aboutsummaryrefslogtreecommitdiffstats
path: root/lib/ssl/doc/src/old_ssl.xml
blob: 0d2e1afdbd8aa2f460dd7a66a3c18f8150134c28 (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
<?xml version="1.0" encoding="latin1" ?>
<!DOCTYPE erlref SYSTEM "erlref.dtd">

<erlref>
  <header>
    <copyright>
      <year>1999</year><year>2010</year>
      <holder>Ericsson AB. All Rights Reserved.</holder>
    </copyright>
    <legalnotice>
      The contents of this file are subject to the Erlang Public License,
      Version 1.1, (the "License"); you may not use this file except in
      compliance with the License. You should have received a copy of the
      Erlang Public License along with this software. If not, it can be
      retrieved online at http://www.erlang.org/.

      Software distributed under the License is distributed on an "AS IS"
      basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
      the License for the specific language governing rights and limitations
      under the License.

    </legalnotice>

    <title>ssl</title>
    <prepared>Peter H&ouml;gfeldt</prepared>
    <responsible>Peter H&ouml;gfeldt</responsible>
    <docno></docno>
    <approved>Peter H&ouml;gfeldt</approved>
    <checked></checked>
    <date>2003-03-25</date>
    <rev>D</rev>
    <file>old_ssl.xml</file>
  </header>
  <module>old_ssl</module>
  <modulesummary>Interface Functions for Secure Socket Layer</modulesummary>
  <description>
    <p>This module contains interface functions to the Secure Socket Layer.</p>
  </description>

  <section>
    <title>General</title>

    <p>This manual page describes functions that are defined
      in the ssl module and represents the old ssl implementation
      that coexists with the new one until it has been
      totally phased out. </p>

   <p>The old implementation can be
      accessed by providing the option {ssl_imp, old} to the
      ssl:connect and ssl:listen functions.</p>
      
    <p>The reader is advised to also read the <c>ssl(6)</c> manual page
      describing the SSL application.
      </p>
    <warning>
      <p>It is strongly advised to seed the random generator after
        the ssl application has been started (see <c>seed/1</c>
        below), and before any connections are established. Although
        the port program interfacing to the ssl libraries does a
        "random" seeding of its own in order to make everything work
        properly, that seeding is by no means random for the world
        since it has a constant value which is known to everyone
        reading the source code of the port program.</p>
    </warning>
  </section>

