Hacker News Reader

> we were able to make some legacy apps use SSL/TLS without adding any code at all

How did you deal with certificate validation?

This[0] seems to answer your questions.

TL;DR: The kernel does it all and passes the unencrypted traffic to the local port specified. There's a command to configure it with the appropriate keys, etc.

[0] http://www.c0t0d0s0.org/archives/5575-Less-known-Solaris-Fea...

Sounds like nginx streams - http://nginx.org/en/docs/stream/ngx_stream_core_module.html . Really useful if you need TLS but the author of whatever you are running couldn't be bothered by adding support (includes being able to do client certificate auth!).

So, the same API semantics as IPSec transport mode, but not using IPSec. Seems like the best of both worlds, really.

Well the app didn't care - we had self signed certs (actually internal CA signed IIRC) that we had to feed to the kernel ssl module using the ksslconfig commands.

Edit: @Mister_Snuggles points to a link below if you wanted to run through the whole process.

Reply on news.ycombinator.com