== How to fix it in Botan

=== Code examples

The following code samples attempt to create a Botan TLS Client.

==== Noncompliant code example

This sample uses Botan's default TLS algorithms, which are weak cryptographical
algorithms (TLSv1.0 and DLTv1.0).

[source,cpp,diff-id=1,diff-type=noncompliant]
----
#include <botan/tls_client.h>
#include <botan/tls_callbacks.h>
#include <botan/tls_session_manager.h>
#include <botan/tls_policy.h>
#include <botan/auto_rng.h>
#include <botan/certstor.h>
#include <botan/certstor_system.h>

class Custom_Callbacks   : public Botan::TLS::Callbacks { };
class Custom_Credentials : public Botan::Credentials_Manager { };

void encrypt() {
    Custom_Callbacks      callbacks;
    Botan::AutoSeeded_RNG rng;
    Custom_Credentials    creds;
    Botan::TLS::Policy    policy; // Noncompliant

    Botan::TLS::Session_Manager_In_Memory session_mgr(rng);
    Botan::TLS::Client client(callbacks, session_mgr, creds, policy, rng,
                              Botan::TLS::Server_Information("example.com", 443),
                              Botan::TLS::Protocol_Version::TLS_V12);
}
----

==== Compliant solution

This sample uses the "Strict" Botan TLS Policy, whose minimal versions are
strong cryptographical algorithms (TLSv1.2 and TLSv1.2).

[source,cpp,diff-id=1,diff-type=compliant]
----
#include <botan/tls_client.h>
#include <botan/tls_callbacks.h>
#include <botan/tls_session_manager.h>
#include <botan/tls_policy.h>
#include <botan/auto_rng.h>
#include <botan/certstor.h>
#include <botan/certstor_system.h>

class Custom_Callbacks   : public Botan::TLS::Callbacks { };
class Custom_Credentials : public Botan::Credentials_Manager { };

void encrypt() {
    Custom_Callbacks          callbacks;
    Botan::AutoSeeded_RNG     rng;
    Custom_Credentials        creds;
    Botan::TLS::Strict_Policy policy;

    Botan::TLS::Session_Manager_In_Memory session_mgr(rng);
    Botan::TLS::Client client(callbacks, session_mgr, creds, policy, rng,
                              Botan::TLS::Server_Information("example.com", 443),
                              Botan::TLS::Protocol_Version::TLS_V12);
}
----

=== How does this work?

include::../../common/fix/fix.adoc[]
