Namespace: go.std.crypto.tls

v1.0

Contents

• Summary
• Index
• Constants
• Variables
• Functions, Macros, and Special Forms
• Types

Summary

Provides a low-level interface to the crypto/tls package.

Package tls partially implements TLS 1.2, as specified in RFC 5246,
and TLS 1.3, as specified in RFC 8446.

Index

• *Certificate
• *CertificateRequestInfo
• *CipherSuite
• *ClientAuthType
• *ClientHelloInfo
• *ClientSessionState
• *Config
• *Conn
• *ConnectionState
• *CurveID
• *Dialer
• *RecordHeaderError
• *RenegotiationSupport
• *SignatureScheme
• Certificate
• CertificateRequestInfo
• CipherSuite
• CipherSuiteName
• CipherSuites
• Client
• ClientAuthType
• ClientHelloInfo
• ClientSessionCache
• ClientSessionState
• Config
• Conn
• ConnectionState
• CurveID
• CurveP256
• CurveP384
• CurveP521
• Dial
• DialWithDialer
• Dialer
• ECDSAWithP256AndSHA256
• ECDSAWithP384AndSHA384
• ECDSAWithP521AndSHA512
• ECDSAWithSHA1
• Ed25519
• InsecureCipherSuites
• Listen
• LoadX509KeyPair
• NewLRUClientSessionCache
• NewListener
• NoClientCert
• PKCS1WithSHA1
• PKCS1WithSHA256
• PKCS1WithSHA384
• PKCS1WithSHA512
• PSSWithSHA256
• PSSWithSHA384
• PSSWithSHA512
• RecordHeaderError
• RenegotiateFreelyAsClient
• RenegotiateNever
• RenegotiateOnceAsClient
• RenegotiationSupport
• RequestClientCert
• RequireAndVerifyClientCert
• RequireAnyClientCert
• Server
• SignatureScheme
• TLS_AES_128_GCM_SHA256
• TLS_AES_256_GCM_SHA384
• TLS_CHACHA20_POLY1305_SHA256
• TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
• TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
• TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
• TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
• TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
• TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
• TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
• TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
• TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
• TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
• TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
• TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
• TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
• TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
• TLS_ECDHE_RSA_WITH_RC4_128_SHA
• TLS_FALLBACK_SCSV
• TLS_RSA_WITH_3DES_EDE_CBC_SHA
• TLS_RSA_WITH_AES_128_CBC_SHA
• TLS_RSA_WITH_AES_128_CBC_SHA256
• TLS_RSA_WITH_AES_128_GCM_SHA256
• TLS_RSA_WITH_AES_256_CBC_SHA
• TLS_RSA_WITH_AES_256_GCM_SHA384
• TLS_RSA_WITH_RC4_128_SHA
• VerifyClientCertIfGiven
• VersionSSL30
• VersionTLS10
• VersionTLS11
• VersionTLS12
• VersionTLS13
• X25519
• X509KeyPair
• arrayOfCertificate
• arrayOfCertificateRequestInfo
• arrayOfCipherSuite
• arrayOfClientAuthType
• arrayOfClientHelloInfo
• arrayOfClientSessionCache
• arrayOfClientSessionState
• arrayOfConfig
• arrayOfConn
• arrayOfConnectionState
• arrayOfCurveID
• arrayOfDialer
• arrayOfRecordHeaderError
• arrayOfRenegotiationSupport
• arrayOfSignatureScheme

Legend

Constant Variable Function Macro Special form Type GoVar Receiver/Method

Constants

Constants are variables with :const true in their metadata. Joker currently does not recognize them as special; as such, it allows redefining them or their values.

• TLS_AES_128_GCM_SHA256

  Int v1.0

  TLS 1.3 cipher suites.
  

• TLS_AES_256_GCM_SHA384

  Int v1.0

  A list of cipher suite IDs that are, or have been, implemented by this
  package.
  
  See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
  

• TLS_CHACHA20_POLY1305_SHA256

  Int v1.0

  A list of cipher suite IDs that are, or have been, implemented by this
  package.
  
  See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
  

• TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA

  Int v1.0

  A list of cipher suite IDs that are, or have been, implemented by this
  package.
  
  See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
  

• TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256

  Int v1.0

  A list of cipher suite IDs that are, or have been, implemented by this
  package.
  
