---
name: "ne_sock_handshake"
section: "3"
platform: "linux"
package: "neon"
version: "0.37.1-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/ne_sock_handshake"
---

# ne\_sock\_handshake(3)

SSL socket functions

## NAME

ne\_sock\_handshake, ne\_sock\_sessid, ne\_sock\_cipher, ne\_sock\_getproto, ne\_sock\_getcert, ne\_ssl\_check\_certificate - SSL socket functions

## SYNOPSIS

```
#include <ne_socket.h>
```

**int ne\_sock\_handshake(ne\_socket \****sock***, ne\_ssl\_context \****ctx***, const char \****hostname***, unsigned int** *flags***);**

**int ne\_sock\_sessid(ne\_socket \****sock***, unsigned char \****buf***, size\_t \****buflen***);**

**char \*ne\_sock\_cipher(ne\_socket \****sock***);**

**enum ne\_ssl\_protocol ne\_sock\_getproto(ne\_socket \****sock***);**

**ne\_ssl\_certificate \*ne\_sock\_getcert(ne\_socket \****sock***, ne\_ssl\_context \****ctx***);**

**int ne\_ssl\_check\_certificate(ne\_ssl\_context \****ctx***, ne\_socket \****sock***, const char \****hostname***, const ne\_inet\_addr \****address***, const ne\_ssl\_certificate \****cert***, unsigned int** *flags***, int \****failures***);**

## DESCRIPTION

The **ne\_sock\_handshake** function initiates an SSL handshake on socket *sock* using SSL context *ctx*. If *hostname* is non-NULL, it is used as the Server Name Indication (SNI) hint. The *flags* parameter must be zero.

The **ne\_sock\_sessid** function retrieves the session ID of the current SSL session. If *buf* is non-NULL, on success, copies at most \*buflen bytes to *buf* and sets \*buflen to the exact number of bytes copied. If *buf* is NULL, on success, sets \*buflen to the length of the session ID.

The **ne\_sock\_cipher** function returns a human-readable name of the SSL/TLS cipher used for the connection, or NULL if none. The format of this string is not intended to be fixed or parseable, but is informational only. The return value is a NUL-terminated malloc-allocated string which must be freed by the caller.

The **ne\_sock\_getproto** function returns the SSL/TLS protocol version used for socket *sock*, or **NE\_SSL\_PROTO\_UNSPEC** if SSL/TLS is not in use for the socket.

The **ne\_sock\_getcert** function returns the server certificate for the socket.

The **ne\_ssl\_check\_certificate** function checks the identity of a server certificate against the hostname or address used to establish the connection, following rules specified by **RFC 2818**\[1\] and **RFC 3280**\[2\]. Either *hostname* or *address* can be non-NULL; whichever was used to identify the server when establishing the SSL connection. If both are NULL, matching will fail but the \*identity output parameter will still be set. The *flags* parameter must be zero. If verification fails, the failure reasons are stored in \*failures as a binary OR of **NE\_SSL\_\*** values.

## RETURN VALUE

**ne\_sock\_handshake** returns zero on success, or non-zero on error.

**ne\_sock\_sessid** returns zero on success, or non-zero on error.

**ne\_sock\_cipher** returns a malloc-allocated string on success which must be freed by the caller, or NULL if no cipher is in use.

**ne\_sock\_getproto** returns the SSL/TLS protocol version, or **NE\_SSL\_PROTO\_UNSPEC**.

**ne\_sock\_getcert** returns the server certificate, or NULL on error.

**ne\_ssl\_check\_certificate** returns zero if the identity matches, 1 if the identity does not match, or less than zero if the certificate had no identity.

## HISTORY

**ne\_sock\_getproto** is available in neon 0.34.0 and later. **ne\_sock\_handshake** and **ne\_sock\_getcert** are available in neon 0.37.0 and later.

## SEE ALSO

[**ne\_ssl\_context\_create**(3)](/ne_ssl_context_create/3.md)

## COPYRIGHT

Copyright © 2001-2026 Joe Orton\

## REFERENCES

- 1\.

  RFC 2818

  https://www.rfc-editor.org/rfc/rfc2818

- 2\.

  RFC 3280

  https://www.rfc-editor.org/rfc/rfc3280