Using a Deferred Handshake

A deferred handshake enables an application to create an unsecured connection and then later convert it to a secure connection.

    To implement secure sockets with a deferred handshake

1. Create a socket with the socket function.
2. Set the socket in secure mode with setsockopt.

   The level parameter should be set to SO_SOCKET, optname should be set to SO_SECURE, and optval should be a DWORD set to SO_SEC_SSL.

3. Specify the certificate validation callback function by calling WSAIoctl with the SO_SSL_SET_VALIDATE_CERT_HOOK control code.
4. Set the socket in deferred handshake mode with WSAIoctl. The control code should be set to SO_SSL_SET_FLAGS and the flag set to SSL_FLAG_DEFER_HANDSHAKE.
5. Establish a nonsecure connection with the remote party using connect.
6. Transmit and receive unencoded data.
7. To switch to secure mode, call WSAIoctl with the SO_SSL_PERFORM_HANDSHAKE control code passing in the target server name.

   The certificate callback function is automatically called. The handshake is successful only if the callback function verifies the acceptability of the certificate by returning SSL_ERR_OKAY.

8. Transmit and receive.

   The send and recv functions encode and decode the data automatically.

9. Close the socket with closesocket when finished.