|
@@ -0,0 +1,351 @@
|
|
|
+<?xml version="1.0" encoding="UTF-8"?>
|
|
|
+<!-- this file is autogenerated, do not edit! -->
|
|
|
+<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
|
|
|
+ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
|
|
|
+<chapter id="config_vars.tls">
|
|
|
+ <title> Configuration Variables for tls</title>
|
|
|
+
|
|
|
+
|
|
|
+<section id="tls.force_run">
|
|
|
+ <title>tls.force_run</title>
|
|
|
+ <para>
|
|
|
+ force loading the tls module even when initial sanity checks
|
|
|
+ fail.
|
|
|
+ </para>
|
|
|
+ <para>Default value: 0.</para>
|
|
|
+ <para>Range: 0 - 1.</para>
|
|
|
+ <para>Type: integer.</para>
|
|
|
+ <para>
|
|
|
+ Read-only.
|
|
|
+ </para>
|
|
|
+</section>
|
|
|
+
|
|
|
+<section id="tls.method">
|
|
|
+ <title>tls.method</title>
|
|
|
+ <para>
|
|
|
+ TLS method used (TLSv1, SSLv3, SSLv2, SSLv23).
|
|
|
+ </para>
|
|
|
+ <para>Default value: <unknown:str>.</para>
|
|
|
+ <para>Type: string.</para>
|
|
|
+ <para>
|
|
|
+ Read-only.
|
|
|
+ </para>
|
|
|
+</section>
|
|
|
+
|
|
|
+<section id="tls.verify_certificate">
|
|
|
+ <title>tls.verify_certificate</title>
|
|
|
+ <para>
|
|
|
+ if enabled the certificates will be verified.
|
|
|
+ </para>
|
|
|
+ <para>Default value: 0.</para>
|
|
|
+ <para>Range: 0 - 1.</para>
|
|
|
+ <para>Type: integer.</para>
|
|
|
+ <para>
|
|
|
+ Read-only.
|
|
|
+ </para>
|
|
|
+</section>
|
|
|
+
|
|
|
+<section id="tls.verify_depth">
|
|
|
+ <title>tls.verify_depth</title>
|
|
|
+ <para>
|
|
|
+ sets how far up the certificate chain will the certificate
|
|
|
+ verification go in the search for a trusted CA.
|
|
|
+ </para>
|
|
|
+ <para>Default value: 9.</para>
|
|
|
+ <para>Range: 0 - 100.</para>
|
|
|
+ <para>Type: integer.</para>
|
|
|
+ <para>
|
|
|
+ Read-only.
|
|
|
+ </para>
|
|
|
+</section>
|
|
|
+
|
|
|
+<section id="tls.require_certificate">
|
|
|
+ <title>tls.require_certificate</title>
|
|
|
+ <para>
|
|
|
+ if enabled a certificate will be required from clients.
|
|
|
+ </para>
|
|
|
+ <para>Default value: 0.</para>
|
|
|
+ <para>Range: 0 - 1.</para>
|
|
|
+ <para>Type: integer.</para>
|
|
|
+ <para>
|
|
|
+ Read-only.
|
|
|
+ </para>
|
|
|
+</section>
|
|
|
+
|
|
|
+<section id="tls.private_key">
|
|
|
+ <title>tls.private_key</title>
|
|
|
+ <para>
|
|
|
+ name of the file containing the private key (pem format), if
|
|
|
+ not contained in the certificate file.
|
|
|
+ </para>
|
|
|
+ <para>Default value: <unknown:str>.</para>
|
|
|
+ <para>Type: string.</para>
|
|
|
+ <para>
|
|
|
+ Read-only.
|
|
|
+ </para>
|
|
|
+</section>
|
|
|
+
|
|
|
+<section id="tls.ca_list">
|
|
|
+ <title>tls.ca_list</title>
|
|
|
+ <para>
|
|
|
+ name of the file containing the trusted CA list (pem format).
