cloudflare-tls

CipherSuiteName returns the standard name for the passed cipher suite ID (e.g.

CipherSuites returns a list of cipher suites currently implemented by this package, excluding those with security issues, which are returned by InsecureCipherSuites.

Client returns a new TLS client side connection using conn as the underlying transport.

Dial connects to the given network address using net.Dial and then initiates a TLS handshake, returning the resulting TLS connection.

DialWithDialer connects to the given network address using dialer.Dial and then initiates a TLS handshake, returning the resulting TLS connection.

EXP_NewECHKeySet constructs an EXP_ECHKeySet.

EXP_UnmarshalECHKeys parses a sequence of ECH keys.

InsecureCipherSuites returns a list of cipher suites currently implemented by this package and which have security issues.

Listen creates a TLS listener accepting connections on the given network address using net.Listen.

LoadX509KeyPair reads and parses a public/private key pair from a pair of files.

NewDelegatedCredential creates a new Delegated Credential using 'cert' for delegation, depending if the caller is the client or the server (defined by 'isClient').

NewListener creates a Listener which accepts connections from an inner Listener and wraps each connection with Server.

NewLRUClientSessionCache returns a ClientSessionCache with the given capacity that uses an LRU strategy.

NewResumptionState returns a state value that can be returned by [ClientSessionCache.Get] to resume a previous session.

ParseSessionState parses a [SessionState] encoded by [SessionState.Bytes].

QUICClient returns a new TLS client side connection using QUICTransport as the underlying transport.

QUICServer returns a new TLS server side connection using QUICTransport as the underlying transport.

Server returns a new TLS server side connection using conn as the underlying transport.

UnmarshalDelegatedCredential decodes a DelegatedCredential structure.

UnmarshalECHConfigs parses a sequence of ECH configurations.

VersionName returns the name for the provided TLS version number (e.g.

X509KeyPair parses a public/private key pair from a pair of PEM encoded data.

ECDSA algorithms.

EdDSA algorithms.

NoClientCert indicates that no client certificate should be requested during the handshake, and if any certificates are sent they will not be verified.

Legacy signature and hash algorithms for TLS 1.2.

RSASSA-PKCS1-v1_5 algorithms.

RSASSA-PSS algorithms with public key OID rsaEncryption.

QUICHandshakeDone indicates that the TLS handshake has completed.

QUICNoEvent indicates that there are no events available.

QUICRejectedEarlyData indicates that the server rejected 0-RTT data even if we offered it.

QUICSetReadSecret and QUICSetWriteSecret provide the read and write secrets for a given encryption level.

QUICTransportParameters provides the peer's QUIC transport parameters.

QUICTransportParametersRequired indicates that the caller must provide QUIC transport parameters to send to the peer.

QUICWriteData provides data to send to the peer in CRYPTO frames.

RenegotiateFreelyAsClient allows a remote server to repeatedly request renegotiation.

RenegotiateNever disables renegotiation.

RenegotiateOnceAsClient allows a remote server to request renegotiation once per connection.

RequestClientCert indicates that a client certificate should be requested during the handshake, but does not require that the client send any certificates.

RequireAndVerifyClientCert indicates that a client certificate should be requested during the handshake, and that at least one valid certificate is required to be sent by the client.

RequireAnyClientCert indicates that a client certificate should be requested during the handshake, and that at least one certificate is required to be sent by the client, but that certificate is not required to be valid.

TLS 1.3 cipher suites.

A list of cipher suite IDs that are, or have been, implemented by this package.

A list of cipher suite IDs that are, or have been, implemented by this package.

A list of cipher suite IDs that are, or have been, implemented by this package.

A list of cipher suite IDs that are, or have been, implemented by this package.

A list of cipher suite IDs that are, or have been, implemented by this package.

A list of cipher suite IDs that are, or have been, implemented by this package.

A list of cipher suite IDs that are, or have been, implemented by this package.

A list of cipher suite IDs that are, or have been, implemented by this package.

A list of cipher suite IDs that are, or have been, implemented by this package.

A list of cipher suite IDs that are, or have been, implemented by this package.

A list of cipher suite IDs that are, or have been, implemented by this package.

A list of cipher suite IDs that are, or have been, implemented by this package.

