SslStream Class

.NET API | Microsoft Learn

Namespace: System.Net.Security
Assembly: System.Net.Security.dll

Class SslStream

Represents a stream that performs authentication using the Secure Sockets Layer (SSL) or Transport Layer Security (TLS) protocol over a stream.

This class provides the functionality to secure communication between two endpoints by encrypting and authenticating data exchanged between them.

Remarks

The SslStream class allows you to wrap an existing stream (such as a NetworkStream) and add SSL/TLS security to it. This is commonly used for securing HTTP connections (HTTPS), FTP connections, and other network protocols.

To use SslStream, you typically:

Create an instance of a stream that represents the underlying communication channel (e.g., new NetworkStream(socket)).
Create an instance of SslStream, passing the underlying stream and an SslContext (or SslClientAuthenticationOptions/SslServerAuthenticationOptions for .NET 5+).
Call AuthenticateAsClientAsync or AuthenticateAsServerAsync to establish the SSL/TLS connection.
Use the SslStream instance to read and write data, which will be automatically encrypted and decrypted.

It's important to manage the lifecycle of the underlying stream and the SslStream correctly to avoid resource leaks. Ensure that both streams are disposed of when they are no longer needed.

Inheritance Hierarchy

System.Object
System.IO.Stream
System.Net.Security.SslStream

Constructors

The SslStream class has several constructors:

SslStream(Stream innerStream)

Initializes a new instance of the SslStream class using the specified inner stream.

SslStream(Stream innerStream, bool leaveInnerStreamOpen)

Initializes a new instance of the SslStream class using the specified inner stream and a value that indicates whether the inner stream should be left open after the SslStream is disposed of.

SslStream(Stream innerStream, bool leaveInnerStreamOpen, System.Security.Cryptography.X509Certificates.X509Certificate serverCertificate)

Initializes a new instance of the SslStream class using the specified inner stream, a value that indicates whether the inner stream should be left open after the SslStream is disposed of, and the server certificate.

For .NET 5 and later, you should use SslClientAuthenticationOptions and SslServerAuthenticationOptions for configuring client and server authentication respectively, in conjunction with the appropriate constructors.

Methods

The SslStream class provides a rich set of methods for managing secure communication:

Method Signature Description AuthenticateAsClientAsync(string targetHost) Authenticates the server endpoint on this instance of the SslStream.

AuthenticateAsClientAsync(string targetHost, System.Security.Cryptography.X509Certificates.X509CertificateCollection clientCertificates, System.Security.Authentication.SslProtocols enabledSslProtocols, bool checkCertificateRevocation)

Authenticates the client endpoint on this instance of the SslStream. AuthenticateAsServerAsync(System.Security.Cryptography.X509Certificates.X509Certificate serverCertificate) Authenticates the server endpoint on this instance of the SslStream.

AuthenticateAsServerAsync(System.Security.Cryptography.X509Certificates.X509Certificate serverCertificate, bool clientCertificateRequired, System.Security.Authentication.SslProtocols enabledSslProtocols, bool checkCertificateRevocation)

Authenticates the server endpoint on this instance of the SslStream. ReadAsync(byte[] buffer, int offset, int count) Asynchronously reads from the current stream and writes the data to the provided buffer. WriteAsync(byte[] buffer, int offset, int count) Asynchronously writes data to the current stream. Dispose() Releases the unmanaged resources used by the current instance of the Stream class and optionally releases the unmanaged resources used by the inner stream.

Properties

The SslStream class exposes several properties:

CanRead: Gets a value indicating whether the stream supports reading.
CanWrite: Gets a value indicating whether the stream supports writing.
CanSeek: Gets a value indicating whether the stream supports seeking. (Typically false for network streams).
IsAuthenticated: Gets a value indicating whether the stream has been successfully authenticated.
IsMutuallyAuthenticated: Gets a value indicating whether both the client and server have authenticated each other.
IsEncrypted: Gets a value indicating whether the stream is encrypted.
LocalCertificate: Gets the local certificate used for authentication.
RemoteCertificate: Gets the remote certificate used for authentication.

Events

The SslStream class does not expose any public events.

Security Considerations

When using SslStream, it is crucial to:

Always validate the server's certificate to prevent man-in-the-middle attacks.
Use strong SSL/TLS protocols (e.g., TLS 1.2 or TLS 1.3) and appropriate cipher suites.
Handle certificate exceptions gracefully.
Ensure proper disposal of SslStream and underlying streams.