How to serve https

How am I doing so far?

I’m not familiar with the gory details of the different APIs, but sounds about right. One thing to note is the TLS library may drive the socket for you, so you don’t need to pass encrypted traffic from the library to the socket, you just pass it a file descriptor of the socket as part of the setup and it’ll do the rest. That means you only handle unencrypted data on your side.

@ Theo, I was thinking of STARTTLS, but I’m not aware that it can be done using SSL.
So my thoughts were it’s a property of TLS that allows it whereas it’s impossible using SSL.
e.g. SNI only works with TLS as well I think
Or that was my assumption/guess. Oh Well.
I would really like to get to grips with the workings of encryption, so perhaps a few books and reading is in order for me!
The encryption policy is enforced by the application.
For example imap, there is no reason why it cannot be enforced by network IP – so plain for local and TLS for remote networks.
There’s no need for packet inspection.