+{
+ unsigned const bitCount = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_MEDIUM);
+
+ gnutls_priority_init(&cipherCache, ciphers, NULL);
+ initializeCertificate();
+
+ gnutls_dh_params_init(&dhParameters);
+
+ Log_info("Generating Diffie-Hellman parameters (%i bits)", bitCount);
+ int error = gnutls_dh_params_generate2(dhParameters, bitCount);
+
+ if(!error) {
+ Log_info("Successfully generated Diffie-Hellman parameters");
+ } else {
+ Log_warn("Failed to generate Diffie-Hellman parameters: %s", gnutls_strerror(error));
+ }
+
+ gnutls_certificate_set_dh_params(certificate, dhParameters);
+
+ Log_info("Sucessfully initialized GNUTLS version %s", gnutls_check_version(NULL));
+
+}
+
+void SSLi_deinit()
+{
+ gnutls_certificate_free_credentials(certificate);
+ gnutls_priority_deinit(cipherCache);
+ gnutls_global_deinit();
+}
+
+SSL_handle_t * SSLi_newconnection( int * fileDescriptor, bool_t * isSSLReady )
+{
+ gnutls_session_t * session
+ = Memory_safeCalloc(1, sizeof(gnutls_session_t));
+
+ gnutls_init(session, GNUTLS_SERVER);
+ gnutls_priority_set(*session, cipherCache);
+ gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE, certificate);
+
+ gnutls_certificate_server_set_request(*session, GNUTLS_CERT_REQUIRE);
+
+ gnutls_transport_set_int(*session, *fileDescriptor);
+
+ if(isSSLReady && SSLi_nonblockaccept(session, isSSLReady))
+ *isSSLReady = true;
+
+ return session;
+}
+
+bool_t SSLi_getSHA1Hash(SSL_handle_t *session, uint8_t *hash)
+{
+ gnutls_datum_t const * certificateData = gnutls_certificate_get_peers(*session, NULL);
+
+ size_t resultSize = 0;
+ int error = gnutls_fingerprint( GNUTLS_DIG_SHA1, certificateData, hash, &resultSize);
+ return error == GNUTLS_E_SUCCESS && resultSize == 20;
+}
+
+int SSLi_nonblockaccept( SSL_handle_t *session, bool_t * isSSLReady )
+{
+ int error;
+ do {
+ error = gnutls_handshake(*session);
+ } while(error < GNUTLS_E_SUCCESS && !gnutls_error_is_fatal(error));
+
+ if ( error < GNUTLS_E_SUCCESS ) {
+ Log_warn("TLS handshake failed with error %i (%s).", error, gnutls_strerror(error));
+ }
+
+ if(isSSLReady)
+ *isSSLReady = true;
+
+ return error;
+}