FIX.Session.Transport.TLS (fix_session v0.1.3)

Copy Markdown View Source

TLS initiator transport over :ssl.

Sockets are binary, unpacketized, and passive; the session enables each read with set_active_once/1. User options may tune the connection but cannot override the mode, packeting, or active flag the session depends on.

Defaults

Each default below applies only when the options do not already set it:

  • verify: :verify_peer — the peer certificate is verified.
  • cacerts: :public_key.cacerts_get() — the OS trust store; applied only when the options set neither :cacerts nor :cacertfile.
  • customize_hostname_check with the :https match function, so wildcard certificates verify.
  • server_name_indication derived from the host: hostnames are sent as SNI, IP literals disable it.
  • nodelay: true, keepalive: true — the same TCP-level tuning as FIX.Session.Transport.TCP.

TLS versions and verification depth use the :ssl application defaults and can likewise be overridden.

Self-signed counterparty certificates

Prefer pinning the counterparty CA over disabling verification:

transport: FIX.Session.Transport.TLS,
transport_options: [cacertfile: "/etc/fix/counterparty_ca.pem"]

verify: :verify_none also works; :ssl logs a warning for it, which can be silenced with log_level: :error.

Connecting by IP address

When the host is an IP address but the server certificate names a DNS host, pass server_name_indication: ~c"fix.example.com" — :ssl uses the SNI value for hostname verification as well. Without it the certificate must carry a matching iPAddress subject alternative name.

:public_key.cacerts_get/0 raises when no OS trust store is available; supply :cacerts or :cacertfile in that case.