  See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
  

• TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

  Int v1.0

  A list of cipher suite IDs that are, or have been, implemented by this
  package.
  
  See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
  

• TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA

  Int v1.0

  A list of cipher suite IDs that are, or have been, implemented by this
  package.
  
  See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
  

• TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

  Int v1.0

  A list of cipher suite IDs that are, or have been, implemented by this
  package.
  
  See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
  

• TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305

  Int v1.0

  A list of cipher suite IDs that are, or have been, implemented by this
  package.
  
  See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
  

• TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256

  Int v1.0

  A list of cipher suite IDs that are, or have been, implemented by this
  package.
  
  See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
  

• TLS_ECDHE_ECDSA_WITH_RC4_128_SHA

  Int v1.0

  A list of cipher suite IDs that are, or have been, implemented by this
  package.
  
  See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
  

• TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA

  Int v1.0

  A list of cipher suite IDs that are, or have been, implemented by this
  package.
  
  See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
  

• TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

  Int v1.0

  A list of cipher suite IDs that are, or have been, implemented by this
  package.
  
  See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
  

• TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

  Int v1.0

  A list of cipher suite IDs that are, or have been, implemented by this
  package.
  
  See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
  

• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

  Int v1.0

  A list of cipher suite IDs that are, or have been, implemented by this
  package.
  
  See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
  

• TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA

  Int v1.0

  A list of cipher suite IDs that are, or have been, implemented by this
  package.
  
  See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
  

• TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

  Int v1.0

  A list of cipher suite IDs that are, or have been, implemented by this
  package.
  
  See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
  

• TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305

  Int v1.0

  Legacy names for the corresponding cipher suites with the correct _SHA256
  suffix, retained for backward compatibility.
  

• TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256

  Int v1.0

  A list of cipher suite IDs that are, or have been, implemented by this
  package.
  
  See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
  

• TLS_ECDHE_RSA_WITH_RC4_128_SHA

  Int v1.0

  A list of cipher suite IDs that are, or have been, implemented by this
  package.
  
  See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
  

• TLS_FALLBACK_SCSV

  Int v1.0

  TLS_FALLBACK_SCSV isn't a standard cipher suite but an indicator
  that the client is doing version fallback. See RFC 7507.
  

• TLS_RSA_WITH_3DES_EDE_CBC_SHA

  Int v1.0

  A list of cipher suite IDs that are, or have been, implemented by this
  package.
  
  See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
  

• TLS_RSA_WITH_AES_128_CBC_SHA

  Int v1.0

  A list of cipher suite IDs that are, or have been, implemented by this
  package.
  
  See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
  

• TLS_RSA_WITH_AES_128_CBC_SHA256

  Int v1.0

  A list of cipher suite IDs that are, or have been, implemented by this
  package.
  
  See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
  

• TLS_RSA_WITH_AES_128_GCM_SHA256

  Int v1.0

  A list of cipher suite IDs that are, or have been, implemented by this
  package.
  
  See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
  

• TLS_RSA_WITH_AES_256_CBC_SHA

  Int v1.0

  A list of cipher suite IDs that are, or have been, implemented by this
  package.
  
  See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
  

• TLS_RSA_WITH_AES_256_GCM_SHA384

  Int v1.0

  A list of cipher suite IDs that are, or have been, implemented by this
  package.
  
  See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
  

• TLS_RSA_WITH_RC4_128_SHA

  Int v1.0

  TLS 1.0 - 1.2 cipher suites.
  

• VersionSSL30

  Int v1.0

  Deprecated: SSLv3 is cryptographically broken, and is no longer
  supported by this package. See golang.org/issue/32716.
  

• VersionTLS10

  Int v1.0

• VersionTLS11

  Int v1.0

• VersionTLS12

  Int v1.0

• VersionTLS13

  Int v1.0

Variables

• CurveP256

  GoObject v1.0

• CurveP384

  GoObject v1.0

• CurveP521

  GoObject v1.0

• ECDSAWithP256AndSHA256

  GoObject v1.0

  ECDSA algorithms. Only constrained to a specific curve in TLS 1.3.
  

• ECDSAWithP384AndSHA384

  GoObject v1.0

• ECDSAWithP521AndSHA512

  GoObject v1.0

• ECDSAWithSHA1

  GoObject v1.0

• Ed25519

  GoObject v1.0

  EdDSA algorithms.
  

