# Secure Transport Secure network communication using standardized transport layer security mechanisms. ## Overview The `Security.SecureTransport` API gives you access to Apple’s implementation of Secure Sockets Layer version 3.0 (SSLv3), Transport Layer Security (TLS) versions 1.0 through 1.2, and Datagram Transport Layer Security (DTLS) version 1.0. This API imposes no transport layer dependencies. You can use it with BSD Sockets and other protocols. To use this API, you provide callback functions to perform I/O on the underlying network connections. You are also responsible for setting up raw network connections. You pass in an opaque reference to the underlying (connected) entity at the start of an SSL session in the form of an [`SSLConnectionRef`](/documentation/Security/SSLConnectionRef) object. > Important: > This API is considered legacy. Use the framework instead. ## Topics ### First Steps [Using the Secure Socket Layer for Network Communication](/documentation/Security/using-the-secure-socket-layer-for-network-communication) Establish Secure Sockets Layer (SSL) sessions to facilitate secure communication between client and server. ### Session Context [`SSLCreateContext(_:_:_:)`](/documentation/Security/SSLCreateContext(_:_:_:)) Allocates and returns a new context. [`SSLProtocolSide`](/documentation/Security/SSLProtocolSide) The flags that indicate whether a context is for the server or client side of a connection. [`SSLConnectionType`](/documentation/Security/SSLConnectionType) The flags that indicate whether a context is to be used for streaming or datagram-based communication. [`SSLContext`](/documentation/Security/SSLContext) An opaque type that represents an SSL session context object. [`SSLContextGetTypeID()`](/documentation/Security/SSLContextGetTypeID()) Returns the Core Foundation type ID for context objects. ### Context Options [`SSLSetSessionOption(_:_:_:)`](/documentation/Security/SSLSetSessionOption(_:_:_:)) Specifies options for a specific session. [`SSLGetSessionOption(_:_:_:)`](/documentation/Security/SSLGetSessionOption(_:_:_:)) Indicates the current setting of Secure Sockets Layer (SSL) session options. [`SSLSessionOption`](/documentation/Security/SSLSessionOption) The options that can be set for an SSL session. ### Context Callbacks [`SSLSetIOFuncs(_:_:_:)`](/documentation/Security/SSLSetIOFuncs(_:_:_:)) Specifies callback functions that perform the network I/O operations. [`SSLReadFunc`](/documentation/Security/SSLReadFunc) A pointer to a customized read function that secure transport calls to read data from the connection. [`SSLWriteFunc`](/documentation/Security/SSLWriteFunc) A pointer to a customized write function that secure transport calls to write data to the connection. ### Session Configuration [`SSLSetSessionConfig(_:_:)`](/documentation/Security/SSLSetSessionConfig(_:_:)) Sets a predefined configuration for the Secure Sockets Layer (SSL) session. [`SSLSetClientSideAuthenticate(_:_:)`](/documentation/Security/SSLSetClientSideAuthenticate(_:_:)) Specifies the requirements for client-side authentication. [SSLConfig](/documentation/Security/sslconfig) Use these constants to configure Transport Layer Security (TLS) sessions. [`SSLAuthenticate`](/documentation/Security/SSLAuthenticate) The flags that represent the requirements for client-side authentication. ### I/O Connections [`SSLSetConnection(_:_:)`](/documentation/Security/SSLSetConnection(_:_:)) Specifies an I/O connection for a specific session. [`SSLGetConnection(_:_:)`](/documentation/Security/SSLGetConnection(_:_:)) Retrieves an I/O connection—such as a socket or