QSslServer - how to ?

[Dariusz]

Hey

So I was about to update my Encrypted-qtcSocket system when I noticed that in Qt 6.4 there is QSslServer ? : O
Now I've never really looked in to ssl encryption/etc. I usually just made my own handshake/message/packet and used that. But now I was wondering if I can skip the "pain" of doing my own handshake & relay on QsslServer/Socket for my security and just use my own packet implementation...

In any case, I'm reading and digging in trying to wrap my head around it.

https://doc-snapshots.qt.io/qt6-6.4/qsslserver.html#details
https://doc.qt.io/qt-6/qsslsocket.html
https://doc.qt.io/qt-6/qsslcertificate.html#details
https://doc.qt.io/qt-6/qsslcipher.html#details

Now I'm not a security expert in Ssl... so I was wondering, does any1 have any experience in it?
I want to run my own QsslServer and connect to it via my QSslSockets, Have it all secured, etc.
Do I need to do anything with Certificates/cipher/securityauthority/etc/etc or is Qt handling it all and I'm having a good day ?
any1?

As a side note, found this talk from 10y ago about certificated (still trying to find the talk/video> https://github.com/richmoore/qt-examples/blob/master/sslcertmonitor3/sslcertificatemonitor.cpp
But not sure if that is relevant with qsslServer?

Regards
Dariusz

[SGaist]

Hi,

No experience yet with that class but from the looks of it, it's drop in replacement for QTcpServer. So I would say that what you will have to take care of is the certificate side. Either use an official provider or if you create your own certificate, be ready to deploy them.

[ThirdStrand]

I have used QSslServer and passed the

QSslCongifuration::defaultSslConfiguration()

value to use it as the configuration data. Seems pretty easy in that respect.

The default SSL configuration consists of:

no local certificate and no private key
protocol SecureProtocols
the system's default CA certificate list
the cipher list equal to the list of the SSL libraries' supported SSL ciphers that are 128 bits or more

Another option is

QSslConfiguration::defaultDtlsConfiguration()

You have full control over certs, keys, etc. in the QSslConfiguration object. Just depends on how detailed you need to get with it. Usually in my case it's a "same host" sort of deal so I just use the default config.