tls

Hot Reloadable

New TLS material is used by connections established after the reload; existing client connections keep the session they negotiated. pinned_certs is applied to existing connections immediately.

TLS configuration for client and HTTP monitoring.

Properties

Name	Description	Type	Default	Reloadable
allow_insecure_cipher_suites	Permit cipher suites Go considers insecure to be named in cipher_suites. Without it those names are rejected.	boolean	false	Yes
cert_store	Load the certificate from an OS certificate store rather than a file. Windows only.	string	-	Yes
certs	Multiple certificate/key pairs to serve, so one listener can present different certificates to different clients. Use this instead of cert_file and key_file.	object	-	Yes
handshake_first	Send the TLS handshake before the INFO protocol message rather than after. A duration string instead of true waits that long for a client that may not support it before falling back.	(multiple)	false	Yes
min_version	Lowest TLS version the server will negotiate.	string	-	Yes
ocsp_peer	Verify the peer's certificate against its OCSP responder and reject revoked certificates. Set an object to tune the checks.	(multiple)	false	Yes
cert_file	TLS certificate file.	string	-	Yes*
key_file	TLS certificate key file.	string	-	Yes*
ca_file	TLS certificate authority file. Defaults to system trust store.	string	-	Yes*
cipher_suites	When set, only the specified TLS cipher suites will be allowed. Values must match the golang version used to build the server.	string	-	Yes
curve_preferences	List of TLS cipher curves to use in order.	string	-	Yes
insecure	Skip certificate verification. This only applies to outgoing connections, NOT incoming client connections. not recommended.	boolean	-	Yes*
timeout	TLS handshake timeout.	duration	500ms	Yes
verify	If true, require and verify client certificates. Does not apply to monitoring.	boolean	false	Yes*
verify_and_map	If true, require and verify client certificates and map certificate values for authentication. Does not apply to monitoring.	boolean	false	No
verify_cert_and_check_known_urls	Only used in a non-client context where verify is true, such as cluster and gateway configurations. The incoming connection's certificate x509v3 Subject Alternative Name DNS entries will be matched against all URLs. If a match is found, the connection is accepted and rejected otherwise. For gateways, the server will match all names in the certificate against the gateway URLs. For clusters, the server will match all names in the certificate against the route URLs. A consequence of this, is that dynamic cluster growth may require config changes in other clusters where this option is true. DNS name checking is performed according to RFC6125. Only the full wildcard is supported for the the left most domain.	boolean	-	No*
connection_rate_limit		integer	-	No*
pinned_certs	List of hex-encoded SHA256 of DER-encoded public key fingerprints. When present, during the TLS handshake, the provided certificate's fingerprint is required to be present in the list, otherwise the connection will be closed.	string	-	Yes*

* See the property page for reload caveats.