Simple WolfSSL Server Side Example
IntroductionThis page describes how, in just a few easy steps, the WolfSSL library can be used to to ensure the security and integrity of a server side networking application.
The information on this page is nearly identical to that found on the
Simple WolfSSL Client Side Example
page. It is repeated here for consistency – with the differences highlighted
where they exist.
Header fileswolfssl/ssl.h contains the WolfSSL structures, data definitions, and function prototypes. It must be included in all the source files that use the WolfSSL library.
Initialising the library and creating a WolfSSL contextwolfSSL_Init() prepares the WolfSSL library for use, and must be called before any other WolfSSL API functions.
Next, a variable of type WOLFSSL_CTX is required to store context information, and can be created using wolfSSL_CTX_new(). The SSL or TLS protocol to use is specified as the context is created using the function’s parameter. Options include SSLv3, TLSv1, TLSv1.1, TLSv1.2, or DTLS. This example demonstrates the TLSv1 server protocol being selected (the client side example selects TLSv1 client). The values to use to select the other protocol options are listed in the user manual.
The client side example demonstrated a Certificate Authority (CA) file being loaded into the WolfSSL context. In addition to the CA, the server context must also be loaded with the server certificate, and a key file. This allows the server to send its certificate to the client for verification. wolfSSL_CTX_load_verify_locations() is called to load the CA, wolfSSL_CTX_use_certificate_file() to load the certificate, and wolfSSL_CTX_use_PrivateKey_file to load the private key file.
Associating a WolfSSL object with a connected socketEach accepted connection must be associated with a WolfSSL object. WolfSSL objects are created using wolfSSL_new(), and associated with a TCP socket using wolfSSL_set_fd().
Using the socketSecure communication can now be made through the socket by using wolfSSL_write() in place of the standard sockets write() or send() functions, and wolfSSL_read() in place of the standard sockets read() or recv().
Note that the first parameter to both wolfSSL_write() and wolfSSL_read() is not the socket descriptor, but the WolfSSL object that is associated with the socket descriptor.
Deleting allocated resourcesWolfSSL API functions that result in dynamic resource allocation have a counterpart function that should be called to free the resource when it is no longer required. The code snippet below shows how the objects created in this small example should be freed.