|
|
|
+ </para>
|
|
|
+ <para>Default value: <unknown:str>.</para>
|
|
|
+ <para>Type: string.</para>
|
|
|
+ <para>
|
|
|
+ Read-only.
|
|
|
+ </para>
|
|
|
+</section>
|
|
|
+
|
|
|
+<section id="tls.certificate">
|
|
|
+ <title>tls.certificate</title>
|
|
|
+ <para>
|
|
|
+ name of the file containing the certificate (pem format).
|
|
|
+ </para>
|
|
|
+ <para>Default value: <unknown:str>.</para>
|
|
|
+ <para>Type: string.</para>
|
|
|
+ <para>
|
|
|
+ Read-only.
|
|
|
+ </para>
|
|
|
+</section>
|
|
|
+
|
|
|
+<section id="tls.cipher_list">
|
|
|
+ <title>tls.cipher_list</title>
|
|
|
+ <para>
|
|
|
+ list of the accepted ciphers (strings separated by colons).
|
|
|
+ </para>
|
|
|
+ <para>Default value: <unknown:str>.</para>
|
|
|
+ <para>Type: string.</para>
|
|
|
+ <para>
|
|
|
+ Read-only.
|
|
|
+ </para>
|
|
|
+</section>
|
|
|
+
|
|
|
+<section id="tls.session_cache">
|
|
|
+ <title>tls.session_cache</title>
|
|
|
+ <para>
|
|
|
+ enables or disables the session cache.
|
|
|
+ </para>
|
|
|
+ <para>Default value: 0.</para>
|
|
|
+ <para>Range: 0 - 1.</para>
|
|
|
+ <para>Type: integer.</para>
|
|
|
+ <para>
|
|
|
+ Read-only.
|
|
|
+ </para>
|
|
|
+</section>
|
|
|
+
|
|
|
+<section id="tls.session_id">
|
|
|
+ <title>tls.session_id</title>
|
|
|
+ <para>
|
|
|
+ string used for the session id.
|
|
|
+ </para>
|
|
|
+ <para>Default value: <unknown:str>.</para>
|
|
|
+ <para>Type: string.</para>
|
|
|
+ <para>
|
|
|
+ Read-only.
|
|
|
+ </para>
|
|
|
+</section>
|
|
|
+
|
|
|
+<section id="tls.config">
|
|
|
+ <title>tls.config</title>
|
|
|
+ <para>
|
|
|
+ tls config file name (used for the per domain options).
|
|
|
+ </para>
|
|
|
+ <para>Default value: <unknown:str>.</para>
|
|
|
+ <para>Type: string.</para>
|
|
|
+ <para>
|
|
|
+ </para>
|
|
|
+</section>
|
|
|
+
|
|
|
+<section id="tls.log">
|
|
|
+ <title>tls.log</title>
|
|
|
+ <para>
|
|
|
+ tls info messages log level.
|
|
|
+ </para>
|
|
|
+ <para>Default value: 3.</para>
|
|
|
+ <para>Range: 0 - 1000.</para>
|
|
|
+ <para>Type: integer.</para>
|
|
|
+ <para>
|
|
|
+ </para>
|
|
|
+</section>
|
|
|
+
|
|
|
+<section id="tls.debug">
|
|
|
+ <title>tls.debug</title>
|
|
|
+ <para>
|
|
|
+ tls debug messages log level.
|
|
|
+ </para>
|
|
|
+ <para>Default value: 3.</para>
|
|
|
+ <para>Range: 0 - 1000.</para>
|
|
|
+ <para>Type: integer.</para>
|
|
|
+ <para>
|
|
|
+ </para>
|
|
|
+</section>
|
|
|
+
|
|
|
+<section id="tls.connection_timeout">
|
|
|
+ <title>tls.connection_timeout</title>
|
|
|
+ <para>
|
|
|
+ initial connection lifetime (in s) (obsolete).
