1.

...

• Current 'mode' for verifying peer certificate is global, it's good to have specific mode among different sites hosted on a same machine. This mode will be preferred if it is not NULL. Otherwise, global mode will take effect.

2. Optimization on TLS record size

...

SSL

...

3. Configurable session time

• Session size is configurable, whereas application can not specify a session time out threshold. The default is 300 seconds. In some cases, applications need to reduce or increase the caching time, it's good to be configurable.

4. Expose API to extract peer certificate data

• Application use ATS to verify peer certificate, and expect some specific cert data (i.e. subject, issuer info) can be forwarded to orgin servers as well. It's better to expose API to extract peer certificate data.

...

_read size threshold

• A few customers

  in Yahoo

  expect a size threshold for client request over ssl from protecting

  their

  system perspective. If the max

  reqested

  requested data exceed the threshold, server will reject the client connection

  .