  <section>
    <title>Common data types</title>
    <p>The following datatypes are used in the functions below:
      </p>
    <list type="bulleted">
      <item>
        <p><c>options() = [option()]</c></p>
      </item>
      <item>
        <p><c>option() = socketoption() | ssloption()</c></p>
      </item>
      <item>
        <p><c>socketoption() = {mode, list} | {mode, binary} |  binary | {packet, packettype()} | {header, integer()} | {nodelay, boolean()} | {active, activetype()} |  {backlog, integer()} | {ip, ipaddress()} | {port, integer()}</c></p>
      </item>
      <item>
        <p><c>ssloption() = {verify, code()} | {depth, depth()} |  {certfile, path()} | {keyfile, path()} | {password, string()} | {cacertfile, path()} | {ciphers, string()}</c></p>
      </item>
      <item>
        <p><c>packettype()</c>  (see inet(3))</p>
      </item>
      <item>
        <p><c>activetype()</c>  (see inet(3))</p>
      </item>
      <item>
        <p><c>reason() = atom() | {atom(), string()}</c></p>
      </item>
      <item>
        <p><c>bytes() = [byte()]</c></p>
      </item>
      <item>
        <p><c>string() = [byte()]</c></p>
      </item>
      <item>
        <p><c>byte() = 0 | 1 | 2 | ... | 255</c></p>
      </item>
      <item>
        <p><c>code() = 0 | 1 | 2</c></p>
      </item>
      <item>
        <p><c>depth() = byte()</c></p>
      </item>
      <item>
        <p><c>address() = hostname() | ipstring() | ipaddress()</c></p>
      </item>
      <item>
        <p><c>ipaddress() = ipstring() | iptuple()</c></p>
      </item>
      <item>
        <p><c>hostname() = string()</c></p>
      </item>
      <item>
        <p><c>ipstring() = string()</c></p>
      </item>
      <item>
        <p><c>iptuple() = {byte(), byte(), byte(), byte()}</c></p>
      </item>
      <item>
        <p><c>sslsocket()</c></p>
      </item>
      <item>
        <p><c>protocol() = sslv2 | sslv3 | tlsv1</c></p>
      </item>
      <item>
        <p><c></c></p>
      </item>
    </list>
    <p>The socket option <c>{backlog, integer()}</c> is for
      <c>listen/2</c> only, and the option <c>{port, integer()}</c>
      is for <c>connect/3/4</c> only. 
      </p>
    <p>The following socket options are set by default: <c>{mode, list}</c>, <c>{packet, 0}</c>, <c>{header, 0}</c>, <c>{nodelay, false}</c>, <c>{active, true}</c>, <c>{backlog, 5}</c>,
      <c>{ip, {0,0,0,0}}</c>, and <c>{port, 0}</c>.
      </p>
    <p>Note that the options <c>{mode, binary}</c> and <c>binary</c>
      are equivalent. Similarly <c>{mode, list}</c> and the absence of
      option <c>binary</c> are equivalent. 
      </p>
    <p>The ssl options are for setting specific SSL parameters as follows:
      </p>
    <list type="bulleted">
      <item>
        <p><c>{verify, code()}</c> Specifies type of verification:
          0 = do not verify peer; 1 = verify peer, 2 = verify peer,
          fail if no peer certificate.  The default value is 0.
          </p>
      </item>
      <item>
        <p><c>{depth, depth()}</c> Specifies the maximum
          verification depth, i.e. how far in a chain of certificates
          the verification process can proceed before the verification
          is considered to fail. 
          </p>
        <p>Peer certificate = 0, CA certificate = 1, higher level CA
          certificate = 2, etc.  The value 2 thus means that a chain
          can at most contain peer cert, CA cert, next CA cert, and an
          additional CA cert.
          </p>
        <p>The default value is 1.
          </p>
      </item>
      <item>
        <p><c>{certfile, path()}</c> Path to a file containing the
          user's certificate.
          chain of PEM encoded certificates.</p>
      </item>
      <item>
        <p><c>{keyfile, path()}</c> Path to file containing user's
          private PEM encoded key.</p>
      </item>
      <item>
        <p><c>{password, string()}</c> String containing the user's
          password. Only used if the private keyfile is password protected.</p>
      </item>
      <item>
        <p><c>{cacertfile, path()}</c> Path to file containing PEM encoded
          CA certificates (trusted certificates used for verifying a peer
          certificate).</p>
      </item>
      <item>
        <p><c>{ciphers, string()}</c> String of ciphers as a colon
          separated list of ciphers. The function <c>ciphers/0</c> can
          be used to find all available ciphers.</p>
      </item>
    </list>
    <p>The type <c>sslsocket()</c> is opaque to the user.
      </p>
    <p>The owner of a socket is the one that created it by a call to
      <c>transport_accept/[1,2]</c>,  <c>connect/[3,4]</c>,
      or <c>listen/2</c>.
      </p>
    <p>When a socket is in active mode (the default), data from the
