NAME

       tlshd.conf - tlshd configuration file

SYNOPSIS

       /etc/tlshd.conf

DESCRIPTION

       The  tlshd  program implements a user agent that services TLS handshake requests on behalf
       of kernel TLS consumers.  Its configuration file contains  information  that  the  program
       reads when it starts up.  The file is designed to be human readable and contains a list of
       keywords with values that provide various types of information.  The configuration file is
       considered a trusted source of information.

       The  tlshd  program  reads  this file once when it is launched.  Thus changes made in this
       file take effect only when the lshd program is restarted.  If this file  does  not  exist,
       the tlshd program exits immediately.

OPTIONS

       The configuration file is split into sections.

       The  [main]  section  specifies run-time settings for the tlshd program.  In this section,
       there are two available options:

       debug  This option specifies an integer which indicates the debug  message  level.   Zero,
              the quietest setting, is the default.

       tlsdebug
              This  option  specifies  an integer which indicates the debug message level for TLS
              library calls.  Zero, the quietest setting, is the default.

       nl_debug
              This option specifies an integer  which  indicates  the  debug  message  level  for
              netlink operations.  Zero, the quietest setting, is the default.

       keyrings
              This  option  specifies a semicolon-separated list of auxiliary keyrings that might
              contain handshake authentication tokens.   tlshd  links  these  keyrings  into  its
              session  keyring.   The  configuration  file may specify either a keyring's name or
              serial number.  The default is to provide no keyring.

       The [authentication] section specifies default authentication material  when  establishing
       TLS  sessions.   There  are  two  subsections:  [client]and[server].   In  each  of  these
       subsections, there are two available options:

       x509.certificate
              This option specifies the  pathname  of  a  file  containing  a  PEM-encoded  x.509
              certificate  that  is  to  be  presented during a ClientHello request when no other
              certificate is available.

       x509.private_key
              This option specifies the pathname of a file containing a PEM-encoded  private  key
              associated with the above certificate.

NOTES

       This  software  is  a  prototype.   It's  purpose  is for demonstration and as a proof-of-
       concept.  USE THIS SOFTWARE AT YOUR OWN RISK.

SEE ALSO

       tlshd(8)

AUTHOR

       Chuck Lever

                                           20 Oct 2022                              tlshd.conf(5)