To see relevant version information for ssl you can call ssl:versions/0
To see all supported cipher suites call ssl:cipher_suites/0. Note that available cipher suites for a connection will depend on your certificate. It is also possible to specify a specific cipher suite(s) that you want your connection to use. Default is to use the strongest available.
Here follows some small example of how to set up client/server connections
using the erlang shell. The returned value of the sslsocket has been abbreviated with
The minimal setup is not the most secure setup of ssl.
Start server side
1 server> ssl:start().
ok
Create an ssl listen socket
2 server> {ok, ListenSocket} =
ssl:listen(9999, [{certfile, "cert.pem"}, {keyfile, "key.pem"},{reuseaddr, true}]).
{ok,{sslsocket, [...]}}
Do a transport accept on the ssl listen socket
3 server> {ok, Socket} = ssl:transport_accept(ListenSocket).
{ok,{sslsocket, [...]}}
Start client side
1 client> ssl:start().
ok
2 client> {ok, Socket} = ssl:connect("localhost", 9999, [], infinity).
{ok,{sslsocket, [...]}}
Do the ssl handshake
4 server> ok = ssl:ssl_accept(Socket).
ok
Send a messag over ssl
5 server> ssl:send(Socket, "foo").
ok
Flush the shell message queue to see that we got the message sent on the server side
3 client> flush().
Shell got {ssl,{sslsocket,[...]},"foo"}
ok
To upgrade a TCP/IP connection to an ssl connection the client and server have to aggre to do so. Agreement may be accompliced by using a protocol such the one used by HTTP specified in RFC 2817.
Start server side
1 server> ssl:start().
ok
Create a normal tcp listen socket
2 server> {ok, ListenSocket} = gen_tcp:listen(9999, [{reuseaddr, true}]).
{ok, #Port<0.475>}
Accept client connection
3 server> {ok, Socket} = gen_tcp:accept(ListenSocket).
{ok, #Port<0.476>}
Start client side
1 client> ssl:start().
ok
2 client> {ok, Socket} = gen_tcp:connect("localhost", 9999, [], infinity).
Make sure active is set to false before trying to upgrade a connection to an ssl connection, otherwhise ssl handshake messages may be deliverd to the wrong process.
4 server> inet:setopts(Socket, [{active, false}]).
ok
Do the ssl handshake.
5 server> {ok, SSLSocket} = ssl:ssl_accept(Socket, [{cacertfile, "cacerts.pem"},
{certfile, "cert.pem"}, {keyfile, "key.pem"}]).
{ok,{sslsocket,[...]}}
Upgrade to an ssl connection. Note that the client and server must agree upon the upgrade and the server must call ssl:accept/2 before the client calls ssl:connect/3.
3 client>{ok, SSLSocket} = ssl:connect(Socket, [{cacertfile, "cacerts.pem"},
{certfile, "cert.pem"}, {keyfile, "key.pem"}], infinity).
{ok,{sslsocket,[...]}}
Send a messag over ssl
4 client> ssl:send(SSLSocket, "foo").
ok
Set active true on the ssl socket
4 server> ssl:setopts(SSLSocket, [{active, true}]).
ok
Flush the shell message queue to see that we got the message sent on the client side
5 server> flush().
Shell got {ssl,{sslsocket,[...]},"foo"}
ok