NNG_TLS_CONFIG_CA_CHAIN(3tls)

💖 nng_tls_config_ca_chain — the NNG Reference Manual, but make it a group chat 💖

okay bestie, pull up a chair because we're configuring certificate authority chains and honestly? it's giving trust issues but make them cryptographic 🎀

---

✨ NAME ✨

nng_tls_config_ca_chain — configure certificate authority certificate chain 💅

---

🌸 SYNOPSIS 🌸

#include <nng/nng.h>
#include <nng/supplemental/tls/tls.h>

int nng_tls_config_ca_chain(nng_tls_config *cfg, const char *chain, const char *crl);

---

🦋 DESCRIPTION 🦋

so the way that nng_tls_config_ca_chain() works is: it sets up a certificate, or a whole certificate chain, that gets used to validate peers — and it does that using the configuration cfg. like, this is the "who do I actually trust" list, no cap. 👑

Note — bestie, if you're running the authentication mode NNG_TLS_AUTH_MODE_REQUIRED, you must configure certificates. it's not optional, it's the vibe check. not having them configured = no trust = no handshake. 😭

Tip — you can call this function multiple times to add more chains to a configuration, and it will not mess with the ones you added before. stacking trust like it's layer cake 🍓

the certificates sitting in chain have to be a zero-terminated C string in PEM format (PEM = the format in [RFC 7468](https://tools.ietf.org/html/rfc7468), iykyk). and here's the part people fumble: you can concatenate multiple certificates together in that one string, and the leaf certificate goes first. leaf. first. periodt. 🌈

the crl is allowed to be NULL. OR it can be a C string holding a PEM format certificate revocation list for the associated authority — that's the "these specific certs are cancelled, actually" list 💀

---

🧚 RETURN VALUES 🧚

• returns 0 when it slays (success) ✨
• returns non-zero otherwise (it did not slay) 🙈

---

💜 ERRORS 💜

• NNG_ENOMEM — there's just not enough memory available. the RAM said "I'm full bestie". 😔
• NNG_EBUSY — the configuration cfg is already in use, so it literally cannot be modified. like, hands off, it's busy being a main character 🔥
• NNG_EINVAL — an invalid chain or crl was supplied. you handed it something it can't work with. 🙅

---

🫶 SEE ALSO 🫶

• nng_strerror(3)
• nng_tls_config_alloc(.3tls)
• nng_tls_config_auth_mode(.3tls)
• nng_tls_config_ca_file(.3tls)
• nng(7)

---

and that's the whole page, bestie 🎀 go forth and configure your CA chain, you've got this, it's literally your era 👑💖

sign-off szn: this iconic little page comes from the NNG Reference Manual, and it's dated 2026-06-30. keep it close, memo it, screenshot it, whatever — just don't lose the date, that's the lore ⭐💅