# net/starttls Upgrade an established plaintext client connection to TLS (STARTTLS), after the protocol's cleartext negotiation has already happened. From this point the connection uses mbedTLS transparently and its existing `net/on-data`/`net/on-line`/`net/on-close` callbacks stay live. ## Syntax

[net/starttls $conn $host]

## Parameters - `$conn` — client connection (from `net/connect` or equivalent) - `$host` — hostname for SNI and certificate verification (string) Certificate verification is mandatory; hostname verification is set from `$host`. ## Examples

set conn [net/connect "imap.example.com" 143]
# ... read the greeting, send STARTTLS in the clear ...
[net/starttls $conn "imap.example.com"]
[net/tls-error $conn]     # → nil once the handshake succeeds

## Returns `true` once the handshake is started/completed; `%Err{:message}` for a non-connection argument, a closed or already-TLS connection, a build without SSL (`-Dssl=true`), or an immediate handshake failure (mbedTLS error text). Completion is asynchronous: `net/send` reports "TLS handshake in progress" until ready, a failure fires `net/on-close`, and `net/tls-error` reports the reason. ## See Also `net/connect-tls`, `net/tls-error`, `net/send`