1.

...

SSL

...

• ref: http://www.igvita.com/2013/10/24/optimizing-tls-record-size-and-buffering-latency/^{Image Removed}

...

2. Configurable session time

• Session size is configurable, whereas application can not specify a session time out threshold. The default is 300 seconds. In some cases, applications need to reduce or increase the caching time, it's good to be configurable.

3. Release memory for idle ssl connection

...

_

...

#ifdef SSL_MODE_RELEASE_BUFFERS
    SSL_CTX_set_mode(ctx, SSL_MODE_RELEASE_BUFFERS);
#endif

3. Expose API to extract peer certificate data

...

read size threshold

• A few customers expect a size threshold for client request over ssl from protecting system perspective. If the max requested data exceed the threshold, server will reject the client connection

  .

5. Specific mode for verifying peer certificate

• Current 'mode' for verifying peer certificate is a global option, it's good to have specific mode among different sites hosted on a same machine. If the mode is non-empty, it would be the preference when making the decision to verify peer or not. Otherwise, the global mode will take effect. Code Block # Client certification level should be: # 0 no client certificates # 1 client certificates optional # 2 client certificates required CONFIG proxy.config.ssl.client.certification_level INT 0