• NoClientCert

  GoObject v1.0

  NoClientCert indicates that no client certificate should be requested
  during the handshake, and if any certificates are sent they will not
  be verified.
  

• PKCS1WithSHA1

  GoObject v1.0

  Legacy signature and hash algorithms for TLS 1.2.
  

• PKCS1WithSHA256

  GoObject v1.0

  RSASSA-PKCS1-v1_5 algorithms.
  

• PKCS1WithSHA384

  GoObject v1.0

• PKCS1WithSHA512

  GoObject v1.0

• PSSWithSHA256

  GoObject v1.0

  RSASSA-PSS algorithms with public key OID rsaEncryption.
  

• PSSWithSHA384

  GoObject v1.0

• PSSWithSHA512

  GoObject v1.0

• RenegotiateFreelyAsClient

  GoObject v1.0

  RenegotiateFreelyAsClient allows a remote server to repeatedly
  request renegotiation.
  

• RenegotiateNever

  GoObject v1.0

  RenegotiateNever disables renegotiation.
  

• RenegotiateOnceAsClient

  GoObject v1.0

  RenegotiateOnceAsClient allows a remote server to request
  renegotiation once per connection.
  

• RequestClientCert

  GoObject v1.0

  RequestClientCert indicates that a client certificate should be requested
  during the handshake, but does not require that the client send any
  certificates.
  

• RequireAndVerifyClientCert

  GoObject v1.0

  RequireAndVerifyClientCert indicates that a client certificate should be requested
  during the handshake, and that at least one valid certificate is required
  to be sent by the client.
  

• RequireAnyClientCert

  GoObject v1.0

  RequireAnyClientCert indicates that a client certificate should be requested
  during the handshake, and that at least one certificate is required to be
  sent by the client, but that certificate is not required to be valid.
  

• VerifyClientCertIfGiven

  GoObject v1.0

  VerifyClientCertIfGiven indicates that a client certificate should be requested
  during the handshake, but does not require that the client sends a
  certificate. If the client does send a certificate it is required to be
  valid.
  

• X25519

  GoObject v1.0

Functions, Macros, and Special Forms

• CipherSuiteName

  Function v1.0

  (CipherSuiteName id)
  

  CipherSuiteName returns the standard name for the passed cipher suite ID
  (e.g. "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"), or a fallback representation
  of the ID value if the cipher suite is not implemented by this package.
  
  Go input arguments: (id uint16)
  
  Go returns: string
  
  Joker input arguments: [^Int id]
  
  Joker returns: ^String

• CipherSuites

  Function v1.0

  (CipherSuites)
  

  CipherSuites returns a list of cipher suites currently implemented by this
  package, excluding those with security issues, which are returned by
  InsecureCipherSuites.
  
  The list is sorted by ID. Note that the default cipher suites selected by
  this package might depend on logic that can't be captured by a static list,
  and might not match those returned by this function.
  
  Go returns: []*CipherSuite
  
  Joker input arguments: []
  
  Joker returns: ^arrayOf*CipherSuite

• Client

  Function v1.0

  (Client conn config)
  

  Client returns a new TLS client side connection
  using conn as the underlying transport.
  The config cannot be nil: users must set either ServerName or
  InsecureSkipVerify in the config.
  
  Go input arguments: (conn net.Conn, config *Config)
  
  Go returns: *Conn
  
  Joker input arguments: [^go.std.net/Conn conn, ^*Config config]
  
  Joker returns: ^*Conn

• Dial

  Function v1.0

  (Dial network addr config)
  

  Dial connects to the given network address using net.Dial
  and then initiates a TLS handshake, returning the resulting
  TLS connection.
  Dial interprets a nil configuration as equivalent to
  the zero configuration; see the documentation of Config
  for the defaults.
  
  Go input arguments: (network string, addr string, config *Config)
  
  Go returns: (*Conn, error)
  
  Joker input arguments: [^String network, ^String addr, ^*Config config]
  
  Joker returns: [^*Conn, ^Error]

• DialWithDialer

  Function v1.0

  (DialWithDialer dialer network addr config)
  

  DialWithDialer connects to the given network address using dialer.Dial and
  then initiates a TLS handshake, returning the resulting TLS connection. Any
  timeout or deadline given in the dialer apply to connection and TLS
  handshake as a whole.
  
