# Configuration Variables for tls

## tls.force_run

force loading the tls module even when initial sanity checks fail.

Default value: 0.

Range: 0 - 1.

Type: integer.

Read-only.

## tls.method

TLS method used (TLSv1, SSLv3, SSLv2, SSLv23).

Default value: <unknown:str>.

Type: string.

Read-only.

## tls.verify_certificate

if enabled the certificates will be verified.

Default value: 0.

Range: 0 - 1.

Type: integer.

Read-only.

## tls.verify_depth

sets how far up the certificate chain will the certificate verification go in the search for a trusted CA.

Default value: 9.

Range: 0 - 100.

Type: integer.

Read-only.

## tls.require_certificate

if enabled a certificate will be required from clients.

Default value: 0.

Range: 0 - 1.

Type: integer.

Read-only.

## tls.private_key

name of the file containing the private key (pem format), if not contained in the certificate file.

Default value: <unknown:str>.

Type: string.

Read-only.

## tls.ca_list

name of the file containing the trusted CA list (pem format).

Default value: <unknown:str>.

Type: string.

Read-only.

## tls.crl

name of the file containing the CRL (certificare revocation list in pem format).

Default value: <unknown:str>.

Type: string.

Read-only.

## tls.certificate

name of the file containing the certificate (pem format).

Default value: <unknown:str>.

Type: string.

Read-only.

## tls.cipher_list

list of the accepted ciphers (strings separated by colons).

Default value: <unknown:str>.

Type: string.

Read-only.

## tls.session_cache

enables or disables the session cache.

Default value: 0.

Range: 0 - 1.

Type: integer.

Read-only.

## tls.session_id

string used for the session id.

Default value: <unknown:str>.

Type: string.

Read-only.

## tls.config

tls config file name (used for the per domain options).

Default value: <unknown:str>.

Type: string.

## tls.log

tls info messages log level.

Default value: 3.

Range: 0 - 1000.

Type: integer.

## tls.debug

tls debug messages log level.

Default value: 3.

Range: 0 - 1000.

Type: integer.

## tls.connection_timeout

initial connection lifetime (in s) (obsolete).

Default value: 600.

Range: -1 - -2147483648.

Type: integer.

## tls.disable_compression

if set disable the built-in OpenSSL compression.

Default value: 1.

Range: 0 - 1.

Type: integer.

Read-only.

## tls.ssl_release_buffers

quickly release internal OpenSSL read or write buffers. Works only for OpenSSL >= 1.0..

Default value: -1.

Range: -1 - 1.

Type: integer.

Read-only.

## tls.ssl_free_list_max

maximum number of free/cached memory chunks that OpenSSL will keep per connection. Works only for OpenSSL >= 1.0..

Default value: -1.

Range: -1 - 1073741824.

Type: integer.

Read-only.

## tls.ssl_max_send_fragment

sets the maximum number of bytes (clear text) send into one TLS record. Valid values are between 512 and 16384. Works only for OpenSSL >= 0.9.9.

Default value: -1.

Range: -1 - 65536.

Type: integer.

Read-only.

## tls.ssl_read_ahead

Enables read ahead, reducing the number of BIO read calls done internally by the OpenSSL library. Note that in newer tls module versions it is better to have read ahead disabled, since everything it is buffered in memory anyway.

Default value: 0.

Range: -1 - 1.

Type: integer.

Read-only.

## tls.low_mem_threshold1

sets the minimum amount of free memory for accepting new TLS connections (KB).

Default value: -1.

Range: -1 - 1073741824.

Type: integer.

## tls.low_mem_threshold2

sets the minimum amount of free memory after which no more TLS operations will be attempted (even on existing connections).

Default value: -1.

Range: -1 - 1073741824.

Type: integer.

## tls.ct_wq_max

maximum bytes queued globally for write when write has to wait due to TLS-level renegotiation (SSL_ERROR_WANT_READ) or initial TLS connection establishment (it is different from tcp.wq_max, which works at the TCP connection level).

Default value: 10485760.

Range: 0 - 1073741824.

Type: integer.

## tls.con_ct_wq_max

maximum bytes queued for write per connection when write has to wait due to TLS-level renegotiation (SSL_ERROR_WANT_READ) or initial TLS connection establishment (it is different from tcp.conn_wq_max, which works at the TCP connection level).

Default value: 65536.

Range: 0 - 4194304.

Type: integer.

## tls.ct_wq_blk_size

internal TLS pre-write (clear-text) queue minimum block size (advanced tunning or debugging for now).

Default value: 4096.

Range: 1 - 65536.

Type: integer.

## tls.send_close_notify

enable/disable sending a close notify TLS shutdown alert before closing the corresponding TCP connection.Note that having it enabled has a performance impact..

Default value: 0.

Range: 0 - 1.

Type: integer.