From 89a97f666265dbbbedef065d6ed79f8ee7981588 Mon Sep 17 00:00:00 2001 From: Olivier Houchard Date: Fri, 24 Jul 2026 00:30:18 +0200 Subject: [PATCH] DOC: ssl: Document tune.ssl.keyupdate-rate-limit Add documentation for tune.ssl.keyupdate-rate-limit This should be backported up to 2.8, when commit 91004114fe8816f848025fe71def4ea23e72a5f6 will be backported. --- doc/configuration.txt | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/doc/configuration.txt b/doc/configuration.txt index 6476565b8..a8e5192b1 100644 --- a/doc/configuration.txt +++ b/doc/configuration.txt @@ -1993,6 +1993,7 @@ The following keywords are supported in the "global" section : - tune.ssl.force-private-cache - tune.ssl.hard-maxrecord - tune.ssl.keylog + - tune.ssl.keyupdate-rate-limit - tune.ssl.lifetime - tune.ssl.maxrecord - tune.ssl.ssl-ctx-cache-size @@ -5565,6 +5566,12 @@ tune.ssl.keylog { on | off } $HAPROXY_KEYLOG_FC_LOG_FMT frontend (client-facing) connection keys $HAPROXY_KEYLOG_BC_LOG_FMT backend (server-facing) connection keys +tune.ssl.keyupdate-rate-limit + Limit the amount of KeyUpdate per second we're willing to accept to + before considering it flood, and killing the connection. Dealing with + KeyUpdate is cpu-expensive, and there is little reason to receive a lot of + them. Using a value of "0" disables the rate limiting. + The default value is 100. tune.ssl.lifetime Sets how long a cached SSL session may remain valid. This time is expressed in seconds and defaults to 300 (5 min). It is important to understand that it -- 2.47.3