      socket is delivered to the owner of the socket in the form of
      messages:
      </p>
    <list type="bulleted">
      <item>
        <p><c>{ssl, Socket, Data}</c></p>
      </item>
      <item>
        <p><c>{ssl_closed, Socket}</c></p>
      </item>
      <item>
        <p><c>{ssl_error, Socket, Reason}</c></p>
      </item>
    </list>
    <p>A <c>Timeout</c> argument specifies a timeout in milliseconds. The 
      default value for a <c>Timeout</c> argument is <c>infinity</c>.
      </p>
    <p>Functions listed below may return the value <c>{error, closed}</c>, which only indicates that the SSL socket is
      considered closed for the operation in question. It is for
      instance possible to have <c>{error, closed}</c> returned from
      an call to <c>send/2</c>, and a subsequent call to <c>recv/3</c>
      returning <c>{ok, Data}</c>.
      </p>
    <p>Hence a return value of <c>{error, closed}</c> must not be
      interpreted as if the socket was completely closed. On the
      contrary, in order to free all resources occupied by an SSL
      socket, <c>close/1</c> must be called, or else the process owning
      the socket has to terminate.
      </p>
    <p>For each SSL socket there is an Erlang process representing the
      socket.  When a socket is opened, that process links to the
      calling client process.  Implementations that want to detect
      abnormal exits from the socket process by receiving <c>{'EXIT', Pid, Reason}</c> messages, should use the function <c>pid/1</c>
      to retrieve the process identifier from the socket, in order to
      be able to match exit messages properly.</p>
  </section>
  <funcs>
    <func>
      <name>ciphers() -> {ok, string()} | {error, enotstarted}</name>
      <fsummary>Get supported ciphers.</fsummary>
      <desc>
        <p>Returns a string consisting of colon separated cipher
          designations that are supported by the current SSL library
          implementation.
          </p>
        <p>The SSL application has to be started to return the string
          of ciphers.</p>
      </desc>
    </func>
    <func>
      <name>close(Socket) -> ok | {error, Reason}</name>
      <fsummary>Close a socket returned by <c>transport_accept/[1,2]</c>, <c>connect/3/4</c>, or <c>listen/2</c>.</fsummary>
      <type>
        <v>Socket = sslsocket()</v>
      </type>
      <desc>
	<p>Closes a socket returned by <c>transport_accept/[1,2]</c>,
	<c>connect/[3,4]</c>, or <c>listen/2</c></p>
      </desc>
    </func>
    <func>
      <name>connect(Address, Port, Options) -> {ok, Socket} | {error, Reason}</name>
      <name>connect(Address, Port, Options, Timeout) -> {ok, Socket} | {error, Reason}</name>
      <fsummary>Connect to <c>Port</c>at <c>Address</c>.</fsummary>
      <type>
        <v>Address = address()</v>
        <v>Port = integer()</v>
        <v>Options = [connect_option()]</v>
        <v>connect_option() = {mode, list} | {mode, binary} | binary | {packet, packettype()} | {header, integer()} | {nodelay, boolean()} | {active, activetype()} | {ip, ipaddress()} | {port, integer()} | {verify, code()} | {depth, depth()} | {certfile, path()} | {keyfile, path()} | {password, string()} | {cacertfile, path()} | {ciphers, string()}</v>
        <v>Timeout = integer()</v>
        <v>Socket = sslsocket()</v>
      </type>
      <desc>
        <p>Connects to <c>Port</c> at <c>Address</c>. If the optional 
          <c>Timeout</c> argument is specified, and a connection could not
          be established within the given time, <c>{error, timeout}</c> is
          returned. The default value for <c>Timeout</c> is <c>infinity</c>.
          </p>
        <p>The <c>ip</c> and <c>port</c> options are for binding to a 
          particular <em>local</em> address and port, respectively.</p>
      </desc>
    </func>
    <func>
      <name>connection_info(Socket) -> {ok, {Protocol, Cipher}} | {error, Reason}</name>
      <fsummary>Get current protocol version and cipher.</fsummary>
      <type>
        <v>Socket = sslsocket()</v>
        <v>Protocol = protocol()</v>
        <v>Cipher = string()</v>
      </type>
      <desc>
        <p>Gets the chosen protocol version and cipher for an established
          connection (accepted och connected). </p>
      </desc>
    </func>
    <func>
      <name>controlling_process(Socket, NewOwner) -> ok | {error, Reason}</name>
      <fsummary>Assign a new controlling process to the socket.</fsummary>
      <type>
        <v>Socket = sslsocket()</v>
        <v>NewOwner = pid()</v>
      </type>
      <desc>
        <p>Assigns a new controlling process to <c>Socket</c>. A controlling
          process is the owner of a socket, and receives all messages from
