TLS (encrypted connections)

Some MUDs offer a TLS port, often called the SSL port, as well as plain telnet. Veilrunner can connect to it with TLS 1.2 or newer.

Turn on TLS for a MUD

1. Open Add/Edit Character (the + or Edit button in the connection bar).
2. Turn on Use TLS.
3. Set Port to the MUD's TLS port.
4. Connect.

Veilrunner checks the server's certificate the normal way. If the certificate doesn't check out, the connect stops with a clear line.

Self-signed certificates

If the MUD uses a self-signed certificate, turn on Allow self-signed for that MUD only. Veilrunner then trusts the certificate on first use:

• The first connect remembers the certificate's SHA-256 fingerprint ("pins" it) and prints it.
• Later connects succeed only with that same certificate. If it changes, the connect stops with "certificate changed".
• If the MUD really did change its certificate, #tls trust forgets the old one, and the next connect pins the new one.

How to tell you're encrypted

While you're connected, the footer shows:

• 🔒 TLS when the certificate was verified.
• ⚠︎ TLS (pinned) for a self-signed certificate that matches the pin.

Plain telnet shows no marker. A new connect never reuses an earlier TLS session, so every connect is checked.

Commands

#tls                      show TLS for this MUD and this connection
#tls on                   use TLS (certificate checked) from the next connect
#tls off                  back to plain telnet
#tls selfsigned on        accept this MUD's self-signed certificate (warns)
#tls selfsigned off       check the certificate again
#tls trust                forget the pinned certificate; the next connect pins the new one

#tls changes take effect on the next connect. Triggers can't run #tls.

TLS works together with MCCP compression.