Network.Wai.Handler.WarpTLS

HTTP over TLS support for Warp via the TLS package.

If HTTP/2 is negotiated by ALPN, HTTP/2 over TLS is used. Otherwise HTTP/1.1 over TLS is used.

Support for SSL is now obsoleted.

Runner

runTLS :: TLSSettings -> Settings -> Application -> IO ()

Running Application with TLSSettings and Settings.

runTLSSocket :: TLSSettings -> Settings -> Socket -> Application -> IO ()

Running Application with TLSSettings and Settings using specified Socket.

Settings

data TLSSettings

Settings for WarpTLS.

defaultTlsSettings :: TLSSettings

Default TLSSettings. Use this to create TLSSettings with the field record name (aka accessors).

Smart constructors

From files

tlsSettings

Arguments

:: FilePath

Certificate file

-> FilePath

Key file

-> TLSSettings

A smart constructor for TLSSettings based on defaultTlsSettings.

tlsSettingsChain

Arguments

:: FilePath

Certificate file

-> [FilePath]

Chain certificate files

-> FilePath

Key file

-> TLSSettings

A smart constructor for TLSSettings that allows specifying chain certificates based on defaultTlsSettings.

Since 3.0.3

From memory

tlsSettingsMemory

Arguments

:: ByteString

Certificate bytes

-> ByteString

Key bytes

-> TLSSettings

A smart constructor for TLSSettings, but uses in-memory representations of the certificate and key based on defaultTlsSettings.

Since 3.0.1

tlsSettingsChainMemory

Arguments

:: ByteString

Certificate bytes

-> [ByteString]

Chain certificate bytes

-> ByteString

Key bytes

-> TLSSettings

A smart constructor for TLSSettings, but uses in-memory representations of the certificate and key based on defaultTlsSettings.

Since 3.0.3

From references

tlsSettingsRef

Arguments

:: IORef ByteString

Reference to certificate bytes

-> IORef ByteString

Reference to key bytes

-> TLSSettings

A smart constructor for TLSSettings, but uses references to in-memory representations of the certificate and key based on defaultTlsSettings.

Since: 3.3.0

tlsSettingsChainRef

Arguments

:: IORef ByteString

Reference to certificate bytes

-> [IORef ByteString]

Reference to chain certificate bytes

-> IORef ByteString

Reference to key bytes

-> TLSSettings

A smart constructor for TLSSettings, but uses references to in-memory representations of the certificate and key based on defaultTlsSettings.

Since: 3.3.0

data CertSettings

Determines where to load the certificate, chain certificates, and key from.

Accessors

tlsCredentials :: TLSSettings -> Maybe Credentials

Specifying Credentials directly. If this value is specified, other fields such as certFile are ignored.

Since 3.2.12

tlsLogging :: TLSSettings -> Logging

The level of logging to turn on.

Default: defaultLogging.

Since 1.4.0

tlsAllowedVersions :: TLSSettings -> [Version]

The TLS versions this server accepts.

>>> tlsAllowedVersions defaultTlsSettings
[TLS13,TLS12,TLS11,TLS10]

Since 1.4.2

tlsCiphers :: TLSSettings -> [Cipher]

The TLS ciphers this server accepts.

>>> tlsCiphers defaultTlsSettings
[ECDHE-ECDSA-AES256GCM-SHA384,ECDHE-ECDSA-AES128GCM-SHA256,ECDHE-RSA-AES256GCM-SHA384,ECDHE-RSA-AES128GCM-SHA256,DHE-RSA-AES256GCM-SHA384,DHE-RSA-AES128GCM-SHA256,ECDHE-ECDSA-AES256CBC-SHA384,ECDHE-RSA-AES256CBC-SHA384,DHE-RSA-AES256-SHA256,ECDHE-ECDSA-AES256CBC-SHA,ECDHE-RSA-AES256CBC-SHA,DHE-RSA-AES256-SHA1,RSA-AES256GCM-SHA384,RSA-AES256-SHA256,RSA-AES256-SHA1,AES128GCM-SHA256,AES256GCM-SHA384]

Since 1.4.2

tlsWantClientCert :: TLSSettings -> Bool

Whether or not to demand a certificate from the client. If this is set to True, you must handle received certificates in a server hook or all connections will fail.

>>> tlsWantClientCert defaultTlsSettings
False

Since 3.0.2

tlsServerHooks :: TLSSettings -> ServerHooks

The server-side hooks called by the tls package, including actions to take when a client certificate is received. See the Network.TLS module for details.

Default: def

Since 3.0.2

tlsServerDHEParams :: TLSSettings -> Maybe DHParams

Configuration for ServerDHEParams more function lives in crypton package

Default: Nothing

Since 3.2.2

tlsSessionManagerConfig :: TLSSettings -> Maybe Config

Configuration for in-memory TLS session manager. If Nothing, noSessionManager is used. Otherwise, an in-memory TLS session manager is created according to Config.

Default: Nothing

Since 3.2.4

tlsSessionManager :: TLSSettings -> Maybe SessionManager

Specifying SessionManager directly. If this value is specified, tlsSessionManagerConfig is ignored.

Since 3.2.12

onInsecure :: TLSSettings -> OnInsecure

Do we allow insecure connections with this server as well?

>>> onInsecure defaultTlsSettings
DenyInsecure "This server only accepts secure HTTPS connections."

Since 1.4.0

data OnInsecure

An action when a plain HTTP comes to HTTP over TLS/SSL port.

Constructors

DenyInsecure ByteString

AllowInsecure

Instances

Show OnInsecure

Defined in Network.Wai.Handler.WarpTLS.Internal

Methods

showsPrec :: Int -> OnInsecure -> ShowS

show :: OnInsecure -> String

showList :: [OnInsecure] -> ShowS

Exception

data WarpTLSException

Constructors

InsecureConnectionDenied

ClientClosedConnectionPrematurely

Instances

Exception WarpTLSException

Defined in Network.Wai.Handler.WarpTLS

Methods

toException :: WarpTLSException -> SomeException

fromException :: SomeException -> Maybe WarpTLSException

displayException :: WarpTLSException -> String

Show WarpTLSException

Defined in Network.Wai.Handler.WarpTLS

Methods

showsPrec :: Int -> WarpTLSException -> ShowS

show :: WarpTLSException -> String

showList :: [WarpTLSException] -> ShowS