  DialWithDialer interprets a nil configuration as equivalent to the zero
  configuration; see the documentation of Config for the defaults.
  
  DialWithDialer uses context.Background internally; to specify the context,
  use Dialer.DialContext with NetDialer set to the desired dialer.
  
  Go input arguments: (dialer *net.Dialer, network string, addr string, config *Config)
  
  Go returns: (*Conn, error)
  
  Joker input arguments: [^go.std.net/*Dialer dialer, ^String network, ^String addr, ^*Config config]
  
  Joker returns: [^*Conn, ^Error]

• InsecureCipherSuites

  Function v1.0

  (InsecureCipherSuites)
  

  InsecureCipherSuites returns a list of cipher suites currently implemented by
  this package and which have security issues.
  
  Most applications should not use the cipher suites in this list, and should
  only use those returned by CipherSuites.
  
  Go returns: []*CipherSuite
  
  Joker input arguments: []
  
  Joker returns: ^arrayOf*CipherSuite

• Listen

  Function v1.0

  (Listen network laddr config)
  

  Listen creates a TLS listener accepting connections on the
  given network address using net.Listen.
  The configuration config must be non-nil and must include
  at least one certificate or else set GetCertificate.
  
  Go input arguments: (network string, laddr string, config *Config)
  
  Go returns: (net.Listener, error)
  
  Joker input arguments: [^String network, ^String laddr, ^*Config config]
  
  Joker returns: [^go.std.net/Listener, ^Error]

• LoadX509KeyPair

  Function v1.0

  (LoadX509KeyPair certFile keyFile)
  

  LoadX509KeyPair reads and parses a public/private key pair from a pair
  of files. The files must contain PEM encoded data. The certificate file
  may contain intermediate certificates following the leaf certificate to
  form a certificate chain. On successful return, Certificate.Leaf will
  be nil because the parsed form of the certificate is not retained.
  
  Go input arguments: (certFile string, keyFile string)
  
  Go returns: (Certificate, error)
  
  Joker input arguments: [^String certFile, ^String keyFile]
  
  Joker returns: [^Certificate, ^Error]

• NewLRUClientSessionCache

  Function v1.0

  (NewLRUClientSessionCache capacity)
  

  NewLRUClientSessionCache returns a ClientSessionCache with the given
  capacity that uses an LRU strategy. If capacity is < 1, a default capacity
  is used instead.
  
  Go input arguments: (capacity int)
  
  Go returns: ClientSessionCache
  
  Joker input arguments: [^Int capacity]
  
  Joker returns: ^ClientSessionCache

• NewListener

  Function v1.0

  (NewListener inner config)
  

  NewListener creates a Listener which accepts connections from an inner
  Listener and wraps each connection with Server.
  The configuration config must be non-nil and must include
  at least one certificate or else set GetCertificate.
  
  Go input arguments: (inner net.Listener, config *Config)
  
  Go returns: net.Listener
  
  Joker input arguments: [^go.std.net/Listener inner, ^*Config config]
  
  Joker returns: ^go.std.net/Listener

• Server

  Function v1.0

  (Server conn config)
  

  Server returns a new TLS server side connection
  using conn as the underlying transport.
  The configuration config must be non-nil and must include
  at least one certificate or else set GetCertificate.
  
  Go input arguments: (conn net.Conn, config *Config)
  
  Go returns: *Conn
  
  Joker input arguments: [^go.std.net/Conn conn, ^*Config config]
  
  Joker returns: ^*Conn

• X509KeyPair

  Function v1.0

  (X509KeyPair certPEMBlock keyPEMBlock)
  

  X509KeyPair parses a public/private key pair from a pair of
  PEM encoded data. On successful return, Certificate.Leaf will be nil because
  the parsed form of the certificate is not retained.
  
  Go input arguments: (certPEMBlock []byte, keyPEMBlock []byte)
  
  Go returns: (Certificate, error)
  
  Joker input arguments: [^arrayOfByte certPEMBlock, ^arrayOfByte keyPEMBlock]
  
  Joker returns: [^Certificate, ^Error]

Types

• *Certificate

  Concrete Type v1.0

  A Certificate is a chain of one or more certificates, leaf first.
  

