This virtual server controls caching of TLS sessions.
When a TLS session is used, the server will automatically create the following attributes in the session-state list. These attributes are the ones for the server certificate.
If a client certificate is required (e.g. EAP-TLS or sometimes PEAP / TTLS), the following attributes are also created in the session-state list:
This section can be run to verify a client certificate if additional checks need to be performed beyond standard checks verification against a trust chain, CRLs and OCSP.
Attributes extracted from the certificates forming the client certificate chain will be in the session state list.
Returning 'ok', 'updated' or 'noop' will cause the verification to succeed. Other return codes will cause the verification to fail.
This section is run whenever the server needs to read an entry from the TLS session cache.
It should read the attribute &session-state.TLS-Session-Data from the cache, along with any other attributes which were in the cache
On success it should return 'ok' or 'updated'.
The return code has no real effect on session processing and will just cause the server to emit a warning.
This section is run whenever the server needs to write an entry to the TLS session cache.
It should write the attribute &session-state.Session-Data to the cache, along with any other attributes which need to be cached.
On success it should return 'ok' or 'updated'.
The return code has no real effect on session processing and will just cause the server to emit a warning.
This section is run whenever the server needs to delete an entry from the TLS session cache.
On success it should return 'ok', 'updated', 'noop' or 'notfound'
The return code has no real effect on session processing and will just cause the server to emit a warning.
This section is run after certificate attributes are added to the request list, and before performing OCSP validation.
It should read the attribute &control.TLS-OCSP-Cert-Valid from the cache.
On success it should return 'ok', 'updated', 'noop' or 'notfound' To force OCSP validation failure, it should return 'reject'.
This section is run after OCSP validation has completed.
It should write the attribute &reply.TLS-OCSP-Cert-Valid to the cache.
On success it should return 'ok' or 'updated'.
The return code has no real effect on session processing and will just cause the server to emit a warning.
Default Configuration
# TLS-Cert-Serial
# TLS-Cert-Expiration
# TLS-Cert-Subject
# TLS-Cert-Issuer
# TLS-Cert-Common-Name
# TLS-Cert-Subject-Alt-Name-Email
# TLS-Client-Cert-Serial
# TLS-Client-Cert-Expiration
# TLS-Client-Cert-Subject
# TLS-Client-Cert-Issuer
# TLS-Client-Cert-Common-Name
# TLS-Client-Cert-Subject-Alt-Name-Email
server tls-cache {
namespace = tls
verify certificate {
ok
}
load session {
&control.Cache-Allow-Insert := no
cache_tls_session
}
store session {
&control.Cache-TTL := 0
cache_tls_session
}
clear session {
&control.Cache-TTL := 0
&control.Cache-Allow-Insert := no
cache_tls_session
}
load ocsp-state {
&control.Cache-Allow-Insert := no
cache_ocsp
}
store ocsp-state {
&control.Cache-TTL := "%{&reply.TLS-OCSP-Next-Update * -1}"
&control.Cache-Allow-Merge := no
cache_ocsp
}
}