|
|
|
+ </para>
|
|
|
+ <para>Default value: 600.</para>
|
|
|
+ <para>Range: -1 - -2147483648.</para>
|
|
|
+ <para>Type: integer.</para>
|
|
|
+ <para>
|
|
|
+ </para>
|
|
|
+</section>
|
|
|
+
|
|
|
+<section id="tls.disable_compression">
|
|
|
+ <title>tls.disable_compression</title>
|
|
|
+ <para>
|
|
|
+ if set disable the built-in OpenSSL compression.
|
|
|
+ </para>
|
|
|
+ <para>Default value: 1.</para>
|
|
|
+ <para>Range: 0 - 1.</para>
|
|
|
+ <para>Type: integer.</para>
|
|
|
+ <para>
|
|
|
+ Read-only.
|
|
|
+ </para>
|
|
|
+</section>
|
|
|
+
|
|
|
+<section id="tls.ssl_release_buffers">
|
|
|
+ <title>tls.ssl_release_buffers</title>
|
|
|
+ <para>
|
|
|
+ quickly release internal OpenSSL read or write buffers. Works
|
|
|
+ only for OpenSSL >= 1.0..
|
|
|
+ </para>
|
|
|
+ <para>Default value: -1.</para>
|
|
|
+ <para>Range: -1 - 1.</para>
|
|
|
+ <para>Type: integer.</para>
|
|
|
+ <para>
|
|
|
+ Read-only.
|
|
|
+ </para>
|
|
|
+</section>
|
|
|
+
|
|
|
+<section id="tls.ssl_free_list_max">
|
|
|
+ <title>tls.ssl_free_list_max</title>
|
|
|
+ <para>
|
|
|
+ maximum number of free/cached memory chunks that OpenSSL will
|
|
|
+ keep per connection. Works only for OpenSSL >= 1.0..
|
|
|
+ </para>
|
|
|
+ <para>Default value: -1.</para>
|
|
|
+ <para>Range: -1 - 1073741824.</para>
|
|
|
+ <para>Type: integer.</para>
|
|
|
+ <para>
|
|
|
+ Read-only.
|
|
|
+ </para>
|
|
|
+</section>
|
|
|
+
|
|
|
+<section id="tls.ssl_max_send_fragment">
|
|
|
+ <title>tls.ssl_max_send_fragment</title>
|
|
|
+ <para>
|
|
|
+ sets the maximum number of bytes (clear text) send into one TLS
|
|
|
+ record. Valid values are between 512 and 16384. Works only for
|
|
|
+ OpenSSL >= 0.9.9.
|
|
|
+ </para>
|
|
|
+ <para>Default value: -1.</para>
|
|
|
+ <para>Range: -1 - 65536.</para>
|
|
|
+ <para>Type: integer.</para>
|
|
|
+ <para>
|
|
|
+ Read-only.
|
|
|
+ </para>
|
|
|
+</section>
|
|
|
+
|
|
|
+<section id="tls.ssl_read_ahead">
|
|
|
+ <title>tls.ssl_read_ahead</title>
|
|
|
+ <para>
|
|
|
+ Enables read ahead, reducing the number of BIO read calls done
|
|
|
+ internally by the OpenSSL library. Note that in newer tls
|
|
|
+ module versions it is better to have read ahead disabled, since
|
|
|
+ everything it is buffered in memory anyway.
|
|
|
+ </para>
|
|
|
+ <para>Default value: 0.</para>
|
|
|
+ <para>Range: -1 - 1.</para>
|
|
|
+ <para>Type: integer.</para>
|
|
|
+ <para>
|
|
|
+ Read-only.
|
|
|
+ </para>
|
|
|
+</section>
|
|
|
+
|
|
|
+<section id="tls.low_mem_threshold1">
|
|
|
+ <title>tls.low_mem_threshold1</title>
|
|
|
+ <para>
|
|
|
+ sets the minimum amount of free memory for accepting new TLS
|
|
|
+ connections (KB).
