GnuTLS ¶

This manual is last updated 29 April 2026 for version 3.8.13 of GnuTLS.

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is included in the section entitled “GNU Free Documentation License”.

1 Preface
2 Introduction to GnuTLS
- 2.1 Downloading and installing
- 2.2 Installing for a software distribution
- 2.3 Overview
3 Introduction to TLS and DTLS
- 3.1 TLS Layers
- 3.2 The Transport Layer
- 3.3 The TLS record protocol
- 3.4 The TLS alert protocol
- 3.5 The TLS handshake protocol
- 3.6 TLS extensions
- 3.7 How to use TLS in application protocols
  - 3.7.1 Separate ports
  - 3.7.2 Upward negotiation
- 3.8 On SSL 2 and older protocols
4 Authentication methods
- 4.1 Certificate authentication
- 4.2 More on certificate authentication
- 4.3 Shared-key and anonymous authentication
- 4.4 Selecting an appropriate authentication method
5 Abstract key types and Hardware security modules
- 5.1 Abstract key types
- 5.2 System and application-specific keys
  - 5.2.1 System-specific keys
  - 5.2.2 Application-specific keys
- 5.3 Smart cards and HSMs
- 5.4 Trusted Platform Module (TPM)
6 How to use GnuTLS in applications
- 6.1 Introduction
- 6.2 Preparation
- 6.3 Session initialization
- 6.4 Associating the credentials
- 6.5 Setting up the transport layer
- 6.6 TLS handshake
- 6.7 Data transfer and termination
- 6.8 Buffered data transfer
- 6.9 Handling alerts
- 6.10 Priority strings
- 6.11 Selecting cryptographic key sizes
- 6.12 Advanced topics
7 GnuTLS application examples
- 7.1 Client examples
- 7.2 Server examples
  - 7.2.1 Echo server with X.509 authentication
  - 7.2.2 DTLS echo server with X.509 authentication
- 7.3 More advanced client and servers
- 7.4 OCSP example
- 7.5 Miscellaneous examples
8 System-wide configuration of the library
- 8.1 Application-specific priority strings
- 8.2 Disabling algorithms and protocols
  - 8.2.1 Examples
- 8.3 Querying for disabled algorithms and protocols
- 8.4 Overriding the parameter verification profile
- 8.5 Overriding the default priority string
- 8.6 Enabling TLS certificate compression
- 8.7 Enabling/Disabling system/acceleration protocols
  - 8.7.1 Enabling kTLS
- 8.8 Enabling/Disabling RSAES-PKCS1-v1_5
- 8.9 Using PKCS#11 module as cryptographic backend
  - 8.9.1 Examples
9 Using GnuTLS as a cryptographic library
- 9.1 Symmetric algorithms
- 9.2 Public key algorithms
  - 9.2.1 Key generation
- 9.3 Cryptographic Message Syntax / PKCS7
- 9.4 Hybrid Public Key Encryption
- 9.5 Hash and MAC functions
- 9.6 Random number generation
- 9.7 Overriding algorithms
10 Other included programs
11 Internal Architecture of GnuTLS
- 11.1 The TLS Protocol
- 11.2 TLS Handshake Protocol
- 11.3 TLS Authentication Methods
- 11.4 TLS Extension Handling
- 11.5 Cryptographic Backend
- 11.6 Random Number Generators
- 11.7 FIPS140-2 mode
Appendix A Upgrading from previous versions
Appendix B Support
- B.1 Getting Help
- B.2 Commercial Support
- B.3 Bug Reports
- B.4 Contributing
- B.5 Certification
Appendix C Error Codes and Descriptions
Appendix D Supported Ciphersuites
Appendix E API reference
- E.1 Core TLS API
- E.2 Datagram TLS API
- E.3 X.509 certificate API
- E.4 PKCS 7 API
- E.5 OCSP API
- E.6 PKCS 12 API
- E.7 Hardware token via PKCS 11 API
- E.8 TPM API
- E.9 Abstract key API
- E.10 Socket specific API
- E.11 DANE API
- E.12 HPKE API
- E.13 Cryptographic API
- E.14 Compatibility API
Appendix F Copying Information
Appendix G Additional Features
- G.1 kTLS (Kernel TLS)
Bibliography
Function and Data Index
Concept Index

GnuTLS ¶

Table of Contents