tls

Hot Reloadable

New TLS settings apply to route connections established after the reload; existing routes keep the old TLS session.

TLS configuration for securing cluster connections. verify is always enabled and cert_file is used for both client and server for mutual TLS.

Properties

Name	Description	Type	Default	Reloadable
allow_insecure_cipher_suites	Permit cipher suites Go considers insecure to be named in cipher_suites. Without it those names are rejected.	boolean	false	Yes
cert_store	Load the certificate from an OS certificate store rather than a file. Windows only.	string	-	Yes
certs	Multiple certificate/key pairs to serve, so one listener can present different certificates to different clients. Use this instead of cert_file and key_file.	object	-	Yes
handshake_first	Send the TLS handshake before the INFO protocol message rather than after. A duration string instead of true waits that long for a client that may not support it before falling back.	(multiple)	false	Yes
min_version	Lowest TLS version the server will negotiate.	string	-	Yes
ocsp_peer	Verify the peer's certificate against its OCSP responder and reject revoked certificates. Set an object to tune the checks.	(multiple)	false	Yes
cert_file	TLS certificate file.	string	-	Yes*
key_file	TLS certificate key file.	string	-	Yes*
ca_file	TLS certificate authority file. Defaults to system trust store.	string	-	Yes*
cipher_suites	When set, only the specified TLS cipher suites will be allowed. Values must match the golang version used to build the server.	string	-	Yes*
curve_preferences	List of TLS cipher curves to use in order.	string	-	Yes*
insecure	Skip certificate verification. This only applies to outgoing connections, NOT incoming client connections. not recommended.	boolean	-	Yes*
timeout	TLS handshake timeout.	duration	500ms	Yes*
verify	If true, require and verify client certificates. Does not apply to monitoring.	boolean	false	Ignored*
verify_and_map	If true, require and verify client certificates and map certificate values for authentication. Does not apply to monitoring.	boolean	false	Yes*
verify_cert_and_check_known_urls	Only used in a non-client context where verify is true, such as cluster and gateway configurations. The incoming connection's certificate x509v3 Subject Alternative Name DNS entries will be matched against all URLs. If a match is found, the connection is accepted and rejected otherwise. For gateways, the server will match all names in the certificate against the gateway URLs. For clusters, the server will match all names in the certificate against the route URLs. A consequence of this, is that dynamic cluster growth may require config changes in other clusters where this option is true. DNS name checking is performed according to RFC6125. Only the full wildcard is supported for the the left most domain.	boolean	-	Yes*
connection_rate_limit		integer	-	Ignored*
pinned_certs	List of hex-encoded SHA256 of DER-encoded public key fingerprints. When present, during the TLS handshake, the provided certificate's fingerprint is required to be present in the list, otherwise the connection will be closed.	string	-	Yes*

* See the property page for reload caveats.