ioxd/tls.h - TLS 1.3, terminated in the kernel after an OpenSSL handshake: a store of certificates to listen with.
#include <ioxd.h> ioxd_certs *ioxd_certs_load(const char *dir); int ioxd_certs_reload(ioxd_certs *certs); void ioxd_certs_free(ioxd_certs *certs);
ioxd_certs *ioxd_certs_load(const char *dir);
A store from a directory: <dir>/<host>/cert.pem (the chain) and key.pem for each hostname, `default` for no SNI or no match, `_.example.com` for *.example.com. `default` is required - without it nothing can answer a name we do not have. NULL, with the reason on stderr, when nothing loads or the build has no TLS. Then: ioxd_bind(port, store).
int ioxd_certs_reload(ioxd_certs *certs);
Read the directory again and switch to what it holds. A host that fails to load - unreadable, mismatched, not valid yet, expired - keeps its old certificate, and the host answering for unmatched SNI keeps answering. Safe while serving: handshakes in flight finish on the table they started with, and reloads serialise against each other. 0, or -1 when nothing could be loaded at all, in which case what was serving still is.
void ioxd_certs_free(ioxd_certs *certs);
Give the store back: its certificates and the store itself, once the last handshake holding a table of it has finished. Not while a listener still uses it - every TLS connection takes a reference through the store - so this is for a store that was never listened on, or for after ioxd_run has returned. NULL is a no-op.
A TLS port beside a plain one; the files rotated, then reloaded:
ioxd_certs *certs = ioxd_certs_load("/etc/ioxd/certs"); /* <dir>/<host>/cert.pem and key.pem; `default` required */ if (!certs) return 1; ioxd_bind(8080, NULL); ioxd_bind(8443, certs); /* ... later, after new files were written: */ ioxd_certs_reload(certs); /* a host that fails keeps its old certificate */
ioxd_config(3), ioxd_http(3), ioxd_router(3), ioxd_slice(3), ioxd_json(3), ioxd_pipe(3), ioxd_examples(7), ioxd(7)