• *CertificateRequestInfo

  Concrete Type v1.0

  CertificateRequestInfo contains information from a server's
  CertificateRequest message, which is used to demand a certificate and proof
  of control from a client.
  

• Context

  Receiver for *CertificateRequestInfo v1.0

  ([])
  

  Context returns the context of the handshake that is in progress.
  This context is a child of the context passed to HandshakeContext,
  if any, and is canceled when the handshake concludes.
  

• SupportsCertificate

  Receiver for *CertificateRequestInfo v1.0

  ([c])
  

  SupportsCertificate returns nil if the provided certificate is supported by
  the server that sent the CertificateRequest. Otherwise, it returns an error
  describing the reason for the incompatibility.
  

• *CipherSuite

  Concrete Type v1.0

  CipherSuite is a TLS cipher suite. Note that most functions in this package
  accept and expose cipher suite IDs instead of this type.
  

• *ClientAuthType

  Concrete Type v1.0

  ClientAuthType declares the policy the server will follow for
  TLS Client Authentication.
  

• *ClientHelloInfo

  Concrete Type v1.0

  ClientHelloInfo contains information from a ClientHello message in order to
  guide application logic in the GetCertificate and GetConfigForClient callbacks.
  

• Context

  Receiver for *ClientHelloInfo v1.0

  ([])
  

  Context returns the context of the handshake that is in progress.
  This context is a child of the context passed to HandshakeContext,
  if any, and is canceled when the handshake concludes.
  

• SupportsCertificate

  Receiver for *ClientHelloInfo v1.0

  ([c])
  

  SupportsCertificate returns nil if the provided certificate is supported by
  the client that sent the ClientHello. Otherwise, it returns an error
  describing the reason for the incompatibility.
  
  If this ClientHelloInfo was passed to a GetConfigForClient or GetCertificate
  callback, this method will take into account the associated Config. Note that
  if GetConfigForClient returns a different Config, the change can't be
  accounted for by this method.
  
  This function will call x509.ParseCertificate unless c.Leaf is set, which can
  incur a significant performance cost.
  

• *ClientSessionState

  Concrete Type v1.0

  ClientSessionState contains the state needed by clients to resume TLS
  sessions.
  

• *Config

  Concrete Type v1.0

  A Config structure is used to configure a TLS client or server.
  After one has been passed to a TLS function it must not be
  modified. A Config may be reused; the tls package will also not
  modify it.
  

• BuildNameToCertificate

  Receiver for *Config v1.0

  ([])
  

  BuildNameToCertificate parses c.Certificates and builds c.NameToCertificate
  from the CommonName and SubjectAlternateName fields of each of the leaf
  certificates.
  
  Deprecated: NameToCertificate only allows associating a single certificate
  with a given name. Leave that field nil to let the library select the first
  compatible chain from Certificates.
  

• Clone

  Receiver for *Config v1.0

  ([])
  

  Clone returns a shallow clone of c or nil if c is nil. It is safe to clone a Config that is
  being used concurrently by a TLS client or server.
  

• SetSessionTicketKeys

  Receiver for *Config v1.0

  ([keys])
  

  SetSessionTicketKeys updates the session ticket keys for a server.
  
  The first key will be used when creating new tickets, while all keys can be
  used for decrypting tickets. It is safe to call this function while the
  server is running in order to rotate the session ticket keys. The function
  will panic if keys is empty.
  
  Calling this function will turn off automatic session ticket key rotation.
  
  If multiple servers are terminating connections for the same host they should
  all have the same session ticket keys. If the session ticket keys leaks,
  previously recorded and future TLS connections using those keys might be
  compromised.
  

• *Conn

  Concrete Type v1.0

  A Conn represents a secured connection.
  It implements the net.Conn interface.
  

• Close

  Receiver for *Conn v1.0

  ([])
  

  Close closes the connection.
  

• CloseWrite

  Receiver for *Conn v1.0

  ([])
  

  CloseWrite shuts down the writing side of the connection. It should only be
  called once the handshake has completed and does not call CloseWrite on the
  underlying connection. Most callers should just use Close.
  

• ConnectionState

  Receiver for *Conn v1.0

  ([])
  

  ConnectionState returns basic TLS details about the connection.
  

