what is sharptls fr?

SharpTls is a C# library that lets a program speak TLS, the protocol that secures most internet connections, without relying on the built-in .NET TLS plumbing or any native system library. It is written entirely in managed C# and targets .NET 9 and newer. The project describes itself as pre-1.0, meaning the public API may still change, and it points readers to a security policy, threat model, and platform matrix before any serious deployment. The main selling point is byte-exact control over the ClientHello, the first message a client sends when opening a TLS connection. A normal TLS library hides that message. SharpTls exposes nearly every part of it: cipher suites, extension order, key shares, SNI, ALPN, padding, and record fragmentation. It also ships a catalog of uTLS-style fingerprints that imitate the handshakes produced by Chrome, Firefox, Edge, Safari, iOS, Android, 360, and QQ, plus version-bound "Auto" aliases for each family. Beyond fingerprinting, the library includes working TLS 1.3 and a deliberately restricted TLS 1.2 client and server core, with certificate validation, session resumption, 0-RTT, KeyUpdate, and exporters. It supports newer privacy features such as Encrypted Client Hello (ECH), HTTPS SVCB discovery, hybrid post-quantum key exchange, delegated credentials, and certificate compression. There are also adapters for the TLS layer used inside QUIC, without claiming to implement QUIC transport or HTTP/3. Developers install it from NuGet as a prerelease package. A five-minute sample shows connecting to a host, sending a simple HTTP request over the negotiated stream, and reading the response. More advanced examples cover building a custom ClientHello profile from raw and built-in extensions, importing a captured handshake, serializing it to JSON, and rebuilding it later. A "Roller" helper retries connections only on explicit negotiation alerts, never masking certificate, hostname, or transport failures. The README also stresses that wire fidelity does not weaken security. Every executable profile still passes authentication and state-machine checks, and disabling certificate validation requires an explicitly named dangerous opt-in intended for lab use. The full README is longer than what was shown.