SSL service "ssl:C"

Command Header Available since system-version Available from service-sessions Description
0x00010002 Basically main-only Initialize
0x000200C2 CreateContext
0x00030000 CreateRootCertChain
0x00040040 DestroyRootCertChain
0x00050082 Main-only AddTrustedRootCA
0x00060080 Main-only RootCertChainAddDefaultCert
0x00070080 Main-only RootCertChainRemoveCert
0x00080000 This writes an output u32 to cmdreply[2](created context handle).
0x00090040 (u32 handle for a context) This is used for destroying a context created by command 0x00080000.
0x000A0082 (u32 contexthandle, u32 size, ((Size<<4) | 10), inbufptr) Writes an output u32 to cmdreply[2]. This uses a context created by command 0x00080000.
0x000B0080 (u32 contexthandle, u8 inval2) Writes an output u32 to cmdreply[2]. This uses a context created by command 0x00080000.
0x000C0080 (u32 contexthandle, u32 inval) This uses a context created by command 0x00080000.
0x000D0084 Main-only OpenClientCertContext
0x000E0040 Main-only OpenDefaultClientCertContext
0x000F0040 Main-only CloseClientCertContext
0x00100000 All GatherEntropy
0x00110042 All GenerateRandomData
0x00120042 InitializeConnectionSession
0x00130040 Context-only StartConnection
0x00140040 Context-only StartConnectionGetOut
0x00150082 Context-only Read
0x00160082 Context-only (u32 contexthandle, u32 size, ((Size<<4) | 12), outbufptr) Writes an output u32 to cmdreply[2].
0x00170082 Write
0x00180080 ContextSetRootCertChain
0x00190080 Context-only ContextSetClientCert
0x001A0080 Context-only (u32 contexthandle, u32 handle) This writes some sort of context handle into the session context.
0x001B0080 Context-only ContextClearOpt
0x001C00C4 Context-only (u32 contexthandle, u32 size0, u32 size1, ((Size0<<4) | 12), outbufptr0, ((Size1<<4) | 12), outbufptr1) This copies two strings to the specified output buffers, each string is only copied if it was successfully loaded. The out sizes include the nul-terminator.
0x001D0040 Context-only (u32 contexthandle) Writes an output u32 from the context state to cmdreply[2].
0x001E0040 All DestroyContext
0x001F0082 Context-only ContextInitSharedmem
0x00200082 Context-only (contexthandle, u32 size, ((Size<<4) | 10), inbufptr) Inbuf seems to be a cert?

Going by strings in the SSL sysmodule it appears the sysmodule uses RSA BSAFE(like certain other 3DS software), this is also likely where the "ssl:C" name comes from(RSA BSAFE "SSL-C").

Similar to HTTPC, each SSL context is used with a dedicated service session which gets opened after creating that context. Following creating the context + opening the service session, SSLC:InitializeConnectionSession is used from that service session for that context. Afterwards, all commands which require a handle for this context are done with this dedicated service session.

Internally there's a separate object vtable used with the above SSLC commands, for the main session(where SSLC:InitializeConnectionSession wasn't used), and context sessions where SSLC:InitializeConnectionSession was used. Error 0xD960BBF4 will be returned if a command was used with the wrong session type.

Like some other commands, 0x001F0082 and 0x00200082 are not used by HTTP-sysmodule.

Among commands 0x00180080..0x001B0080 none of them are completely mandatory. However, with the default settings at bare minimum a RootCertChain needs selected otherwise an untrusted-RootCA error will trigger eventually.

It's unknown whether TLS server->client connections are supported.

Error codes

Error code Description
0xd8a0b836 The specified RootCertChain handle was not found in the linked-list.