| # sni.yaml |
| # |
| # Documentation: |
| # https://docs.trafficserver.apache.org/en/latest/admin-guide/files/sni.yaml.en.html |
| # |
| # |
| # This configuration file |
| # - sets the SSL actions to be performed based on the servername provided during SSL handshake phase (SNI extension) |
| # - sets the SSL properties required to make SSL connection with the next hop or origin server. |
| # |
| # YAML-based Configuration file |
| # Format : |
| # Actions available: |
| # ip_allow - lists or range of client IP addresses, subnets that are allowed for this connection. This accepts CIDR format |
| # for subnet specification. |
| # verify_server_policy - sets the verification flag for verifying the server certificate; parameters = one of 'DISABLED', 'PERMISSIVE', 'ENFORCED' |
| # verify_server_properties - sets the flag to control what Traffic Server checks when evaluating the origin certificate; |
| # parameters = one of 'NONE', 'SIGNATURE', 'NAME', and 'ALL' |
| # verify_client - sets the verification flag for verifying the client certificate; parameters = one of 'NONE', 'MODERATE' or 'STRICT' |
| # verify_client_ca_certs - specifies an alternate set of certificate authority certs to use to verify the client cert. |
| # host_sni_policy - sets the flag to control how policy impacting mismatches between host header and SNI values are dealt with; |
| # parameters = one of 'DISABLED', 'PERMISSIVE', or 'ENFORCED' |
| # valid_tls_versions_in - sets the list of TLS protocols that will be offered to user agents during the TLS negotiation; |
| # parameters = one of 'TLSv1', 'TLSv1_1', 'TLSv1_2', and 'TLSv1_3'. |
| # client_cert - sets the client certificate to present to the server specified in dest_host; parameters = certificate file . |
| # The location of the certificate file is relative to proxy.config.ssl.server.cert.path directory. |
| # client_key - sets the file containing the client private key that corresponds to the certificate for the outbound connection. |
| # client_sni_policy - policy of SNI on outbound connection. |
| # http2 - adds or removes HTTP/2 (H2) from the protocol list advertised by ATS; parameter required = None, parameters = on or off |
| # tunnel_route - sets the e2e tunnel route |
| # forward_route - destination as an FQDN and port, separated by a colon :. |
| # this is similar to tunnel_route, but it terminates the TLS connection and forwards the decrypted traffic. |
| # partial_blind_route - destination as an FQDN and port, separated by a colon :. |
| # this is similar to forward_route in that Traffic Server terminates the incoming TLS connection. |
| # in addition partial_blind_route creates a new TLS connection to the specified origin. |
| # tunnel_alpn - list of ALPN Protocol Ids for Partial Blind Tunnel. |
| # |
| # Example: |
| # sni: |
| # - fqdn: one.com |
| # http2: off |
| # verify_server_policy: ENFORCED |
| # client_cert: somepem.pem |
| # verify_client: MODERATE |
| # - fqdn: two.com |
| # tunnel_route: two.com |
| # ip_allow: '10.0.0.1-10.0.0.255' |