endpoint—for a specific session. [`SSLConnectionRef`](/documentation/Security/SSLConnectionRef) A pointer to an opaque I/O connection object. ### Session State [`SSLHandshake(_:)`](/documentation/Security/SSLHandshake(_:)) Performs the SSL handshake. [`SSLReHandshake(_:)`](/documentation/Security/SSLReHandshake(_:)) Requests renegotiation of the SSL handshake. Server only. [`SSLClose(_:)`](/documentation/Security/SSLClose(_:)) Terminates the current SSL session. [`SSLSetPeerID(_:_:_:)`](/documentation/Security/SSLSetPeerID(_:_:_:)) Specifies data that is sufficient to uniquely identify the peer of the current session. [`SSLGetPeerID(_:_:_:)`](/documentation/Security/SSLGetPeerID(_:_:_:)) Retrieves the current peer ID data. [`SSLGetSessionState(_:_:)`](/documentation/Security/SSLGetSessionState(_:_:)) Retrieves the state of an SSL session. [`SSLSessionState`](/documentation/Security/SSLSessionState) The flags that represent the state of an SSL session. [`SSLSetError(_:_:)`](/documentation/Security/SSLSetError(_:_:)) Sets the status of a session context. ### Read Operations [`SSLRead(_:_:_:_:)`](/documentation/Security/SSLRead(_:_:_:_:)) Performs a normal application-level read operation. [`SSLGetBufferedReadSize(_:_:)`](/documentation/Security/SSLGetBufferedReadSize(_:_:)) Determines how much data is available to be read. ### Write Operations [`SSLWrite(_:_:_:_:)`](/documentation/Security/SSLWrite(_:_:_:_:)) Performs a typical application-level write operation. [`SSLGetDatagramWriteSize(_:_:)`](/documentation/Security/SSLGetDatagramWriteSize(_:_:)) Provides the largest packet that the OS guarantees it can send without fragmentation. [`SSLGetMaxDatagramRecordSize(_:_:)`](/documentation/Security/SSLGetMaxDatagramRecordSize(_:_:)) Obtains the maximum datagram record size allowed by the application for a given context. [`SSLSetMaxDatagramRecordSize(_:_:)`](/documentation/Security/SSLSetMaxDatagramRecordSize(_:_:)) Sets the maximum datagram record size allowed by the application for a given context. [`SSLSetDatagramHelloCookie(_:_:_:)`](/documentation/Security/SSLSetDatagramHelloCookie(_:_:_:)) Sets the cookie value used in the Datagram Transport Layer Security (DTLS) hello message. ### The Peer Domain Name [`SSLSetPeerDomainName(_:_:_:)`](/documentation/Security/SSLSetPeerDomainName(_:_:_:)) Specifies the fully qualified domain name of the peer. [`SSLGetPeerDomainNameLength(_:_:)`](/documentation/Security/SSLGetPeerDomainNameLength(_:_:)) Determines the length of a previously set peer domain name. [`SSLGetPeerDomainName(_:_:_:)`](/documentation/Security/SSLGetPeerDomainName(_:_:_:)) Retrieves the peer domain name specified previously. [`SSLCopyRequestedPeerName(_:_:_:)`](/documentation/Security/SSLCopyRequestedPeerName(_:_:_:)) Determines the buffer size needed for the peer domain name. [`SSLCopyRequestedPeerNameLength(_:_:)`](/documentation/Security/SSLCopyRequestedPeerNameLength(_:_:)) Obtains the hostname specified by the client in the ServerName extension (SNI). Server only. ### Versions [`SSLSetProtocolVersionMax(_:_:)`](/documentation/Security/SSLSetProtocolVersionMax(_:_:)) Sets the maximum protocol version allowed by the application for a given SSL context. [`SSLSetProtocolVersionMin(_:_:)`](/documentation/Security/SSLSetProtocolVersionMin(_:_:)) Sets the minimum protocol version allowed by the application for a given SSL context. [`SSLGetProtocolVersionMax(_:_:)`](/documentation/Security/SSLGetProtocolVersionMax(_:_:)) Gets the maximum protocol version allowed by the application for a given SSL context. [`SSLGetProtocolVersionMin(_:_:)`](/documentation/Security/SSLGetProtocolVersionMin(_:_:)) Gets