Example of switching to TLS mid-stream

[LegalizeAdulthood]

The SMTP and NNTP protocols define a STARTTLS command that switches the communication to TLS mid-stream after connecting.

It would be great to have an example that shows how to do this with corosio.

My asio-tcp-ip repository has an example of how to do this with boost.asio in the file news-reader.cpp.

This repository is used in the video: TCP/IP Networking with Boost.Asio

[vinniefalco]

It may not be possible yet, but this is a use-case we must address. Although if it is not possible, implementing it should be pretty easy. Do I understand correctly, that it is part of the protocol to first have some exchanges in the clear, and then later perform a TLS handshake?

[LegalizeAdulthood]

Yes, first you connect to the server and then you issue a STARTTLS command and the server and client then negotiate a secure connection on the original socket.

Like https, there is also a way to establish a TLS based connection from the get-go.

I think the same situation exists for SMTP, but it was in the context of implementing NNTP that I came across this. Legacy NNTP didn't have the idea of connecting on a separate port and they added the STARTTLS command before they standardized a TLS only port.

[LegalizeAdulthood]

Also, it's not required that STARTTLS be the first command you issue. You may first query the server to see if it supports TLS at all in its list of capabilities.

[LegalizeAdulthood]

Here is some server chat to show this:

Script started on 2026-01-30 19:16:09-07:00 [TERM="vt100" TTY="/dev/pts/16" COLUMNS="80" LINES="42"]
shell 1> telnet news.xmission.com nntp
Trying 2607:fa18:0:3::31...
Connected to news.xmission.com.
Escape character is '^]'.
200 nnrp.xmission InterNetNews NNRP server INN 2.7.3 ready (posting ok)
CAPABILITIES
101 Capability list:
VERSION 2
IMPLEMENTATION INN 2.7.3
AUTHINFO USER SASL
COMPRESS DEFLATE
HDR
LIST ACTIVE ACTIVE.TIMES COUNTS DISTRIB.PATS DISTRIBUTIONS HEADERS MODERATORS MOTD NEWSGROUPS OVERVIEW.FMT SUBSCRIPTIONS
OVER
POST
READER
SASL SCRAM-SHA-512 SCRAM-SHA-384 SCRAM-SHA-256 SCRAM-SHA-224 SCRAM-SHA-1 DIGEST-MD5 CRAM-MD5 NTLM LOGIN PLAIN
STARTTLS
XPAT
.
HELP
100 Legal commands
  ARTICLE [message-ID|number]
  AUTHINFO USER name|PASS password|SASL mechanism [initial-response]|GENERIC program [argument ...]
  BODY [message-ID|number]
  CAPABILITIES [keyword]
  COMPRESS DEFLATE
  DATE
  GROUP newsgroup
  HDR header [message-ID|range]
  HEAD [message-ID|number]
  HELP
  IHAVE message-ID
  LAST
  LIST [ACTIVE [wildmat]|ACTIVE.TIMES [wildmat]|COUNTS [wildmat]|DISTRIB.PATS|DISTRIBUTIONS|HEADERS [MSGID|RANGE]|MODERATORS|MOTD|NEWSGROUPS [wildmat]|OVERVIEW.FMT|SUBSCRIPTIONS [wildmat]]
  LISTGROUP [newsgroup [range]]
  MODE READER
  NEWGROUPS [yy]yymmdd hhmmss [GMT]
  NEWNEWS wildmat [yy]yymmdd hhmmss [GMT]
  NEXT
  OVER [range]
  POST
  QUIT
  STARTTLS
  STAT [message-ID|number]
  XGTITLE [wildmat]
  XHDR header [message-ID|range]
  XOVER [range]
  XPAT header message-ID|range pattern [pattern ...]
Report problems to <usenet@news.xmission.com>.
.
QUIT
205 Bye!
Connection closed by foreign host.
shell 2> exit
shell 3> exit

Script done on 2026-01-30 19:16:24-07:00 [COMMAND_EXIT_CODE="0"]

[LegalizeAdulthood]

RFC 4642 "Using Transport Layer Security (TLS) with Network News Transfer Protocol (NNTP)" discusses the STARTTLS command

[vinniefalco]

Ah yeah that's pretty cool. This is doable.