• Handshake

  Receiver for *Conn v1.0

  ([])
  

  Handshake runs the client or server handshake
  protocol if it has not yet been run.
  
  Most uses of this package need not call Handshake explicitly: the
  first Read or Write will call it automatically.
  
  For control over canceling or setting a timeout on a handshake, use
  HandshakeContext or the Dialer's DialContext method instead.
  

• HandshakeContext

  Receiver for *Conn v1.0

  ([ctx])
  

  HandshakeContext runs the client or server handshake
  protocol if it has not yet been run.
  
  The provided Context must be non-nil. If the context is canceled before
  the handshake is complete, the handshake is interrupted and an error is returned.
  Once the handshake has completed, cancellation of the context will not affect the
  connection.
  
  Most uses of this package need not call HandshakeContext explicitly: the
  first Read or Write will call it automatically.
  

• LocalAddr

  Receiver for *Conn v1.0

  ([])
  

  LocalAddr returns the local network address.
  

• NetConn

  Receiver for *Conn v1.0

  ([])
  

  NetConn returns the underlying connection that is wrapped by c.
  Note that writing to or reading from this connection directly will corrupt the
  TLS session.
  

• OCSPResponse

  Receiver for *Conn v1.0

  ([])
  

  OCSPResponse returns the stapled OCSP response from the TLS server, if
  any. (Only valid for client connections.)
  

• Read

  Receiver for *Conn v1.0

  ([b])
  

  Read reads data from the connection.
  
  As Read calls Handshake, in order to prevent indefinite blocking a deadline
  must be set for both Read and Write before Read is called when the handshake
  has not yet completed. See SetDeadline, SetReadDeadline, and
  SetWriteDeadline.
  

• RemoteAddr

  Receiver for *Conn v1.0

  ([])
  

  RemoteAddr returns the remote network address.
  

• SetDeadline

  Receiver for *Conn v1.0

  ([t])
  

  SetDeadline sets the read and write deadlines associated with the connection.
  A zero value for t means Read and Write will not time out.
  After a Write has timed out, the TLS state is corrupt and all future writes will return the same error.
  

• SetReadDeadline

  Receiver for *Conn v1.0

  ([t])
  

  SetReadDeadline sets the read deadline on the underlying connection.
  A zero value for t means Read will not time out.
  

• SetWriteDeadline

  Receiver for *Conn v1.0

  ([t])
  

  SetWriteDeadline sets the write deadline on the underlying connection.
  A zero value for t means Write will not time out.
  After a Write has timed out, the TLS state is corrupt and all future writes will return the same error.
  

• VerifyHostname

  Receiver for *Conn v1.0

  ([host])
  

  VerifyHostname checks that the peer certificate chain is valid for
  connecting to host. If so, it returns nil; if not, it returns an error
  describing the problem.
  

• Write

  Receiver for *Conn v1.0

  ([b])
  

  Write writes data to the connection.
  
  As Write calls Handshake, in order to prevent indefinite blocking a deadline
  must be set for both Read and Write before Write is called when the handshake
  has not yet completed. See SetDeadline, SetReadDeadline, and
  SetWriteDeadline.
  

• *ConnectionState

  Concrete Type v1.0

  ConnectionState records basic TLS details about the connection.
  

• ExportKeyingMaterial

  Receiver for *ConnectionState v1.0

  ([label context length])
  

  ExportKeyingMaterial returns length bytes of exported key material in a new
  slice as defined in RFC 5705. If context is nil, it is not used as part of
  the seed. If the connection was set to allow renegotiation via
  Config.Renegotiation, this function will return an error.
  

• *CurveID

  Concrete Type v1.0

  CurveID is the type of a TLS identifier for an elliptic curve. See
  https://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-8.
  
  In TLS 1.3, this type is called NamedGroup, but at this time this library
  only supports Elliptic Curve based groups. See RFC 8446, Section 4.2.7.
  

• *Dialer

  Concrete Type v1.0

  Dialer dials TLS connections given a configuration and a Dialer for the
  underlying connection.
  

• Dial

  Receiver for *Dialer v1.0

  ([network addr])
  

  Dial connects to the given network address and initiates a TLS
  handshake, returning the resulting TLS connection.
  
  The returned Conn, if any, will always be of type *Conn.
  
  Dial uses context.Background internally; to specify the context,
  use DialContext.
  

