|
|
@@ -11,56 +11,55 @@
|
|
|
|
|
|
## Note: Modifying the 'sslname' to what you need
|
|
|
listeners.ssl.sslname {
|
|
|
- ## Whether to enable the listener
|
|
|
- enable = true
|
|
|
-
|
|
|
- ## Port or Address to listen on
|
|
|
+ ## Port or Address to listen on, 0 means disable
|
|
|
bind = 8883 ## or with an IP e.g. "127.0.0.1:8883"
|
|
|
|
|
|
- ## Trusted PEM format CA certificates bundle file
|
|
|
- cacertfile = "data/certs/cacert.pem"
|
|
|
+ ssl_options {
|
|
|
+ ## Trusted PEM format CA certificates bundle file
|
|
|
+ cacertfile = "data/certs/cacert.pem"
|
|
|
|
|
|
- ## PEM format certificates chain file
|
|
|
- certfile = "data/certs/cert.pem"
|
|
|
+ ## PEM format certificates chain file
|
|
|
+ certfile = "data/certs/cert.pem"
|
|
|
|
|
|
- ## PEM format private key file
|
|
|
- keyfile = "data/certs/key.pem"
|
|
|
+ ## PEM format private key file
|
|
|
+ keyfile = "data/certs/key.pem"
|
|
|
|
|
|
- ## Enable or disable peer verification
|
|
|
- verify = verify_none ## use verify_peer to enable
|
|
|
+ ## Enable or disable peer verification
|
|
|
+ verify = verify_none ## use verify_peer to enable
|
|
|
|
|
|
- ## if `verify' is ebabled, whit true, the connection fails if the client does not have a certificate to send
|
|
|
- fail_if_no_peer_cert = false
|
|
|
+ ## if `verify' is ebabled, whit true, the connection fails if the client does not have a certificate to send
|
|
|
+ fail_if_no_peer_cert = false
|
|
|
|
|
|
- ## Enable TLS session reuse
|
|
|
- reuse_sessions = true
|
|
|
+ ## Enable TLS session reuse
|
|
|
+ reuse_sessions = true
|
|
|
|
|
|
- ## Maximum number of non-self-issued intermediate certificates that can follow the peer certificate in a valid certification path
|
|
|
- depth = 10
|
|
|
+ ## Maximum number of non-self-issued intermediate certificates that can follow the peer certificate in a valid certification path
|
|
|
+ depth = 10
|
|
|
|
|
|
- ## Which versions are to be supported
|
|
|
- versions = [tlsv1.3, tlsv1.2]
|
|
|
+ ## Which versions are to be supported
|
|
|
+ versions = [tlsv1.3, tlsv1.2]
|
|
|
|
|
|
- ## TLS cipher suite names
|
|
|
- ## Note: By default, all available suites are supported, you do not need to set this
|
|
|
- ciphers = ["TLS_AES_256_GCM_SHA384","TLS_AES_128_GCM_SHA256"]
|
|
|
+ ## TLS cipher suite names
|
|
|
+ ## Note: By default, all available suites are supported, you do not need to set this
|
|
|
+ ciphers = ["TLS_AES_256_GCM_SHA384","TLS_AES_128_GCM_SHA256"]
|
|
|
|
|
|
- ## Allows a client and a server to renegotiate the parameters of the SSL connection on the fly
|
|
|
- secure_renegotiate = true
|
|
|
+ ## Allows a client and a server to renegotiate the parameters of the SSL connection on the fly
|
|
|
+ secure_renegotiate = true
|
|
|
|
|
|
- ## Log level for SSL communication
|
|
|
- ## Type: emergency | alert | critical | error | warning | notice | info | debug | none | all
|
|
|
- log_level = notice
|
|
|
+ ## Log level for SSL communication
|
|
|
+ ## Type: emergency | alert | critical | error | warning | notice | info | debug | none | all
|
|
|
+ log_level = notice
|
|
|
|
|
|
- ## Hibernate the SSL process after idling for amount of time reducing its memory footprint
|
|
|
- hibernate_after = 5s
|
|
|
+ ## Hibernate the SSL process after idling for amount of time reducing its memory footprint
|
|
|
+ hibernate_after = 5s
|
|
|
|
|
|
- ## Forces the cipher to be set based on the server-specified order instead of the client-specified order
|
|
|
- honor_cipher_order = true
|
|
|
+ ## Forces the cipher to be set based on the server-specified order instead of the client-specified order
|
|
|
+ honor_cipher_order = true
|
|
|
|
|
|
- ## Setting this to false to disable client-initiated renegotiation
|
|
|
- client_renegotiation = true
|
|
|
+ ## Setting this to false to disable client-initiated renegotiation
|
|
|
+ client_renegotiation = true
|
|
|
|
|
|
- ## Maximum time duration allowed for the handshake to complete
|
|
|
- handshake_timeout = 15s
|
|
|
+ ## Maximum time duration allowed for the handshake to complete
|
|
|
+ handshake_timeout = 15s
|
|
|
+ }
|
|
|
}
|