|
|
|
+ </para>
|
|
|
+ <para>Default value: -1.</para>
|
|
|
+ <para>Range: -1 - 1073741824.</para>
|
|
|
+ <para>Type: integer.</para>
|
|
|
+ <para>
|
|
|
+ </para>
|
|
|
+</section>
|
|
|
+
|
|
|
+<section id="tls.low_mem_threshold2">
|
|
|
+ <title>tls.low_mem_threshold2</title>
|
|
|
+ <para>
|
|
|
+ sets the minimum amount of free memory after which no more TLS
|
|
|
+ operations will be attempted (even on existing connections).
|
|
|
+ </para>
|
|
|
+ <para>Default value: -1.</para>
|
|
|
+ <para>Range: -1 - 1073741824.</para>
|
|
|
+ <para>Type: integer.</para>
|
|
|
+ <para>
|
|
|
+ </para>
|
|
|
+</section>
|
|
|
+
|
|
|
+<section id="tls.ct_wq_max">
|
|
|
+ <title>tls.ct_wq_max</title>
|
|
|
+ <para>
|
|
|
+ maximum bytes queued globally for write when write has to wait
|
|
|
+ due to TLS-level renegotiation (SSL_ERROR_WANT_READ) or initial
|
|
|
+ TLS connection establishment (it is different from tcp.wq_max,
|
|
|
+ which works at the TCP connection level).
|
|
|
+ </para>
|
|
|
+ <para>Default value: 10485760.</para>
|
|
|
+ <para>Range: 0 - 1073741824.</para>
|
|
|
+ <para>Type: integer.</para>
|
|
|
+ <para>
|
|
|
+ </para>
|
|
|
+</section>
|
|
|
+
|
|
|
+<section id="tls.con_ct_wq_max">
|
|
|
+ <title>tls.con_ct_wq_max</title>
|
|
|
+ <para>
|
|
|
+ maximum bytes queued for write per connection when write has to
|
|
|
+ wait due to TLS-level renegotiation (SSL_ERROR_WANT_READ) or
|
|
|
+ initial TLS connection establishment (it is different from
|
|
|
+ tcp.conn_wq_max, which works at the TCP connection level).
|
|
|
+ </para>
|
|
|
+ <para>Default value: 65536.</para>
|
|
|
+ <para>Range: 0 - 4194304.</para>
|
|
|
+ <para>Type: integer.</para>
|
|
|
+ <para>
|
|
|
+ </para>
|
|
|
+</section>
|
|
|
+
|
|
|
+<section id="tls.ct_wq_blk_size">
|
|
|
+ <title>tls.ct_wq_blk_size</title>
|
|
|
+ <para>
|
|
|
+ internal TLS pre-write (clear-text) queue minimum block size
|
|
|
+ (advanced tunning or debugging for now).
|
|
|
+ </para>
|
|
|
+ <para>Default value: 4096.</para>
|
|
|
+ <para>Range: 1 - 65536.</para>
|
|
|
+ <para>Type: integer.</para>
|
|
|
+ <para>
|
|
|
+ </para>
|
|
|
+</section>
|
|
|
+
|
|
|
+<section id="tls.send_close_notify">
|
|
|
+ <title>tls.send_close_notify</title>
|
|
|
+ <para>
|
|
|
+ enable/disable sending a close notify TLS shutdown alert before
|
|
|
+ closing the corresponding TCP connection.Note that having it
|
|
|
+ enabled has a performance impact..
|
|
|
+ </para>
|
|
|
+ <para>Default value: 0.</para>
|
|
|
+ <para>Range: 0 - 1.</para>
|
|
|
+ <para>Type: integer.</para>
|
|
|
+ <para>
|
|
|
+ </para>
|
|
|
+</section>
|
|
|
+
|
|
|
+</chapter>
|