~3kb estimated) that can be removed from <code><aclass="el"href="_s_s_l_client_8h.html">SSLClient.h</a></code>, <code>SSLClientImpl.h</code>, and <code>SSLClientImpl.cpp</code>. I have not figured out a way to configure compilation of these strings, so you will need to modify the library to remove them yourself.</p>
<p>SSL is a buffered protocol, and since most microcontrollers have limited resources (see <ahref="#resources">Resources</a>), <aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a> is limited in the size of its buffers. A common problem I encountered with SSL connections is buffer overflow, caused by the server sending too much data at once. This problem is caused by the microcontroller being unable to copy and decrypt data faster than it is being received, forcing some data to be discarded. This usually puts BearSSL in an unrecoverable state, forcing <aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a> to close the connection with a write error. If you are experiencing frequent timeout problems, this could be the reason why.</p>
<p>In order to remedy this problem, the device must be able to read the data faster than it is being received, or alternatively have a cache large enough to store the entire payload. Since SSL's encryption forces the device to read slowly, this means we must increase the cache size. Depending on your platform, there are a number of ways this can be done:</p><ul>
<li>Sometimes your communication shield will have an internal buffer, which can be expanded through the driver code. This is the case with the Arduino Ethernet library (in the form of the MAX_SOCK_NUM and ETHERNET_LARGE_BUFFERS macros), however the library must be modified for the change to take effect.</li>
<li><aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a> has an internal buffer SSLClientImpl::m_iobuf, which can be expanded. BearSSL limits the amount of data that can be processed based on the stage in the SSL handshake, and so this will change will have limited usefulness.</li>
<li>In some cases, a website will send so much data that even with the above solutions, <aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a> will be unable to keep up (a website with a lot of HTML is an example). In these cases you will have to find another method of retrieving the data you need.</li>
<li>If none of the above are viable, it is possible to implement your own Client class which has an internal buffer much larger than both the driver and BearSSL. This would require in-depth knowledge of programming and the communication shield you are working with, as well as a microcontroller with a significant amount of RAM.</li>
<p>By default, <aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a> supports only TLS1.2 and the ciphers listed in <ahref="./src/TLS12_only_profile.c">this file</a> under <code>suites[]</code>, and the list is relatively small to keep the connection secure and the flash footprint down. These ciphers should work for most applications, however if for some reason you would like to use an older version of TLS or a different cipher, you can change the BearSSL profile being used by <aclass="el"href="class_s_s_l_client.html"title="The main SSLClient class. Check out README.md for more info.">SSLClient</a> to an <ahref="./src/bearssl/src/ssl/ssl_client_full.c">alternate one with support for older protocols</a>. To do this, edit <code>SSLClientImpl::SSLClientImpl</code> to change these lines: </p><divclass="fragment"><divclass="line"> {C++}</div><divclass="line">br_client_init_TLS12_only(&m_sslctx, &m_x509ctx, m_trust_anchors, m_trust_anchors_num);</div><divclass="line">// comment the above line and uncomment the line below if you're having trouble connecting over SSL</div><divclass="line">// br_ssl_client_init_full(&m_sslctx, &m_x509ctx, m_trust_anchors, m_trust_anchors_num);</div></div><!-- fragment --><p> to this: </p><divclass="fragment"><divclass="line"> {C++}</div><divclass="line">// br_client_init_TLS12_only(&m_sslctx, &m_x509ctx, m_trust_anchors, m_trust_anchors_num);</div><divclass="line">// comment the above line and uncomment the line below if you're having trouble connecting over SSL</div><divclass="line">br_ssl_client_init_full(&m_sslctx, &m_x509ctx, m_trust_anchors, m_trust_anchors_num);</div></div><!-- fragment --><p> If for some unfortunate reason you need SSL 3.0 or SSL 2.0, you will need to modify the BearSSL profile to enable support. Check out the <ahref="https://bearssl.org/api1.html#profiles">BearSSL profiles documentation</a> and I wish you the best of luck. </p>