the minimum protocol version allowed by the application for a given SSL context. [`SSLGetNegotiatedProtocolVersion(_:_:)`](/documentation/Security/SSLGetNegotiatedProtocolVersion(_:_:)) Obtains the negotiated protocol version of the active session. [`tls_protocol_version_t`](/documentation/Security/tls_protocol_version_t) The collection of supported TLS and DTLS versions. [`SSLProtocol`](/documentation/Security/SSLProtocol) An enumeration of valid SSL protocol versions. ### Application Layer Protocols [`SSLCopyALPNProtocols(_:_:)`](/documentation/Security/SSLCopyALPNProtocols(_:_:)) Gets the list of supported application layer protocols. [`SSLSetALPNProtocols(_:_:)`](/documentation/Security/SSLSetALPNProtocols(_:_:)) Sets the list of supported applicaiton layer protocols. ### Ciphers [`SSLGetNumberSupportedCiphers(_:_:)`](/documentation/Security/SSLGetNumberSupportedCiphers(_:_:)) Determines the number of cipher suites supported. [`SSLGetSupportedCiphers(_:_:_:)`](/documentation/Security/SSLGetSupportedCiphers(_:_:_:)) Determines the values of the supported cipher suites. [`SSLSetEnabledCiphers(_:_:_:)`](/documentation/Security/SSLSetEnabledCiphers(_:_:_:)) Specifies a restricted set of SSL cipher suites to be enabled by the current SSL session context. [`SSLGetNumberEnabledCiphers(_:_:)`](/documentation/Security/SSLGetNumberEnabledCiphers(_:_:)) Determines the number of cipher suites currently enabled. [`SSLGetEnabledCiphers(_:_:_:)`](/documentation/Security/SSLGetEnabledCiphers(_:_:_:)) Determines which SSL cipher suites are currently enabled. [`SSLGetNegotiatedCipher(_:_:)`](/documentation/Security/SSLGetNegotiatedCipher(_:_:)) Retrieves the cipher suite negotiated for this session. [`SSLSetDiffieHellmanParams(_:_:_:)`](/documentation/Security/SSLSetDiffieHellmanParams(_:_:_:)) Specifies Diffie-Hellman parameters for a given context. [`SSLGetDiffieHellmanParams(_:_:_:)`](/documentation/Security/SSLGetDiffieHellmanParams(_:_:_:)) Retrieves the Diffie-Hellman parameters for a given context. [`tls_ciphersuite_group_t`](/documentation/Security/tls_ciphersuite_group_t) Groups that collect ciphersuites of comparable security properties. [`tls_ciphersuite_t`](/documentation/Security/tls_ciphersuite_t) The collection of valid ciphersuites. [`SSLCipherSuite`](/documentation/Security/SSLCipherSuite) A type for storing cipher suite values. [`SSLCiphersuiteGroup`](/documentation/Security/SSLCiphersuiteGroup) A mechanism for grouping related cipher suites. [SSL Cipher Suite Values](/documentation/Security/ssl-cipher-suite-values) Recognize the set of valid SSL cipher suite values. ### Root Certificates [`SSLSetCertificateAuthorities(_:_:_:)`](/documentation/Security/SSLSetCertificateAuthorities(_:_:_:)) Adds one or more certificates to a server’s list of certification authorities (CAs) acceptable for client authentication. [`SSLCopyCertificateAuthorities(_:_:)`](/documentation/Security/SSLCopyCertificateAuthorities(_:_:)) Retrieves the current list of certification authorities. ### Authentication [`SSLAddDistinguishedName(_:_:_:)`](/documentation/Security/SSLAddDistinguishedName(_:_:_:)) Adds a DER-encoded distinguished name to a list of acceptable names to be specified in requests for client certificates. [`SSLCopyDistinguishedNames(_:_:)`](/documentation/Security/SSLCopyDistinguishedNames(_:_:)) Retrieves the distinguished names of acceptable certification authorities. [`SSLSetCertificate(_:_:)`](/documentation/Security/SSLSetCertificate(_:_:)) Specifies this connection’s certificate or