tls.options

TLS options

These options apply inside a tls block for a server listener, backend, cluster connection, logger, or EAP method. Select named certificates and keys from the certificates configuration. Repeat alpn_protocol, server_ca_certificate, client_ca_certificate, or crl when multiple values are needed.

For outbound clients, check-local-certificate-expiry enables local expiry enforcement and defaults to false for compatibility. When enabled, certificate-expiry-grace-period controls the allowance and defaults to 0s.

Use min_protocol_version and max_protocol_version with tlsv12 or tlsv13. Use negotiation for cipher suite and key exchange restrictions. Session resumption options control the ticket or session ID lifetime and cache size. keylog_filename exposes TLS traffic keys and should only be used during controlled troubleshooting.

Use keylog_filename "capture:NAME"; to embed secrets in a named capture instead of a separate key log file.