# /etc/proftpd/ku-tls.conf
#
# ::copy::
# ::maintainer::
#
<IfModule mod_tls.c>
  TLSEngine		on
  TLSLog		::ftp.tls_logfile::
  TLSProtocol		::ftp.tls_protocol::

  # Server SSL certificate. You can generate a self-signed certificate using 
  # a command like:
  #
  # openssl req -x509 -newkey rsa:1024 \
  #          -keyout /etc/ssl/private/proftpd.key -out /etc/ssl/certs/proftpd.crt \
  #          -nodes -days 365
  #
  # The proftpd.key file must be readable by root only. The other file can be
  # readable by anyone.
  #
  # chmod 0600 /etc/ssl/private/proftpd.key 
  # chmod 0640 /etc/ssl/private/proftpd.key
  # 
  #[ku]
  # uses certificate file described by "ftp.tls_*" kusa-db definitions,
  # that defaults to files produced by srv-ssl module
  #
  TLSRSACertificateFile		::ftp.tls_cert_file::
  TLSRSACertificateKeyFile	::ftp.tls_key_file::

  # CA the server trusts...
  #TLSCACertificateFile		/etc/ssl/certs/CA.pem
  #
  # ...or avoid CA cert and be verbose
  #TLSOptions			NoCertRequest EnableDiags 
  #
  # ... or the same with relaxed session use for some clients (e.g. FireFtp)
  #TLSOptions			NoCertRequest EnableDiags NoSessionReuseRequired
  #
  # Per default drop connection if client tries to start a renegotiate
  # This is a fix for CVE-2009-3555 but could break some clients.
  #
  #TLSOptions			AllowClientRenegotiations
  #
  TLSOptions			::ftp.tls_options::

  # Authenticate clients that want to use FTP over TLS?
  #
  #TLSVerifyClient		off

  # Are clients required to use FTP over TLS when talking to this server?
  #
  TLSRequired			::ftp.tls_required::

  # Allow SSL/TLS renegotiations when the client requests them, but
  # do not force the renegotations.  Some clients do not support
  # SSL/TLS renegotiations; when mod_tls forces a renegotiation, these
  # clients will close the data connection, or there will be a timeout
  # on an idle data connection.
  #
  #TLSRenegotiate		required off

</IfModule>

