SSL_ APIs

The SSL_ APIs allow programmers to create secure socket applications on iSeries™.

Unlike GSKit APIs, SSL_ APIs only exist in the i5/OS™ operating system. The following table describes the SSL_ APIs that are supported in the i5/OS implementation.

Table 1. SSL_ APIs
Function	Description
SSL_Create()	Enable SSL support for the specified socket descriptor.
SSL_Destroy()	End SSL support for the specified SSL session and socket.
SSL_Handshake()	Initiate the SSL handshake protocol.
SSL_Init()	Initialize the current job for SSL and establish the SSL security information for the current job. Note: Either an SSL_Init() or SSL_Init_Application() API must be processed before SSL can be used.
SSL_Init_Application()	Initialize the current job for SSL and establish the SSL security information for the current job. Note: Either an SSL_Init() or SSL_Init_Application() API must be processed before SSL can be used.
SSL_Read()	Receive data from an SSL-enabled socket descriptor.
SSL_Write()	Write data to an SSL-enabled socket descriptor.
SSL_Strerror()	Retrieve SSL runtime error message.
SSL_Perror()	Print SSL error message.
QlgSSL_Init()	Initialize the current job for SSL and establish the SSL security information for the current job using NLS-enabled path name.

An application that uses the sockets and SSL_ APIs contains the following elements:

A call to socket() to obtain a socket descriptor.
Either call SSL_Init() or SSL_Init_Application() to initialize the job environment for SSL processing and to establish the SSL security information for all SSL sessions that run in the current job. Only one of these APIs should be used. It is preferred that you use the SSL_Init_Application() API.
Socket calls to activate a connection. It calls connect() to activate a connection for a client program, or it calls bind(), listen(), and accept() to enable a server to accept incoming connection requests.
A call to SSL_Create() to enable SSL support for the connected socket.
A call to SSL_Handshake() to initiate the SSL handshake negotiation of the cryptographic parameters.
Note: Typically, a server program must provide a certificate for an SSL handshake to succeed. A server must also have access to the private key that is associated with the server certificate and the key database file where the certificate is stored. In some cases, a client must also provide a certificate during the SSL handshake processing. This occurs if the server which the client is connecting to has enabled client authentication. The SSL_Init() or SSL_Init_Application() APIs identify (though in dissimilar ways) the key database file from which the certificate and private key that are used during the handshake are obtained.
Calls to SSL_Read() and SSL_Write() to receive and send data.
A call to SSL_Destroy() to disable SSL support for the socket.
A call to close() to destroy the connected sockets.