Support both SSL and non-SSL on the same server port

Question

I've a plan to add the encryption to my server/client communication by using OpenSSL. But I want to let the user choose if they want to use the SSL channel to communicate or not. The easiest way is just create 2 socket and bind them to a different port, but I want the server to serve the service on only one port.

Is there anyway to open the server side's SSL socket that support both SSL and non-SSL communication regarding the client incoming connection?

P.S. I use OpenSSL lib for my c++ code.

Answer 1

A TLS client hello has a standard format. You could peek at the first few bytes of the first message, detect whether or not this is a TLS client hello, and respond accordingly.

An alternate solution would to be to connect the unencrypted service on port X, and set up stunnel to listen on port Y, where it would handle the TLS layer, and forward the plaintext to local port X. While this would bind to two ports, your service would only run once.