certificates. [`SSLGetClientCertificateState(_:_:)`](/documentation/Security/SSLGetClientCertificateState(_:_:)) Retrieves the exchange status of the client certificate. [`SSLCopyPeerTrust(_:_:)`](/documentation/Security/SSLCopyPeerTrust(_:_:)) Retrieves a trust management object for the certificate used by a session. [`SSLClientCertificateState`](/documentation/Security/SSLClientCertificateState) An enumeration of the states of client certificate exchange. [`SSLSetOCSPResponse(_:_:)`](/documentation/Security/SSLSetOCSPResponse(_:_:)) Sets the OCSP response for the given SSL session. [`SSLSetSessionTicketsEnabled(_:_:)`](/documentation/Security/SSLSetSessionTicketsEnabled(_:_:)) Enables or disables session ticket resumption. ### Result Codes [Secure Transport Result Codes](/documentation/Security/secure-transport-result-codes) Recognize result codes specific to the secure transport API. ### Legacy Operations [`SSLNewContext`](/documentation/Security/SSLNewContext) Creates a new Secure Sockets Layer (SSL) session context. [`SSLDisposeContext`](/documentation/Security/SSLDisposeContext) Disposes of a Secure Sockets Layer (SSL) session context. [`SSLSetProtocolVersionEnabled`](/documentation/Security/SSLSetProtocolVersionEnabled) Sets the allowed Secure Sockets Layer (SSL) protocol versions. [`SSLGetProtocolVersionEnabled`](/documentation/Security/SSLGetProtocolVersionEnabled) Retrieves the enabled status of a given protocol. [`SSLSetRsaBlinding`](/documentation/Security/SSLSetRsaBlinding) Enables or disables RSA blinding. [`SSLGetRsaBlinding`](/documentation/Security/SSLGetRsaBlinding) Obtains a value indicating whether RSA blinding is enabled. [`SSLSetProtocolVersion`](/documentation/Security/SSLSetProtocolVersion) Sets the SSL protocol version. [`SSLGetProtocolVersion`](/documentation/Security/SSLGetProtocolVersion) Gets the SSL protocol version. [`SSLSetAllowsAnyRoot`](/documentation/Security/SSLSetAllowsAnyRoot) Specifies whether root certificates from unrecognized certification authorities are allowed. [`SSLGetAllowsAnyRoot`](/documentation/Security/SSLGetAllowsAnyRoot) Obtains a value specifying whether an unknown root is allowed. [`SSLSetAllowsExpiredRoots`](/documentation/Security/SSLSetAllowsExpiredRoots) Specifies whether expired root certificates are allowed. [`SSLGetAllowsExpiredRoots`](/documentation/Security/SSLGetAllowsExpiredRoots) Retrieves the value indicating whether expired roots are allowed. [`SSLSetTrustedRoots`](/documentation/Security/SSLSetTrustedRoots) Augments or replaces the default set of trusted root certificates for this session. [`SSLCopyTrustedRoots`](/documentation/Security/SSLCopyTrustedRoots) Retrieves the current list of trusted root certificates. [`SSLSetAllowsExpiredCerts`](/documentation/Security/SSLSetAllowsExpiredCerts) Specifies whether certificate expiration times are ignored. [`SSLGetAllowsExpiredCerts`](/documentation/Security/SSLGetAllowsExpiredCerts) Retrieves the value specifying whether expired certificates are allowed. [`SSLSetEnableCertVerify`](/documentation/Security/SSLSetEnableCertVerify) Enables or disables peer certificate chain validation. [`SSLGetEnableCertVerify`](/documentation/Security/SSLGetEnableCertVerify) Determines whether peer certificate chain validation is currently enabled. [`SSLSetEncryptionCertificate(_:_:)`](/documentation/Security/SSLSetEncryptionCertificate(_:_:)) Specifies the encryption certificates used for this connection. [`SSLCopyPeerCertificates`](/documentation/Security/SSLCopyPeerCertificates) Retrieves a peer certificate and its certificate chain. --- Copyright © 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)