tls_verify_certificates = DRSA/server2.example.com/ca_chain.pem
+.ifdef _OPT_OPENSSL_NO_TLSV1_3_X
+openssl_options = +no_tlsv1_3
+.endif
# ------ ACL ------
begin acl
!encrypted = *
logwrite = cipher: $tls_in_cipher
# This appears to lie. Despite what's on the wire, it returns the last cert loaded.
+# Fixed in OpenSSL 1.1.1 ? Testcase golden logfile has the incorrect value.
warn logwrite = ${if def:tls_in_ourcert \
{Our cert SN: <${certextract{subject}{$tls_in_ourcert}}>} \
{We did not present a cert}}
logwrite = sha1 fingerprint ${sha1:$tls_in_peercert}
logwrite = sha256 fingerprint ${sha256:$tls_in_peercert}
logwrite = der_b64 ${base64:$tls_in_peercert}
+ logwrite = cipher: $tls_in_cipher
+ logwrite = cipher_ $tls_in_cipher_std
+ logwrite = ver: $tls_in_ver
# ----- Routers -----