VXVX Docs

TLS

TlsConfig and Certificate

Protos:

Set on TransportConfig.tls, MultiProxyInboundConfig.securityConfigs[].tls, Hysteria2 tlsConfig, and SplitHTTP downloadSettings.tls.

TlsConfig

FieldDescription
certificatesServer/client cert chain (Certificate[])
rootCasCustom root CA PEM blobs
issueCasCAs used to issue certs to peers
serverNameSNI; default = destination domain when dialing
disableSystemRootDo not use system root CAs
allowInsecureSkip certificate verification (client)
nextProtocolALPN list
enableSessionResumptionTLS session tickets / resumption
pinnedPeerCertificateChainSha256Pin peer cert chain hashes
verifyClientCertificateRequire valid client cert (server)
imitateuTLS client fingerprint name
noSNIDo not send SNI (uTLS)
forceAlpnTRANSPORT_PREFERENCE_TAKE_PRIORITY, NO_ALPN, UTLS_PRESET
masterKeyLogNSS key log path (debug)
echKeyServer ECH key
echConfigClient ECH config blob
enableEchClient: enable ECH

ForceALPN

ValueBehavior
TRANSPORT_PREFERENCE_TAKE_PRIORITYUser ALPN if set, else transport default
NO_ALPNDo not send ALPN extension
UTLS_PRESETUse uTLS preset ALPN

Certificate

FieldDescription
certificatePEM cert bytes
keyPEM private key bytes
certificateFilepathPath to cert file
keyFilepathPath to key file
{
  "transport": {
    "tcp": {},
    "tls": {
      "serverName": "example.com",
      "certificates": [
        {
          "certificateFilepath": "/etc/vx/fullchain.pem",
          "keyFilepath": "/etc/vx/privkey.pem"
        }
      ],
      "nextProtocol": ["h2", "http/1.1"]
    }
  }
}

Comments

On this page

TlsConfigForceALPNCertificateRelated