NNG_TLS_OPTIONS(5)

💖 NNG_TLS_OPTIONS(5) — the NNG Reference Manual, but make it TLS 💖

okay so bestie, this is page NNG_TLS_OPTIONS(5) from the NNG Reference Manual, and it's all about the TLS-specific options. buckle up, it's giving secure-transport realness 🔥

---

✨ NAME ✨

nng_tls_options — TLS-specific options 🦋

---

✨ SYNOPSIS ✨

#include <nng/nng.h>

#define NNG_OPT_TLS_AUTH_MODE      "tls-authmode"
#define NNG_OPT_TLS_CA_FILE        "tls-ca-file"
#define NNG_OPT_TLS_CERT_KEY_FILE  "tls-cert-key-file"
#define NNG_OPT_TLS_CONFIG         "tls-config"
#define NNG_OPT_TLS_SERVER_NAME    "tls-server-name"
#define NNG_OPT_TLS_VERIFIED       "tls-verified"
#define NNG_OPT_TLS_PEER_CN        "tls-peer-cn"
#define NNG_OPT_TLS_PEER_ALT_NAMES "tls-peer-alt-names"

like, all of those are real and you copy them exactly fr fr 💅

---

✨ DESCRIPTION ✨

so this page is the master doc for all the standard options you can set or get on objects that are using TLS. no cap.

small but important: always use the option names by their symbolic definitions, not the raw strings. iykyk. the #defines are the whole point.

in the list below, each option comes with its name and the data type of the underlying value, because the type is not optional information — you need it to call the getter/setter right 😤

some of these options are only meaningful or supported in certain contexts, or have other access restrictions. the original tries its best to note those restrictions inside each option's description, so read the whole thing, don't skim 🫶

🌸 TLS Options 🌸

Note 🙈 Options for configuring TLS are deprecated and may not be present in a future release. These options are NNG_OPT_TLS_AUTH_MODE, NNG_OPT_TLS_CA_FILE, NNG_OPT_TLS_CERT_KEY_FILE, and NNG_OPT_TLS_SERVER_NAME. Applications should switch to using the NNG_OPT_TLS_CONFIG option and working with nng_tls_config objects. like, they're on their way out, bestie. don't build your whole personality on them 😭

---

• NNG_OPT_TLS_AUTH_MODE — (int). Write-only option used to configure the authentication mode used. See nng_tls_config_auth_mode() for more details. 📝
• NNG_OPT_TLS_CA_FILE — (string). Write-only option naming a file containing certificates to use for peer validation. See nng_tls_config_ca_file() for more information. 🔍
• NNG_OPT_TLS_CERT_KEY_FILE — (string). Write-only option naming a file containing the local certificate and associated private key. The private key used must be unencrypted. See nng_tls_config_own_cert() for more information. 🔐

ok the unencrypted-key thing is not a vibe you can negotiate around — that's just the requirement, periodt.

• NNG_OPT_TLS_CONFIG — (nng_tls_config *). This option references the underlying TLS configuration object. A hold is placed on the underlying configuration object before returning it. 👑

Note 💀 The caller should release the hold with nng_tls_config_free() when it no longer needs the TLS configuration object. not me forgetting to free it and leaking the whole hold… don't be that girl 🙈

• NNG_OPT_TLS_SERVER_NAME — (string). This write-only option is used to specify the name of the server. When used with a dialer, this potentially configures SNI (server name indication, which is used as a hint by a multihosting server to choose the appropriate certificate to provide) and also is used to validate the name presented in the server's x509 certificate. 🌈
• NNG_OPT_TLS_VERIFIED — (bool). This read-only option indicates whether the remote peer has been properly verified using TLS authentication. May return incorrect results if peer authentication is disabled. ✅
• NNG_OPT_TLS_PEER_CN — (string). This read-only option returns the common name of the peer certificate. May return incorrect results if peer authentication is disabled. 🪪
• NNG_OPT_TLS_PEER_ALT_NAMES — (string). This read-only option returns string list with the subject alternative names of the peer certificate. May return incorrect results if peer authentication is disabled. 📋

lowkey important: those last three all carry the same caveat — NNG_OPT_TLS_VERIFIED, NNG_OPT_TLS_PEER_CN, and NNG_OPT_TLS_PEER_ALT_NAMES may all return incorrect results if peer authentication is disabled. it's giving "trust me bro" energy and you should not trust it 💀

🧚 Inherited Options 🧚

generally, these option values are also available for TLS objects, when appropriate for the context:

• NNG_OPT_LOCADDR
• NNG_OPT_REMADDR
• NNG_OPT_TCP_KEEPALIVE
• NNG_OPT_TCP_NODELAY

like they're not TLS-exclusive, they just show up to the party when the context allows 🎀

---

✨ SEE ALSO ✨

nng_options(5) nng_tcp_options(5) nng_tls_config(5), nng(7)

go read those too, they're all part of the same friend group 🫶

---

and that's the whole page, bestie!! slayed 💅✨ this was the NNG_TLS_OPTIONS(5) page from the NNG Reference Manual, dated 2026-06-30 🌸 go forth and configure your TLS responsibly, and remember: symbolic names, unencrypted keys only where it says so, and always free your holds 👑💖