TLS

Transport Layer Security (TLS) is the standard cryptographic protocol behind HTTPS, secure MQTT, and most other encrypted network traffic. TinyCLR supports TLS 1.2 with the same handshake, cipher suites, and certificate validation as desktop .NET.

The whole crypto stack — handshake, encryption, decryption, certificate validation — runs inside the SITCore processor's internal memory, not on an external chip or over the network. Sensitive material (private keys, session keys, decrypted payloads) never leaves the chip's secure memory.

When to use which

TinyCLR can act as either side of a TLS connection:

• TLS Client — your device connects out to an HTTPS server, MQTT broker, cloud service, etc. You'll need the server's root CA certificate to validate the connection.
• TLS Server — your device accepts incoming encrypted connections (a web UI, a local API). You'll need a server certificate and private key on the device.

Common patterns

TLS shows up in several places throughout TinyCLR — each one uses the same underlying TLS 1.2 stack:

• HTTPS — see HTTP/HTTPS. Just use an https:// URL with HttpWebRequest and TLS is handled automatically.
• Secure MQTT — see MQTT. Set SslProtocol = SslProtocols.Tls12 on the client settings.
• Cloud SDKs — Azure and AWS both connect over TLS-protected MQTT on port 8883.
• Raw sockets — wrap a Socket with SslStream and call AuthenticateAsClient or AuthenticateAsServer.

Certificate maintenance

Root CA and server certificates expire. For deployed devices:

• Track when each embedded certificate expires.
• Plan an in-field update path so you can deploy new certificates before the old ones expire.
• Some services rotate their root CAs every few years (see notes on Azure for one example).

API reference

Namespace	Description
GHIElectronics.TinyCLR.Networking	SslStream and socket-level TLS classes