tlsproxy
Connecting

Generate a CA

These are fixed once the CA exists (they are written to its config.toml, whose [ca] section can't change them). It is renewed with the same key before it expires. What it issues is set in [certificates], editable later with Settings.

Import a CA

Checked before anything is stored: it must be a CA allowed to sign certificates, the key must be its own, and a chain must be in order. Certificates it issues are sent with its chain (without the root), so clients that trust your root accept them.

CA settings

[certificates] says what this CA issues, and is read again as soon as it is saved: new certificates and renewals follow it; existing ones keep theirs until renewed. [ca] describes how the CA was made and can't be changed.

Config reference

Add rule

Examples

    Will be written to the config file
    
      
    
    
    

    
    
      
      
      
      
      
    
    
  
    
    


  
    
    
    Add listener
    
    
    

    
      
      
      2. 
      
      3. 
    
    

    
    
      
    
        
        
        
      
    
      
    0.0.0.0 all IPv4, :: all IPv6 and IPv4, or addresses separated by ;
    
    
    

    

    
    
      
      
      
      
    
        
    Will be written to the config file