          the socket.</p>
      </desc>
    </func>
    <func>
      <name>format_error(ErrorCode) -> string()</name>
      <fsummary>Return an error string.</fsummary>
      <type>
        <v>ErrorCode = term()</v>
      </type>
      <desc>
        <p>Returns a diagnostic string describing an error.</p>
      </desc>
    </func>
    <func>
      <name>getopts(Socket, OptionsTags) -> {ok, Options} | {error, Reason}</name>
      <fsummary>Get options set for socket</fsummary>
      <type>
        <v>Socket = sslsocket()</v>
        <v>OptionTags = [optiontag()]()</v>
      </type>
      <desc>
        <p>Returns the options the tags of which are <c>OptionTags</c> for
          for the socket <c>Socket</c>. </p>
      </desc>
    </func>
    <func>
      <name>listen(Port, Options) -> {ok, ListenSocket} | {error, Reason}</name>
      <fsummary>Set up a socket to listen on a port on the local host.</fsummary>
      <type>
        <v>Port = integer()</v>
        <v>Options = [listen_option()]</v>
        <v>listen_option() = {mode, list} | {mode, binary} | binary | {packet, packettype()} | {header, integer()} | {active, activetype()} | {backlog, integer()} | {ip, ipaddress()} | {verify, code()} | {depth, depth()} | {certfile, path()} | {keyfile, path()} | {password, string()} | {cacertfile, path()} | {ciphers, string()}</v>
        <v>ListenSocket = sslsocket()</v>
      </type>
      <desc>
        <p>Sets up a socket to listen on port <c>Port</c> at the local host.
          If <c>Port</c> is zero, <c>listen/2</c> picks an available port
          number (use <c>port/1</c> to retrieve it).
          </p>
        <p>The listen queue size defaults to 5. If a different value is 
          wanted, the option <c>{backlog, Size}</c> should be added to the 
          list of options.
          </p>
        <p>An empty <c>Options</c> list is considered an error, and
          <c>{error, enooptions}</c> is returned.
          </p>
        <p>The returned <c>ListenSocket</c> can only be used in calls to 
          <c>transport_accept/[1,2]</c>.</p>
      </desc>
    </func>
    <func>
      <name>peercert(Socket) -> {ok, Cert} |  {error, Reason}</name>
      <fsummary>Return the peer certificate.</fsummary>
      <type>
        <v>Socket = sslsocket()</v>
        <v>Cert = binary()()</v>
        <v>Subject = term()()</v>
      </type>
      <desc>
	<p>Returns the DER encoded peer certificate, the certificate can be decoded with
	  <c>public_key:pkix_decode_cert/2</c>.
	</p>
      </desc>
    </func>
    <func>
      <name>peername(Socket) -> {ok, {Address, Port}} | {error, Reason}</name>
      <fsummary>Return peer address and port.</fsummary>
      <type>
        <v>Socket = sslsocket()</v>
        <v>Address = ipaddress()</v>
        <v>Port = integer()</v>
      </type>
      <desc>
        <p>Returns the address and port number of the peer.</p>
      </desc>
    </func>
    <func>
      <name>pid(Socket) -> pid()</name>
      <fsummary>Return the pid of the socket process.</fsummary>
      <type>
        <v>Socket = sslsocket()</v>
      </type>
      <desc>
        <p>Returns the pid of the socket process. The returned pid should
          only be used for receiving exit messages.</p>
      </desc>
    </func>
    <func>
      <name>recv(Socket, Length) -> {ok, Data} | {error, Reason}</name>
      <name>recv(Socket, Length, Timeout) -> {ok, Data} | {error, Reason}</name>
      <fsummary>Receive data on socket.</fsummary>
      <type>
        <v>Socket = sslsocket()</v>
        <v>Length = integer() >= 0</v>
        <v>Timeout = integer()</v>
        <v>Data = bytes() | binary()</v>
      </type>
      <desc>
        <p>Receives data on socket <c>Socket</c> when the socket is in
          passive mode, i.e. when the option <c>{active, false}</c>
          has been specified.
          </p>
        <p>A notable return value is <c>{error, closed}</c> which
          indicates that the socket is closed.
          </p>
        <p>A positive value of the <c>Length</c> argument is only
          valid when the socket is in raw mode (option <c>{packet, 0}</c> is set, and the option <c>binary</c> is <em>not</em>
          set); otherwise it should be set to 0, whence all available
          bytes are returned.
          </p>
        <p>If the optional <c>Timeout</c> parameter is specified, and
          no data was available within the given time, <c>{error, timeout}</c> is returned. The default value for
          <c>Timeout</c> is <c>infinity</c>.</p>
      </desc>
    </func>
    <func>
      <name>seed(Data) -> ok | {error, Reason}</name>
      <fsummary>Seed the ssl random generator.</fsummary>
      <type>
        <v>Data = iolist() | binary()</v>
