43         assert(IS_TCP(c->transport) && settings.ssl_enabled);  in ssl_accept()
45         if (settings.ssl_ctx == NULL) {  in ssl_accept()
46             if (settings.verbose) {  in ssl_accept()
53         ssl = SSL_new(settings.ssl_ctx);  in ssl_accept()
56             if (settings.verbose) {  in ssl_accept()
236     size_t buf_remain = settings.ssl_wbuf_size;  in ssl_sendmsg()
297     if (settings.ssl_ctx == NULL) {  in load_server_certificates()
313     if (!SSL_CTX_use_certificate_chain_file(settings.ssl_ctx,  in load_server_certificates()
314         settings.ssl_chain_cert)) {  in load_server_certificates()
317             "%s : %s", settings.ssl_chain_cert, ssl_err_msg);  in load_server_certificates()
318     } else if (!SSL_CTX_use_PrivateKey_file(settings.ssl_ctx, settings.ssl_key,  in load_server_certificates()
319                                         settings.ssl_keyformat)) {  in load_server_certificates()
322             settings.ssl_key, ssl_err_msg);  in load_server_certificates()
323     } else if (!SSL_CTX_check_private_key(settings.ssl_ctx)) {  in load_server_certificates()
327     } else if (settings.ssl_ca_cert) {  in load_server_certificates()
328         if (!SSL_CTX_load_verify_locations(settings.ssl_ctx,  in load_server_certificates()
329           settings.ssl_ca_cert, NULL)) {  in load_server_certificates()
333               settings.ssl_ca_cert, ssl_err_msg);  in load_server_certificates()
335             SSL_CTX_set_client_CA_list(settings.ssl_ctx,  in load_server_certificates()
336               SSL_load_client_CA_file(settings.ssl_ca_cert));  in load_server_certificates()
345         settings.ssl_last_cert_refresh_time = current_time;  in load_server_certificates()
375     settings.ssl_enabled = false;  in ssl_init_settings()
376     settings.ssl_ctx = NULL;  in ssl_init_settings()
377     settings.ssl_chain_cert = NULL;  in ssl_init_settings()
378     settings.ssl_key = NULL;  in ssl_init_settings()
379     settings.ssl_verify_mode = SSL_VERIFY_NONE;  in ssl_init_settings()
380     settings.ssl_keyformat = SSL_FILETYPE_PEM;  in ssl_init_settings()
381     settings.ssl_ciphers = NULL;  in ssl_init_settings()
382     settings.ssl_ca_cert = NULL;  in ssl_init_settings()
383     settings.ssl_last_cert_refresh_time = current_time;  in ssl_init_settings()
384     settings.ssl_wbuf_size = 16 * 1024; // default is 16KB (SSL max frame size is 17KB)  in ssl_init_settings()
385     settings.ssl_session_cache = false;  in ssl_init_settings()
386     settings.ssl_kernel_tls = false;  in ssl_init_settings()
387     settings.ssl_min_version = TLS1_2_VERSION;  in ssl_init_settings()
394     assert(settings.ssl_enabled);  in ssl_init()
400     settings.ssl_ctx = SSL_CTX_new(TLS_server_method());  in ssl_init()
402     SSL_CTX_set_min_proto_version(settings.ssl_ctx, settings.ssl_min_version);  in ssl_init()
413     SSL_CTX_set_verify(settings.ssl_ctx, settings.ssl_verify_mode, NULL);  in ssl_init()
414     if (settings.ssl_ciphers && !SSL_CTX_set_cipher_list(settings.ssl_ctx,  in ssl_init()
415                                                     settings.ssl_ciphers)) {  in ssl_init()
417                 settings.ssl_ciphers);  in ssl_init()
422     if (settings.ssl_session_cache) {  in ssl_init()
423         SSL_CTX_sess_set_new_cb(settings.ssl_ctx, ssl_new_session_callback);  in ssl_init()
424         SSL_CTX_set_session_cache_mode(settings.ssl_ctx, SSL_SESS_CACHE_SERVER);  in ssl_init()
425         SSL_CTX_set_session_id_context(settings.ssl_ctx,  in ssl_init()
429         SSL_CTX_set_session_cache_mode(settings.ssl_ctx, SSL_SESS_CACHE_OFF);  in ssl_init()
433     if (settings.ssl_kernel_tls) {  in ssl_init()
435         SSL_CTX_set_options(settings.ssl_ctx, SSL_OP_ENABLE_KTLS);  in ssl_init()
445     SSL_CTX_set_options(settings.ssl_ctx, SSL_OP_NO_RENEGOTIATION);  in ssl_init()
449     SSL_CTX_set_mode(settings.ssl_ctx, SSL_MODE_RELEASE_BUFFERS);  in ssl_init()
501            "                          (default: %u)\n", settings.ssl_wbuf_size / (1 << 10));  in ssl_help()
506            ssl_proto_text(settings.ssl_min_version));  in ssl_help()
516     verify_default("ssl_keyformat", settings.ssl_keyformat == SSL_FILETYPE_PEM);  in ssl_help()
517     verify_default("ssl_verify_mode", settings.ssl_verify_mode == SSL_VERIFY_NONE);  in ssl_help()
518     verify_default("ssl_min_version", settings.ssl_min_version == TLS1_2_VERSION);  in ssl_help()
544             settings.ssl_verify_mode = SSL_VERIFY_NONE;  in ssl_set_verify_mode()
547             settings.ssl_verify_mode = SSL_VERIFY_PEER;  in ssl_set_verify_mode()
550             settings.ssl_verify_mode = SSL_VERIFY_PEER |  in ssl_set_verify_mode()
554             settings.ssl_verify_mode = SSL_VERIFY_PEER |  in ssl_set_verify_mode()
567             settings.ssl_min_version = TLS1_VERSION;  in ssl_set_min_version()
570             settings.ssl_min_version = TLS1_1_VERSION;  in ssl_set_min_version()
573             settings.ssl_min_version = TLS1_2_VERSION;  in ssl_set_min_version()
577             settings.ssl_min_version = TLS1_3_VERSION;  in ssl_set_min_version()