<?xml version="1.0" encoding="UTF-8" ?>
<class name="TLSOptions" inherits="RefCounted" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="../class.xsd">
<brief_description>
TLS configuration for clients and servers.
</brief_description>
<description>
TLSOptions abstracts the configuration options for the [StreamPeerTLS] and [PacketPeerDTLS] classes.
Objects of this class cannot be instantiated directly, and one of the static methods [method client], [method client_unsafe], or [method server] should be used instead.
[codeblocks]
[gdscript]
# Create a TLS client configuration which uses our custom trusted CA chain.
var client_trusted_cas = load("res://my_trusted_cas.crt")
var client_tls_options = TLSOptions.client(client_trusted_cas)
# Create a TLS server configuration.
var server_certs = load("res://my_server_cas.crt")
var server_key = load("res://my_server_key.key")
var server_tls_options = TLSOptions.server(server_key, server_certs)
[/gdscript]
[/codeblocks]
</description>
<tutorials>
</tutorials>
<methods>
<method name="client" qualifiers="static">
<return type="TLSOptions" />
<param index="0" name="trusted_chain" type="X509Certificate" default="null" />
<param index="1" name="common_name_override" type="String" default="""" />
<description>
Creates a TLS client configuration which validates certificates and their common names (fully qualified domain names).
You can specify a custom [param trusted_chain] of certification authorities (the default CA list will be used if [code]null[/code]), and optionally provide a [param common_name_override] if you expect the certificate to have a common name other than the server FQDN.
[b]Note:[/b] On the Web platform, TLS verification is always enforced against the CA list of the web browser. This is considered a security feature.
</description>
</method>
<method name="client_unsafe" qualifiers="static">
<return type="TLSOptions" />
<param index="0" name="trusted_chain" type="X509Certificate" default="null" />
<description>
Creates an [b]unsafe[/b] TLS client configuration where certificate validation is optional. You can optionally provide a valid [param trusted_chain], but the common name of the certificates will never be checked. Using this configuration for purposes other than testing [b]is not recommended[/b].
[b]Note:[/b] On the Web platform, TLS verification is always enforced against the CA list of the web browser. This is considered a security feature.
</description>
</method>
<method name="get_common_name_override" qualifiers="const">
<return type="String" />
<description>
Returns the common name (domain name) override specified when creating with [method TLSOptions.client].
</description>
</method>
<method name="get_own_certificate" qualifiers="const">
<return type="X509Certificate" />
<description>
Returns the [X509Certificate] specified when creating with [method TLSOptions.server].
</description>
</method>
<method name="get_private_key" qualifiers="const">
<return type="CryptoKey" />
<description>
Returns the [CryptoKey] specified when creating with [method TLSOptions.server].
</description>
</method>
<method name="get_trusted_ca_chain" qualifiers="const">
<return type="X509Certificate" />
<description>
Returns the CA [X509Certificate] chain specified when creating with [method TLSOptions.client] or [method TLSOptions.client_unsafe].
</description>
</method>
<method name="is_server" qualifiers="const">
<return type="bool" />
<description>
Returns [code]true[/code] if created with [method TLSOptions.server], [code]false[/code] otherwise.
</description>
</method>
<method name="is_unsafe_client" qualifiers="const">
<return type="bool" />
<description>
Returns [code]true[/code] if created with [method TLSOptions.client_unsafe], [code]false[/code] otherwise.
</description>
</method>
<method name="server" qualifiers="static">
<return type="TLSOptions" />
<param index="0" name="key" type="CryptoKey" />
<param index="1" name="certificate" type="X509Certificate" />
<description>
Creates a TLS server configuration using the provided [param key] and [param certificate].
[b]Note:[/b] The [param certificate] should include the full certificate chain up to the signing CA (certificates file can be concatenated using a general purpose text editor).
</description>
</method>
</methods>
</class>
Codebase Browser
godot