Skip to content
Tech News
← Back to articles

Serverless DTLS

2026-09-10 | original
read original get YubiKey 5 NFC Security Key → more articles
Why This Matters

Proxylity is adding DTLS Listeners, a managed service that terminates DTLS 1.2/1.3 sessions and hands decrypted UDP payloads to serverless destinations, so teams can get encrypted UDP without running their own servers or crypto stack. It targets protocols like RADIUS, IoT telemetry, and custom request-response designs that need datagram semantics rather than TLS streams. It's also positioned as the first building block toward WebRTC Data Channel support.

Key Takeaways
Worth a Look

YubiKey 5 NFC Security Key — If you're working with DTLS, RADIUS and encrypted authentication flows like the article describes, a YubiKey 5 NFC is a natural companion for hardware-backed credentials. It supports FIDO2/WebAuthn, PIV smart card and OTP, so it slots into the same identity stack that RADIUS and IoT deployments lean on. Small enough to live on a keyring and works over USB-A or NFC with a phone.

See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.

DTLS Listeners

DTLS Listeners add TLS-style encryption and authentication to UDP applications without changing the datagram transport model. Clients establish a DTLS 1.2 or DTLS 1.3 session with the Listener's assigned domain and port. Proxylity decrypts authenticated application data and delivers the plaintext payload to your configured Destinations. Responses from your application are encrypted and sent back through the same DTLS session.

When to Use DTLS

Choose a DTLS Listener when your application already supports DTLS or needs encrypted UDP transport while preserving datagram boundaries. Common examples include RADIUS, IoT protocols, real-time telemetry, and custom request-response protocols that cannot use a stream-oriented TLS connection.

DTLS is also the first transport layer on Proxylity's roadmap to WebRTC Data Channels. DTLS Listeners are available today for native DTLS clients; SCTP and WebRTC signaling are separate layers and are not provided by a DTLS Listener.

DTLS, UDP, and WireGuard

Feature UDP Listener DTLS Listener WireGuard Listener Transport Plain UDP DTLS 1.2 or DTLS 1.3 WireGuard tunnel Encryption Application responsibility TLS-style authenticated encryption WireGuard authenticated encryption Client authentication Client Restrictions Certificate handshake or configured PSK identity Registered peer key or open-peer policy Payload delivered to Destinations UDP payload Decrypted application data WireGuard payload; optionally decapsulated Typical fit Simple or already-encrypted protocols Applications with native DTLS support VPN clients and IP tunneling

Authentication Options

Server Certificate

Every DTLS Listener receives a server certificate and private key managed by Proxylity. The certificate identifies the Listener's assigned endpoint and is returned through the DtlsServerCertificate CloudFormation attribute. Distribute that certificate or its trust anchor according to your client application's trust model.

... continue reading

Explore topics: dtls proxylity udp webrtc data channels wireguard
Related:
Show HN: Wg-admin – web UI for an existing WireGuard host
Tailcat: Tailscale Without Tailscale, by Tailscale
Tailcat – Like netcat, but over Tailscale’s data plane
Tailcat
Tailcat: Secure Tunnels in Seconds (Tailscale)

© 2026 GoKawiil

About | Editorial Policy | Contact