      </type>
      <desc>
        <p>Seeds the ssl random generator.
          </p>
        <p>It is strongly advised to seed the random generator after
          the ssl application has been started, and before any
          connections are established. Although the port program
          interfacing to the OpenSSL libraries does a "random" seeding
          of its own in order to make everything work properly, that
          seeding is by no means random for the world since it has a 
          constant value which is known to everyone reading the source
          code of the seeding. 
          </p>
        <p>A notable return value is <c>{error, edata}}</c> indicating that
          <c>Data</c> was not a binary nor an iolist.</p>
      </desc>
    </func>
    <func>
      <name>send(Socket, Data) -> ok | {error, Reason}</name>
      <fsummary>Write data to a socket.</fsummary>
      <type>
        <v>Socket = sslsocket()</v>
        <v>Data = iolist() | binary()</v>
      </type>
      <desc>
        <p>Writes <c>Data</c> to <c>Socket</c>. </p>
        <p>A notable return value is <c>{error, closed}</c> indicating that
          the socket is closed.</p>
      </desc>
    </func>
    <func>
      <name>setopts(Socket, Options) -> ok | {error, Reason}</name>
      <fsummary>Set socket options.</fsummary>
      <type>
        <v>Socket = sslsocket()</v>
        <v>Options = [socketoption]()</v>
      </type>
      <desc>
        <p>Sets options according to <c>Options</c> for the socket 
          <c>Socket</c>. </p>
      </desc>
    </func>
    <func>
      <name>ssl_accept(Socket) -> ok | {error, Reason}</name>
      <name>ssl_accept(Socket, Timeout) -> ok | {error, Reason}</name>
      <fsummary>Perform server-side SSL handshake and key exchange</fsummary>
      <type>
        <v>Socket = sslsocket()</v>
        <v>Timeout = integer()</v>
        <v>Reason = atom()</v>
      </type>
      <desc>
        <p>The <c>ssl_accept</c> function establish the SSL connection
          on the server side. It should be called directly after
          <c>transport_accept</c>, in the spawned server-loop.</p>
        <p>Note that the ssl connection is not complete until <c>ssl_accept</c>
          has returned <c>true</c>, and if an error is returned, the socket
          is unavailable and for instance <c>close/1</c> will crash.</p>
      </desc>
    </func>
    <func>
      <name>sockname(Socket) -> {ok, {Address, Port}} | {error, Reason}</name>
      <fsummary>Return the local address and port.</fsummary>
      <type>
        <v>Socket = sslsocket()</v>
        <v>Address = ipaddress()</v>
        <v>Port = integer()</v>
      </type>
      <desc>
        <p>Returns the local address and port number of the socket
          <c>Socket</c>.</p>
      </desc>
    </func>
    <func>
      <name>transport_accept(Socket) -> {ok, NewSocket} | {error, Reason}</name>
      <name>transport_accept(Socket, Timeout) -> {ok, NewSocket} | {error, Reason}</name>
      <fsummary>Accept an incoming connection and prepare for <c>ssl_accept</c></fsummary>
      <type>
        <v>Socket = NewSocket = sslsocket()</v>
        <v>Timeout = integer()</v>
        <v>Reason = atom()</v>
      </type>
      <desc>
        <p>Accepts an incoming connection request on a listen socket.
          <c>ListenSocket</c> must be a socket returned from <c>listen/2</c>.
          The socket returned should be passed to <c>ssl_accept</c> to
          complete ssl handshaking and establishing the connection.</p>
        <warning>
          <p>The socket returned can only be used with <c>ssl_accept</c>,
            no traffic can be sent or received before that call.</p>
        </warning>
        <p>The accepted socket inherits the options set for <c>ListenSocket</c>
          in <c>listen/2</c>.</p>
        <p>The default value for <c>Timeout</c> is <c>infinity</c>. If 
          <c>Timeout</c> is specified, and no connection is accepted within
          the given time, <c>{error, timeout}</c> is returned.</p>
      </desc>
    </func>
    <func>
      <name>version() -> {ok, {SSLVsn, CompVsn, LibVsn}}</name>
      <fsummary>Return the version of SSL.</fsummary>
      <type>
        <v>SSLVsn = CompVsn = LibVsn = string()()</v>
      </type>
      <desc>
        <p>Returns the SSL application version (<c>SSLVsn</c>), the library
          version used when compiling the SSL application port program
          (<c>CompVsn</c>), and the actual library version used when
          dynamically linking in runtime (<c>LibVsn</c>).
          </p>
        <p>If the SSL application has not been started, <c>CompVsn</c> and
          <c>LibVsn</c> are empty strings.
          </p>
      </desc>
    </func>
  </funcs>

