TLS Client

A TLS client initiates encrypted connections to remote servers — HTTPS websites, MQTT brokers, REST APIs. TinyCLR's TLS 1.2 implementation runs entirely inside SITCore's secure memory; see TLS for the overall design.

NuGet packages: GHIElectronics.TinyCLR.Devices.Network, GHIElectronics.TinyCLR.Networking.Http.

Example: HTTPS GET

The example below fetches https://www.google.com over TLS. The only difference from a plain HTTP request is the https:// URL and the loaded root CA certificate.

using GHIElectronics.TinyCLR.Native;
using GHIElectronics.TinyCLR.Networking.Http;
using System;
using System.Diagnostics;
using System.Security.Cryptography.X509Certificates;
using System.Text;

var url = "https://www.google.com";

var caBytes = Resources.GetBytes(Resources.BinaryResources.GlobalSign);
X509Certificate[] caCerts = { new X509Certificate(caBytes) };

int read = 0, total = 0;
byte[] result = new byte[512];

try {
    using (var req = HttpWebRequest.Create(url) as HttpWebRequest) {
        req.KeepAlive = false;
        req.HttpsAuthentCerts = caCerts;
        req.ReadWriteTimeout = 2000;

        using (var res = req.GetResponse() as HttpWebResponse)
        using (var stream = res.GetResponseStream()) {
            do {
                read = stream.Read(result, 0, result.Length);
                total += read;

                Debug.WriteLine("read: " + read + ", total: " + total);
                Debug.WriteLine("Response: " + Encoding.UTF8.GetString(result, 0, read));
            } while (read != 0);
        }
    }
}
catch (Exception ex) {
    Debug.WriteLine("HTTPS request failed: " + ex.Message);
}

Entropy

TLS handshakes need cryptographically-strong random numbers. TinyCLR uses the SITCore's True Random Number Generator (TRNG) by default — no setup needed. If you want to inject your own entropy source, set it on the network interface before enabling the controller:

networkInterfaceSetting.TlsEntropy = new byte[] { 0, 1, 2, 3 };

Root certificate

To verify a remote server's identity, the client needs the root CA certificate that signed the server's certificate. TinyCLR accepts certificates in both PEM (Base-64 text) and DER (binary) formats — embed them in your project as a resource.

Getting a root certificate

The fastest way is the command line:

openssl s_client -showcerts -connect www.google.com:443 < /dev/null

That dumps the full certificate chain. Copy the last -----BEGIN CERTIFICATE----- … -----END CERTIFICATE----- block (the root) into a .cer or .crt file and embed it as a project resource.

From a browser

If you'd rather click than type:

1. Browse to the target site in Chrome or Edge.
2. Click the 🔒 lock icon in the address bar → Connection is secure → Certificate is valid.
3. Switch to the Certification Path (or Details) tab and select the root certificate at the top of the chain.
4. Copy to File… → choose Base-64 encoded X.509 (.CER) and save.

Then add the resulting .cer file as a project resource and reference it from Resources.BinaryResources.<your-cert-name>.

tip

Browser certificate UIs change between versions. If the menus don't match, look for "Certificate" or "View Certificate" — it's there, just relabeled.

API reference

Namespace	Description
GHIElectronics.TinyCLR.Networking.Http	HTTP/HTTPS client with built-in TLS support