Reference
tls
TLS configuration for connecting/authenticating with the remote if mutual TLS is required.
- Default value: n/a
- Hot reloadable: Yes
Values
| Type | Description | Choices |
|---|---|---|
object | An object with a set of explicit properties that can be set. | - |
Properties
| Name | Description | Type | Default |
|---|---|---|---|
cert_file | TLS certificate file. | string | - |
key_file | TLS certificate key file. | string | - |
ca_file | TLS certificate authority file. Defaults to system trust store. | string | - |
cipher_suites | When set, only the specified TLS cipher suites will be allowed. Values must match the golang version used to build the server. | string | - |
curve_preferences | List of TLS cipher curves to use in order. | string | - |
insecure | Skip certificate verification. This only applies to outgoing connections, NOT incoming client connections. not recommended. | boolean | - |
timeout | TLS handshake timeout. | duration | 500ms |
verify | If true, require and verify client certificates. Does not apply to monitoring. | boolean | false |
verify_and_map | If true, require and verify client certificates and map certificate values for authentication. Does not apply to monitoring. | boolean | false |
verify_cert_and_check_known_urls | Only used in a non-client context where verify is true, such as cluster and gateway configurations. The incoming connection's certificate x509v3 Subject Alternative Name DNS entries will be matched against all URLs. If a match is found, the connection is accepted and rejected otherwise. For gateways, the server will match all names in the certificate against the gateway URLs. For clusters, the server will match all names in the certificate against the route URLs. A consequence of this, is that dynamic cluster growth may require config changes in other clusters where this option is true. DNS name checking is performed according to RFC6125. Only the full wildcard is supported for the the left most domain. | boolean | - |
connection_rate_limit | integer | - | |
pinned_certs | List of hex-encoded SHA256 of DER-encoded public key fingerprints. When present, during the TLS handshake, the provided certificate's fingerprint is required to be present in the list, otherwise the connection will be closed. | string | - |