Important:
This is retired content. This content is outdated and is no longer being maintained. It is provided as a courtesy for individuals who are still using these technologies. This content may contain URLs that were valid when originally published, but now link to sites or pages that no longer exist.
A version of this page is also available for
4/8/2010

A deferred handshake enables an application to create an unsecured connection and then later convert it to a connection with a security infrastructure.

To implement secure sockets with a deferred handshake

  1. Create a socket with the socketfunction.

  2. Set the socket in secure mode with setsockopt.

  3. Set levelto SOL_SOCKET, set optnameto SO_SECURE, and set optvalto a DWORDset to SO_SEC_SSL.

  4. Specify the certificate validation callback function by calling WSAIoctlwith the SO_SSL_SET_VALIDATE_CERT_HOOK control code.

  5. To verify the server's identity during the handshake, call WSAIoctlwith the SO_SSL_SET_PEERNAME control code.

    The server name is verified against the server certificate after a successful SSL handshake. The verification results are then indicated in the certificate validation callback. If the specified server name does not match the one indicated in the certificate chain of the SSL Handshake, SSL_CERT_FLAG_ISSUER_UNKNOWN is set in the dwFlags parameter of SslValidateCertHook.

    If you do not perform this step, no verification is performed.

  6. Set the socket in deferred handshake mode with WSAIoctl. The control code should be set to SO_SSL_SET_FLAGS and the flag set to SSL_FLAG_DEFER_HANDSHAKE.

  7. Establish a nonsecure connection with the remote party using connect.

  8. Transmit and receive unencoded data.

  9. To switch to secure mode, call WSAIoctlwith the SO_SSL_PERFORM_HANDSHAKE control code passing in the target server name.

  10. The certificate callback function is automatically called. The handshake is successful only if the callback function verifies the acceptability of the certificate by returning SSL_ERR_OKAY.

  11. Transmit and receive.

  12. The sendand recvfunctions encode and decode the data automatically.

  13. When you are finished, close the socket with closesocket.

See Also