A list of cipher suite IDs that are, or have been, implemented by this package.

A list of cipher suite IDs that are, or have been, implemented by this package.

A list of cipher suite IDs that are, or have been, implemented by this package.

A list of cipher suite IDs that are, or have been, implemented by this package.

Legacy names for the corresponding cipher suites with the correct _SHA256 suffix, retained for backward compatibility.

A list of cipher suite IDs that are, or have been, implemented by this package.

A list of cipher suite IDs that are, or have been, implemented by this package.

TLS_FALLBACK_SCSV isn't a standard cipher suite but an indicator that the client is doing version fallback.

A list of cipher suite IDs that are, or have been, implemented by this package.

A list of cipher suite IDs that are, or have been, implemented by this package.

A list of cipher suite IDs that are, or have been, implemented by this package.

A list of cipher suite IDs that are, or have been, implemented by this package.

A list of cipher suite IDs that are, or have been, implemented by this package.

A list of cipher suite IDs that are, or have been, implemented by this package.

TLS 1.0 - 1.2 cipher suites.

VerifyClientCertIfGiven indicates that a client certificate should be requested during the handshake, but does not require that the client sends a certificate.

Deprecated: SSLv3 is cryptographically broken, and is no longer supported by this package.

A Certificate is a chain of one or more certificates, leaf first.

CertificateRequestInfo contains information from a server's CertificateRequest message, which is used to demand a certificate and proof of control from a client.

CertificateVerificationError is returned when certificate verification fails during the handshake.

CFEventECHPublicNameMismatch is emitted if the outer SNI does not match match the public name of the ECH configuration.

CFEventHandlerContextKey is a context key.

CFEventTLS13ClientHandshakeTimingInfo carries intra-stack time durations for TLS 1.3 client-state machine changes.

CFEventTLS13HRR is emitted when a HRR is sent or received.

CFEventTLS13ServerHandshakeTimingInfo carries intra-stack time durations for TLS 1.3 state machine changes.

CFEventTLSNegotiatedNamedKEX is emitted when a key agreement mechanism has been established that uses a named group.

CipherSuite is a TLS cipher suite.

ClientHelloInfo contains information from a ClientHello message in order to guide application logic in the GetCertificate and GetConfigForClient callbacks.

ClientSessionState contains the state needed by a client to resume a previous TLS session.

A Config structure is used to configure a TLS client or server.

A Conn represents a secured connection.

ConnectionState records basic TLS details about the connection.

DelegatedCredential stores a Delegated Credential with the credential and its signature.

A DelegatedCredentialPair contains a Delegated Credential and its associated private key.

Dialer dials TLS connections given a configuration and a Dialer for the underlying connection.

ECHConfig represents an ECH configuration.

ECHProviderResult represents the result of invoking the ECH provider.

EXP_ECHKey represents an ECH key and its corresponding configuration.

EXP_ECHKeySet implements the ECHProvider interface for a sequence of ECH keys.

A QUICConfig configures a QUICConn.

A QUICConn represents a connection which uses a QUIC implementation as the underlying transport as described in RFC 9001.

A QUICEvent is an event occurring on a QUIC connection.

RecordHeaderError is returned when a TLS record header is invalid.

A SessionState is a resumable session.

CFEvent is a value emitted at various points in the handshake that is handled by the callback Config.CFEventHandler.

ClientSessionCache is a cache of ClientSessionState objects that can be used by a client to resume a TLS session with a given server.

ECHProvider specifies the interface of an ECH service provider that decrypts the ECH payload on behalf of the client-facing server.

An AlertError is a TLS alert.

CFEventECHClientStatus is emitted once it is known whether the client bypassed, offered, or greased ECH.

CFEventECHServerStatus is emitted once it is known whether the client bypassed, offered, or greased ECH.

For backwards compatibility.

ClientAuthType declares the policy the server will follow for TLS Client Authentication.

CurveID is the type of a TLS identifier for an elliptic curve.

ECHProviderStatus is the status of the ECH provider's response.

QUICEncryptionLevel represents a QUIC encryption level used to transmit handshake messages.

A QUICEventKind is a type of operation on a QUIC connection.

RenegotiationSupport enumerates the different levels of support for TLS renegotiation.

SignatureScheme identifies a signature algorithm supported by TLS.