• DialContext

  Receiver for *Dialer v1.0

  ([ctx network addr])
  

  DialContext connects to the given network address and initiates a TLS
  handshake, returning the resulting TLS connection.
  
  The provided Context must be non-nil. If the context expires before
  the connection is complete, an error is returned. Once successfully
  connected, any expiration of the context will not affect the
  connection.
  
  The returned Conn, if any, will always be of type *Conn.
  

• *RecordHeaderError

  Concrete Type v1.0

  RecordHeaderError is returned when a TLS record header is invalid.
  

• *RenegotiationSupport

  Concrete Type v1.0

  RenegotiationSupport enumerates the different levels of support for TLS
  renegotiation. TLS renegotiation is the act of performing subsequent
  handshakes on a connection after the first. This significantly complicates
  the state machine and has been the source of numerous, subtle security
  issues. Initiating a renegotiation is not supported, but support for
  accepting renegotiation requests may be enabled.
  
  Even when enabled, the server may not change its identity between handshakes
  (i.e. the leaf certificate must be the same). Additionally, concurrent
  handshake and application data flow is not permitted so renegotiation can
  only be used with protocols that synchronise with the renegotiation, such as
  HTTPS.
  
  Renegotiation is not defined in TLS 1.3.
  

• *SignatureScheme

  Concrete Type v1.0

  SignatureScheme identifies a signature algorithm supported by TLS. See
  RFC 8446, Section 4.2.3.
  

• Certificate

  Concrete Type v1.0

  A Certificate is a chain of one or more certificates, leaf first.
  

• CertificateRequestInfo

  Concrete Type v1.0

  CertificateRequestInfo contains information from a server's
  CertificateRequest message, which is used to demand a certificate and proof
  of control from a client.
  

• CipherSuite

  Concrete Type v1.0

  CipherSuite is a TLS cipher suite. Note that most functions in this package
  accept and expose cipher suite IDs instead of this type.
  

• ClientAuthType

  Concrete Type v1.0

  ClientAuthType declares the policy the server will follow for
  TLS Client Authentication.
  

• String

  Receiver for ClientAuthType v1.0

  ([])
  

• ClientHelloInfo

  Concrete Type v1.0

  ClientHelloInfo contains information from a ClientHello message in order to
  guide application logic in the GetCertificate and GetConfigForClient callbacks.
  

• ClientSessionCache

  Abstract Type v1.0

  ClientSessionCache is a cache of ClientSessionState objects that can be used
  by a client to resume a TLS session with a given server. ClientSessionCache
  implementations should expect to be called concurrently from different
  goroutines. Up to TLS 1.2, only ticket-based resumption is supported, not
  SessionID-based resumption. In TLS 1.3 they were merged into PSK modes, which
  are supported via this interface.
  

• Get

  Method for ClientSessionCache v1.0

  ([sessionKey])
  

• Put

  Method for ClientSessionCache v1.0

  ([sessionKey cs])
  

• ClientSessionState

  Concrete Type v1.0

  ClientSessionState contains the state needed by clients to resume TLS
  sessions.
  

• Config

  Concrete Type v1.0

  A Config structure is used to configure a TLS client or server.
  After one has been passed to a TLS function it must not be
  modified. A Config may be reused; the tls package will also not
  modify it.
  

• Conn

  Concrete Type v1.0

  A Conn represents a secured connection.
  It implements the net.Conn interface.
  

• ConnectionState

  Concrete Type v1.0

  ConnectionState records basic TLS details about the connection.
  

• CurveID

  Concrete Type v1.0

  CurveID is the type of a TLS identifier for an elliptic curve. See
  https://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-8.
  
  In TLS 1.3, this type is called NamedGroup, but at this time this library
  only supports Elliptic Curve based groups. See RFC 8446, Section 4.2.7.
  

• String

  Receiver for CurveID v1.0

  ([])
  

• Dialer

  Concrete Type v1.0

  Dialer dials TLS connections given a configuration and a Dialer for the
  underlying connection.
  

• RecordHeaderError

  Concrete Type v1.0

  RecordHeaderError is returned when a TLS record header is invalid.
  

