From: Olivier Houchard Date: Thu, 23 Jul 2026 22:30:18 +0000 (+0200) Subject: DOC: ssl: Document tune.ssl.keyupdate-rate-limit X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=89a97f666265dbbbedef065d6ed79f8ee7981588;p=thirdparty%2Fhaproxy.git DOC: ssl: Document tune.ssl.keyupdate-rate-limit Add documentation for tune.ssl.keyupdate-rate-limit This should be backported up to 2.8, when commit 91004114fe8816f848025fe71def4ea23e72a5f6 will be backported. --- diff --git a/doc/configuration.txt b/doc/configuration.txt index 6476565b8..a8e5192b1 100644 --- a/doc/configuration.txt +++ b/doc/configuration.txt @@ -1993,6 +1993,7 @@ The following keywords are supported in the "global" section : - tune.ssl.force-private-cache - tune.ssl.hard-maxrecord - tune.ssl.keylog + - tune.ssl.keyupdate-rate-limit - tune.ssl.lifetime - tune.ssl.maxrecord - tune.ssl.ssl-ctx-cache-size @@ -5565,6 +5566,12 @@ tune.ssl.keylog { on | off } $HAPROXY_KEYLOG_FC_LOG_FMT frontend (client-facing) connection keys $HAPROXY_KEYLOG_BC_LOG_FMT backend (server-facing) connection keys +tune.ssl.keyupdate-rate-limit + Limit the amount of KeyUpdate per second we're willing to accept to + before considering it flood, and killing the connection. Dealing with + KeyUpdate is cpu-expensive, and there is little reason to receive a lot of + them. Using a value of "0" disables the rate limiting. + The default value is 100. tune.ssl.lifetime Sets how long a cached SSL session may remain valid. This time is expressed in seconds and defaults to 300 (5 min). It is important to understand that it