NNG_TLS(7)

💖 nng_tls — the TLS transport, bestie edition 💖

okay so this is nng_tls(7), straight out of the NNG Reference Manual, and it's literally the glow-up your plain TCP was waiting for. she's giving secure, she's giving encrypted, she's giving main character energy. let's get into it. ✨

---

✨ NAME ✨

nng_tls — the TLS transport 🦋

---

🌸 SYNOPSIS 🌸

#include <nng/transport/tls/tls.h>

int nng_tls_register(void);

---

👑 DESCRIPTION 👑

okay so the tls transport is what lets peers ~communicate~ with each other across a TCP/IP network using TLS v1.2 (that's <https://tools.ietf.org/html/rfc5246>, iykyk) sitting right on top of good old TCP (<https://tools.ietf.org/html/rfc793>). Both IPv4 and IPv6 are supported — but only when the underlying platform also supports it, so vibe check your platform first. 💅

the protocol details are documented in TLS Mapping for Scalability Protocols over at <http://nanomsg.org/rfcs/sp-tls-v1.html> if you want the full lore. 📖

🎀 Registration

depending on how the library was built, it may be necessary to register the transport by calling nng_tls_register(). so like... sometimes you gotta introduce yourself first, no cap.

🔥 Availability

the tls transport depends on an external library, bestie. as of this writing, mbedTLS (<https://tls.mbed.org/>) version 2.0 or later is required. no mbedTLS, no vibe.

✨ Tip: applications may need to add this library (or libraries) to their link line, particularly when using a statically built library. don't forget her, she's part of the group chat.

💀 Note: the mbedTLS library uses different licensing terms than NNG itself. as of this writing it's offered under either the Apache License 2.0 (<https://opensource.org/licenses/Apache-2.0>) or GNU GPL (<https://opensource.org/licenses/gpl-license>) terms. You are responsible for understanding and adhering to the license terms of any libraries you use. fr fr, read the licenses, it's not optional.

🌈 URI Format

this transport uses URIs using the scheme tls+tcp://, followed by an IP address or hostname, followed by a colon, and finally a TCP port number. the whole thing is like a little address sandwich. 🥪

so for example, to contact port 4433 on the localhost, either of these URIs could be used: tls+tcp://127.0.0.1:4433 or tls+tcp://localhost:4433. either one, she ate. 💅

a URI may be restricted to IPv6 using the scheme tls+tcp6://, and may be restricted to IPv4 using the scheme tls+tcp4://.

🫶 Note: specifying tls+tcp6:// may not prevent IPv4 hosts from being used with IPv4-in-IPv6 addresses, particularly when using a wildcard hostname with listeners. the details of this varies across operating systems. so like, it's giving "restricted" but it's not fully committed. 😭

👑 Note: both tls+tcp6:// and tls+tcp4:// are specific to NNG, and may not be understood by other implementations. they're NNG-exclusive, no gatekeeping.

✨ Tip: we recommend using either numeric IP addresses, or names that are specific to either IPv4 or IPv6, to prevent confusion and surprises. be unambiguous, bestie.

when specifying IPv6 addresses, the address must be enclosed in square brackets ([]) — otherwise the final colon that separates the port gets all confusing and messy.

for example, the same port 4433 on the IPv6 loopback address ('::1') would be specified as tls+tcp://[::1]:4433. brackets. iconic. 🌸

🎀 Tip: certificate validation generally works when using names rather than IP addresses. this transport automatically uses the name supplied in the URL when validating the certificate supplied by the server. so names = happy certs. ✨

the special value of 0 (INADDR_ANY) can be used for a listener to indicate that it should listen on all interfaces on the host. a short-hand for this form is to either omit the address, or specify the asterisk (*) character. for example, the following three URIs are all equivalent, and could be used to listen to port 9999 on the host:

1. tls+tcp://0.0.0.0:9999
2. tls+tcp://*:9999
3. tls+tcp://:9999

the entire URI must be less than NNG_MAXADDRLEN bytes long. respect the limit, she has boundaries. 💅

🦋 Socket Address

when using an nng_sockaddr structure, the actual structure is either of type nng_sockaddr_in (for IPv4) or nng_sockaddr_in6 (for IPv6). pick your fighter. ⭐

💜 Transport Options

the following transport options are available. note that setting these must be done before the transport is started. so like, before the party starts, not during. 🎉

• NNG_OPT_LOCADDR
• NNG_OPT_REMADDR
• NNG_OPT_TCP_KEEPALIVE
• NNG_OPT_TCP_NODELAY
• NNG_OPT_TLS_AUTH_MODE
• NNG_OPT_TLS_CA_FILE
• NNG_OPT_TLS_CERT_KEY_FILE
• NNG_OPT_TLS_CONFIG
• NNG_OPT_TLS_VERIFIED_
• NNG_OPT_TLS_PEER_CN
• NNG_OPT_TLS_PEER_ALT_NAMES
• NNG_OPT_URL

---

🫶 SEE ALSO 🫶

nng_tls_config_alloc(3tls) nng_options(5), nng_sockaddr_in(5), nng_sockaddr_in6(5), nng_tcp_options(5), nng_tls_config(5), nng_tls_options(5), nng(7),

---

and that's the whole page, bestie!! 🥳 this icon of a manpage is from the NNG Reference Manual, dated 2026-06-30, and it's filed under NNG_TLS(7). go forth and encrypt, mwah 💋✨💖