TLS Settings

TLS Options

Option	Type	Default	Description
`sni`	string	auto	Server Name Indication hostname
`alpn`	list	`[]`	ALPN protocol negotiation
`skip_verify`	bool	`false`	Skip certificate verification
`ca`	string	optional	Custom CA certificate path

By default, the SNI hostname is extracted from the remote address. Override it with:

[client.tls]
sni = "custom-hostname.example.com"

This is useful when the server's TLS certificate uses a different domain than the connection address.

[client.tls]
alpn = ["h2", "http/1.1"]

ALPN (Application-Layer Protocol Negotiation) is advertised during the TLS handshake. Match the server's ALPN configuration for compatibility.

To connect to a server using a self-signed certificate or a private CA:

[client.tls]
ca = "/path/to/server-ca.pem"

The client will trust certificates signed by this CA in addition to the system certificate store.

For testing with self-signed certificates where you don't have the CA:

[client.tls]
skip_verify = true

Do not use in production. This disables all certificate validation, making the connection vulnerable to man-in-the-middle attacks.