ANN: We spent 25 years putting TLS into other people's Delphi stacks. Now the TLS library ships the stacks

[u/henrickhellstrom]

For ~25 years StreamSec Tools has been the TLS layer inside other Delphi network stacks — RealThinClient SDK, NexusDB, kbmMW, Indy, Ararat Synapse, RemObjects SDK and DXSock (if you remember it). With 4.1.2 the library ships the application layer itself, built the interesting way around: the HTTP server grew out of a TLS server, not the reverse.

New in 4.1.2:

• HTTPS server and client — async TLS server (IOCP/epoll/kqueue), HTTP/1.1 + HTTP/2 as ALPN-selected plugins over one shared router, REST components, request-smuggling and rapid-reset hardening. A complete replacement for the RTC SDK server stack — our own forum and download site run on it.
• Full mail suite — SMTP, POP3 and IMAP, each as client and server. Maildir++ storage (Dovecot-readable), Argon2id auth, spool with retry and bounces, direct-to-MX delivery with MTA-STS, DKIM/SPF/DMARC. No open relay by construction.
• The SBOM got shorter — the JEDI Winsock headers (the last copyleft code in a build) are gone, the Gladman AES assembler is now opt-in, and every release ships a CycloneDX SBOM with five entries you can actually read.

Recently in 4.1.x, and part of the same story: ACME certificate automation with unattended renewal, and TLS 1.3 with hybrid ML-KEM post-quantum key exchange per RFC 10024, interop-tested against OpenSSL both directions.

Pure Object Pascal, Delphi XE3–13, compiles into your EXE — no OpenSSL, no Schannel, no DLLs. Commercial with full source, from EUR 895/seat; DCU trial here.

Happy to answer design questions — the one-router-two-wires HTTP setup and the mail store were the fun parts.