Before you start SSL application development, you should understand
the data structures used for SSL APIs, and the relationships between
the data structures.
SSL APIs use data structures to hold various types of information
about SSL sessions and connections. The most important structures
are SSL_CTX and SSL. Usually,
one SSL_CTX structure exists per SSL application program,
and an SSL structure is created every time a
new SSL connection is created. An SSL structure inherits
configuration information from the SSL_CTX structure
when it is created.
Table 4-1 “APIs for Data Structure Creation and Deallocation” shows the APIs commonly
used for creating and deallocating data structures.
Table 4-1 APIs for Data Structure Creation and Deallocation
|Data Structure||API for Creation||API for Deallocation |
Figure 4-1 “ Relationship Between SSL_CTX and SSL” shows the relationship
between the SSL_CTX and SSL data
Figure 4-1 Relationship Between SSL_CTX and SSL
An SSL structure is created for every SSL
connection in the SSL client or server program. You create the SSL structure
after creating and configuring the SSL_CTX structure
because the SSL structure inherits default values
from the SSL_CTX structure. The inheritance of
the default values enables the SSL structure
to be used without explicit configuration. However, it is possible
to change the inherited values in a specific SSL structure.
An SSL structure saves the addresses of
data structures that store information about SSL connections and sessions.
These data structures are as follows:
The SSL_CTX structure
from which the SSL structure is created
SSL_METHOD (SSL protocol version)
CERT (certificate information
extracted from an X.509 structure)
BIO (an SSL connection is performed
The SSL information (protocol
version, connection status values, and so on) in the SSL structure
is used for the SSL connection. Figure 4-2 “ Structures
Associated with SSL Structure” shows the structures associated with the SSL structure.
Figure 4-2 Structures
Associated with SSL Structure
The SSL_METHOD structure is defined in ssl.h.
An SSL_METHOD structure contains pointers to
the functions that implement the SSL protocol version specified.
This structure must be created before creation of the SSL_CTX structure.
The SSL_CIPHER structure is defined in
the ssl.h header file. An SSL_CIPHER structure
holds information about the cipher suite used for SSL connections
A BIO structure is an I/O abstraction in
an SSL application with SSL APIs. The BIO structure
encapsulates an underlying I/O secured by SSL, and all the communication
between the client and server is conducted through this structure.
The BIO structure is defined in bio.h.