• Error

  Receiver for RecordHeaderError v1.0

  ([])
  

• RenegotiationSupport

  Concrete Type v1.0

  RenegotiationSupport enumerates the different levels of support for TLS
  renegotiation. TLS renegotiation is the act of performing subsequent
  handshakes on a connection after the first. This significantly complicates
  the state machine and has been the source of numerous, subtle security
  issues. Initiating a renegotiation is not supported, but support for
  accepting renegotiation requests may be enabled.
  
  Even when enabled, the server may not change its identity between handshakes
  (i.e. the leaf certificate must be the same). Additionally, concurrent
  handshake and application data flow is not permitted so renegotiation can
  only be used with protocols that synchronise with the renegotiation, such as
  HTTPS.
  
  Renegotiation is not defined in TLS 1.3.
  

• SignatureScheme

  Concrete Type v1.0

  SignatureScheme identifies a signature algorithm supported by TLS. See
  RFC 8446, Section 4.2.3.
  

• String

  Receiver for SignatureScheme v1.0

  ([])
  

• arrayOfCertificate

  Concrete Type v1.0

  A Certificate is a chain of one or more certificates, leaf first.
  

• arrayOfCertificateRequestInfo

  Concrete Type v1.0

  CertificateRequestInfo contains information from a server's
  CertificateRequest message, which is used to demand a certificate and proof
  of control from a client.
  

• arrayOfCipherSuite

  Concrete Type v1.0

  CipherSuite is a TLS cipher suite. Note that most functions in this package
  accept and expose cipher suite IDs instead of this type.
  

• arrayOfClientAuthType

  Concrete Type v1.0

  ClientAuthType declares the policy the server will follow for
  TLS Client Authentication.
  

• arrayOfClientHelloInfo

  Concrete Type v1.0

  ClientHelloInfo contains information from a ClientHello message in order to
  guide application logic in the GetCertificate and GetConfigForClient callbacks.
  

• arrayOfClientSessionCache

  Concrete Type v1.0

  ClientSessionCache is a cache of ClientSessionState objects that can be used
  by a client to resume a TLS session with a given server. ClientSessionCache
  implementations should expect to be called concurrently from different
  goroutines. Up to TLS 1.2, only ticket-based resumption is supported, not
  SessionID-based resumption. In TLS 1.3 they were merged into PSK modes, which
  are supported via this interface.
  

• arrayOfClientSessionState

  Concrete Type v1.0

  ClientSessionState contains the state needed by clients to resume TLS
  sessions.
  

• arrayOfConfig

  Concrete Type v1.0

  A Config structure is used to configure a TLS client or server.
  After one has been passed to a TLS function it must not be
  modified. A Config may be reused; the tls package will also not
  modify it.
  

• arrayOfConn

  Concrete Type v1.0

  A Conn represents a secured connection.
  It implements the net.Conn interface.
  

• arrayOfConnectionState

  Concrete Type v1.0

  ConnectionState records basic TLS details about the connection.
  

• arrayOfCurveID

  Concrete Type v1.0

  CurveID is the type of a TLS identifier for an elliptic curve. See
  https://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-8.
  
  In TLS 1.3, this type is called NamedGroup, but at this time this library
  only supports Elliptic Curve based groups. See RFC 8446, Section 4.2.7.
  

• arrayOfDialer

  Concrete Type v1.0

  Dialer dials TLS connections given a configuration and a Dialer for the
  underlying connection.
  

• arrayOfRecordHeaderError

  Concrete Type v1.0

  RecordHeaderError is returned when a TLS record header is invalid.
  

• arrayOfRenegotiationSupport

  Concrete Type v1.0

  RenegotiationSupport enumerates the different levels of support for TLS
  renegotiation. TLS renegotiation is the act of performing subsequent
  handshakes on a connection after the first. This significantly complicates
  the state machine and has been the source of numerous, subtle security
  issues. Initiating a renegotiation is not supported, but support for
  accepting renegotiation requests may be enabled.
  
  Even when enabled, the server may not change its identity between handshakes
  (i.e. the leaf certificate must be the same). Additionally, concurrent
  handshake and application data flow is not permitted so renegotiation can
  only be used with protocols that synchronise with the renegotiation, such as
  HTTPS.
  
  Renegotiation is not defined in TLS 1.3.
  

• arrayOfSignatureScheme

  Concrete Type v1.0

  SignatureScheme identifies a signature algorithm supported by TLS. See
  RFC 8446, Section 4.2.3.