...

• When we no longer need a read buffer or a write buffer for a given SSL, then release the memory we were using to hold it. Released memory is either appended to a list of unused RAM chunks on the SSL_CTX, or simply freed if the list of unused chunks would become longer than SSL_CTX->freelist_max_len, which defaults to 32. Using this flag can save around 34K per idle SSL connection. This flag has no effect on SSL v2 connections, or on DTLS connections.
• ref: http://www.openssl.org/docs/ssl/SSL_CTX_set_mode.html

  Code Block
  #ifdef SSL_MODE_RELEASE_BUFFERS SSL_CTX_set_mode(ctx, SSL_MODE_RELEASE_BUFFERS); #endif

  3

4. Expose API to extract peer certificate data

• When verifying peer certificates, A few customers expect to obtain the specific cert data (i.e. subject, issuer info) and forward them to origin servers. It's better to expose API to extract peer certificate data.
• Status: https://issues.apache.org/jira/browse/TS-2210

...

5. SSL_read size threshold

• A few customers expect a size threshold for client request over ssl from protecting system perspective. If the max requested data exceed the threshold, server will reject the client connection.

...

6. Specific mode for verifying peer certificate

• Current 'mode' for verifying peer certificate is a global option, it's good to have specific mode among different sites hosted on a same machine. If the mode is non-empty, it would be the preference when making the decision to verify peer or not. Otherwise, the global mode will take effect.

  Code Block
  # Client certification level should be: # 0 no client certificates # 1 client certificates optional # 2 client certificates required CONFIG proxy.config.ssl.client.certification_level INT 0