  <section>
    <title>ERRORS</title>
    <p>The possible error reasons and the corresponding diagnostic strings 
      returned by <c>format_error/1</c> are either the same as those defined
      in the <c>inet(3)</c> reference manual, or as follows:
      </p>
    <taglist>
      <tag><c>closed</c></tag>
      <item>
        <p>Connection closed for the operation in question.
          </p>
      </item>
      <tag><c>ebadsocket</c></tag>
      <item>
        <p>Connection not found (internal error).
          </p>
      </item>
      <tag><c>ebadstate</c></tag>
      <item>
        <p>Connection not in connect state (internal error).
          </p>
      </item>
      <tag><c>ebrokertype</c></tag>
      <item>
        <p>Wrong broker type (internal error).
          </p>
      </item>
      <tag><c>ecacertfile</c></tag>
      <item>
        <p>Own CA certificate file is invalid.
          </p>
      </item>
      <tag><c>ecertfile</c></tag>
      <item>
        <p>Own certificate file is invalid.
          </p>
      </item>
      <tag><c>echaintoolong</c></tag>
      <item>
        <p>The chain of certificates provided by peer is too long.
          </p>
      </item>
      <tag><c>ecipher</c></tag>
      <item>
        <p>Own list of specified ciphers is invalid.
          </p>
      </item>
      <tag><c>ekeyfile</c></tag>
      <item>
        <p>Own private key file is invalid.
          </p>
      </item>
      <tag><c>ekeymismatch</c></tag>
      <item>
        <p>Own private key does not match own certificate.
          </p>
      </item>
      <tag><c>enoissuercert</c></tag>
      <item>
        <p>Cannot find certificate of issuer of certificate provided
          by peer.
          </p>
      </item>
      <tag><c>enoservercert</c></tag>
      <item>
        <p>Attempt to do accept without having set own certificate.
          </p>
      </item>
      <tag><c>enotlistener</c></tag>
      <item>
        <p>Attempt to accept on a non-listening socket.
          </p>
      </item>
      <tag><c>enoproxysocket</c></tag>
      <item>
        <p>No proxy socket found (internal error).
          </p>
      </item>
      <tag><c>enooptions</c></tag>
      <item>
        <p>The list of options is empty.
          </p>
      </item>
      <tag><c>enotstarted</c></tag>
      <item>
        <p>The SSL application has not been started.
          </p>
      </item>
      <tag><c>eoptions</c></tag>
      <item>
        <p>Invalid list of options.
          </p>
      </item>
      <tag><c>epeercert</c></tag>
      <item>
        <p>Certificate provided by peer is in error.
          </p>
      </item>
      <tag><c>epeercertexpired</c></tag>
      <item>
        <p>Certificate provided by peer has expired.
          </p>
      </item>
      <tag><c>epeercertinvalid</c></tag>
      <item>
        <p>Certificate provided by peer is invalid.
          </p>
      </item>
      <tag><c>eselfsignedcert</c></tag>
      <item>
        <p>Certificate provided by peer is self signed.
          </p>
      </item>
      <tag><c>esslaccept</c></tag>
      <item>
        <p>Server SSL handshake procedure between client and server failed.
          </p>
      </item>
      <tag><c>esslconnect</c></tag>
      <item>
        <p>Client SSL handshake procedure between client and server failed.
          </p>
      </item>
      <tag><c>esslerrssl</c></tag>
      <item>
        <p>SSL protocol failure. Typically because of a fatal alert 
          from peer.
          </p>
      </item>
      <tag><c>ewantconnect</c></tag>
      <item>
        <p>Protocol wants to connect, which is not supported in
          this version of the SSL application.
          </p>
      </item>
      <tag><c>ex509lookup</c></tag>
      <item>
        <p>Protocol wants X.509 lookup, which is not supported in
          this version of the SSL application.
          </p>
      </item>
      <tag><c>{badcall, Call}</c></tag>
      <item>
        <p>Call not recognized for current mode (active or passive) and
          state of socket.
          </p>
      </item>
      <tag><c>{badcast, Cast}</c></tag>
      <item>
        <p>Call not recognized for current mode (active or passive) and
          state of socket. 
          </p>
      </item>
      <tag><c>{badinfo, Info}</c></tag>
      <item>
        <p>Call not recognized for current mode (active or passive) and
          state of socket.
          </p>
      </item>
    </taglist>
  </section>

  <section>
    <title>SEE ALSO</title>
    <p>gen_tcp(3), inet(3) public_key(3) </p>
  </section>
  
</erlref>