tlsproxy
Connecting

Generate a CA

These are fixed once the CA exists (they are written to its config.yaml, whose ca section can't change them). It is renewed with the same key before it expires. What it issues is set in certificates, editable later with Settings.

Import a CA

Checked before anything is stored: it must be a CA allowed to sign certificates, the key must be its own, and a chain must be in order. Certificates it issues are sent with its chain (without the root), so clients that trust your root accept them.

CA settings

[certificates] says what this CA issues, and is read again as soon as it is saved: new certificates and renewals follow it; existing ones keep theirs until renewed. [ca] describes how the CA was made and can't be changed.

Config reference

Add rule

Examples

    Will be written to the config file
    
          

    Add listener

    0.0.0.0 all IPv4, :: all IPv6 and IPv4, or addresses separated by ;

    Will be written to the config file