Server Settings

**Example of settings:**

```
<openSSL>
    <server>
        <!-- openssl req -subj "/CN=localhost" -new -newkey rsa:2048 -days 365 -nodes -x509 -keyout /etc/clickhouse-server/server.key -out /etc/clickhouse-server/server.crt -->
        <certificateFile>/etc/clickhouse-server/server.crt</certificateFile>
        <privateKeyFile>/etc/clickhouse-server/server.key</privateKeyFile>
        <!-- openssl dhparam -out /etc/clickhouse-server/dhparam.pem 4096 -->
        <dhParamsFile>/etc/clickhouse-server/dhparam.pem</dhParamsFile>
        <verificationMode>none</verificationMode>
        <loadDefaultCAFile>true</loadDefaultCAFile>
        <cacheSessions>true</cacheSessions>
        <disableProtocols>sslv2,sslv3</disableProtocols>
        <preferServerCiphers>true</preferServerCiphers>
    </server>
    <client>
        <loadDefaultCAFile>true</loadDefaultCAFile>
        <cacheSessions>true</cacheSessions>
        <disableProtocols>sslv2,sslv3</disableProtocols>
        <preferServerCiphers>true</preferServerCiphers>
        <!-- Use for self-signed: <verificationMode>none</verificationMode> -->
        <invalidCertificateHandler>
            <!-- Use for self-signed: <name>AcceptCertificateHandler</name> -->
            <name>RejectCertificateHandler</name>
        </invalidCertificateHandler>
    </client>
</openSSL>
```

## openSSL.client.caConfig[​](#openssl.client.caconfig "Direct link to openSSL.client.caConfig")

Path to the file or directory that contains trusted CA certificates. If this points to a file, it must be in PEM format and can contain several CA certificates. If this points to a directory, it must contain one .pem file per CA certificate. The filenames are looked up by the CA subject name hash value. Details can be found in the man page of [SSL\_CTX\_load\_verify\_locations](https://docs.openssl.org/3.0/man3/SSL_CTX_load_verify_locations/).

## openSSL.client.cacheSessions[​](#openssl.client.cachesessions "Direct link to openSSL.client.cacheSessions")

Enables or disables caching sessions. Must be used in combination with `<sessionIdContext>`. Acceptable values: `<true>`, `<false>`.

## openSSL.client.certificateFile[​](#openssl.client.certificatefile "Direct link to openSSL.client.certificateFile")

Path to the client/server certificate file in PEM format. You can omit it if `<privateKeyFile>` contains the certificate.

## openSSL.client.cipherList[​](#openssl.client.cipherlist "Direct link to openSSL.client.cipherList")

Supported OpenSSL encryptions.

## openSSL.client.disableProtocols[​](#openssl.client.disableprotocols "Direct link to openSSL.client.disableProtocols")

Protocols that are not allowed to be used.

## openSSL.client.extendedVerification[​](#openssl.client.extendedverification "Direct link to openSSL.client.extendedVerification")

If enabled, verify that the certificate CN or SAN matches the peer hostname.

## openSSL.client.fips[​](#openssl.client.fips "Direct link to openSSL.client.fips")

Activates OpenSSL FIPS mode. Supported if the library's OpenSSL version supports FIPS.

## openSSL.client.invalidCertificateHandler.name[​](#openssl.client.invalidcertificatehandler.name "Direct link to openSSL.client.invalidCertificateHandler.name")

Class (a subclass of CertificateHandler) for verifying invalid certificates. For example: `<<invalidCertificateHandler> <name>RejectCertificateHandler</name> </invalidCertificateHandler>>`.

## openSSL.client.loadDefaultCAFile[​](#openssl.client.loaddefaultcafile "Direct link to openSSL.client.loadDefaultCAFile")

Determines whether built-in CA certificates for OpenSSL will be used. ClickHouse assumes that builtin CA certificates are in the file `</etc/ssl/cert.pem>` (resp. the directory `</etc/ssl/certs>`) or in file (resp. directory) specified by the environment variable `<SSL_CERT_FILE>` (resp. `<SSL_CERT_DIR>`).

## openSSL.client.preferServerCiphers[​](#openssl.client.preferserverciphers "Direct link to openSSL.client.preferServerCiphers")

Client-preferred server ciphers.

## openSSL.client.privateKeyFile[​](#openssl.client.privatekeyfile "Direct link to openSSL.client.privateKeyFile")

Path to the file with the secret key of the PEM certificate. The file may contain a key and certificate at the same time.

## openSSL.client.privateKeyPassphraseHandler.name[​](#openssl.client.privatekeypassphrasehandler.name "Direct link to openSSL.client.privateKeyPassphraseHandler.name")

Class (PrivateKeyPassphraseHandler subclass) that requests the passphrase for accessing the private key. For example: `<<privateKeyPassphraseHandler>>`, `<<name>KeyFileHandler</name>>`, `<<options><password>test</password></options>>`, `<</privateKeyPassphraseHandler>>`

## openSSL.client.requireTLSv1[​](#openssl.client.requiretlsv1 "Direct link to openSSL.client.requireTLSv1")

Require a TLSv1 connection. Acceptable values: `<true>`, `<false>`.

## openSSL.client.requireTLSv1\_1[​](#openssl.client.requiretlsv1_1 "Direct link to openSSL.client.requireTLSv1_1")

Require a TLSv1.1 connection. Acceptable values: `<true>`, `<false>`.

## openSSL.client.requireTLSv1\_2[​](#openssl.client.requiretlsv1_2 "Direct link to openSSL.client.requireTLSv1_2")

Require a TLSv1.2 connection. Acceptable values: `<true>`, `<false>`.

## openSSL.client.verificationDepth[​](#openssl.client.verificationdepth "Direct link to openSSL.client.verificationDepth")

The maximum length of the verification chain. Verification will fail if the certificate chain length exceeds the set value.

## openSSL.client.verificationMode[​](#openssl.client.verificationmode "Direct link to openSSL.client.verificationMode")

The method for checking the node's certificates. Details are in the description of the [Context](https://github.com/ClickHouse/poco/blob/master/NetSSL_OpenSSL/include/Poco/Net/Context.h) class. Possible values: `<none>`, `<relaxed>`, `<strict>`, `<once>`.

## openSSL.server.caConfig[​](#openssl.server.caconfig "Direct link to openSSL.server.caConfig")

Path to the file or directory that contains trusted CA certificates. If this points to a file, it must be in PEM format and can contain several CA certificates. If this points to a directory, it must contain one .pem file per CA certificate. The filenames are looked up by the CA subject name hash value. Details can be found in the man page of [SSL\_CTX\_load\_verify\_locations](https://docs.openssl.org/3.0/man3/SSL_CTX_load_verify_locations/).

## openSSL.server.cacheSessions[​](#openssl.server.cachesessions "Direct link to openSSL.server.cacheSessions")

Enables or disables caching sessions. Must be used in combination with `<sessionIdContext>`. Acceptable values: `<true>`, `<false>`.

## openSSL.server.certificateFile[​](#openssl.server.certificatefile "Direct link to openSSL.server.certificateFile")

Path to the client/server certificate file in PEM format. You can omit it if `<privateKeyFile>` contains the certificate.

## openSSL.server.cipherList[​](#openssl.server.cipherlist "Direct link to openSSL.server.cipherList")

Supported OpenSSL encryptions.

## openSSL.server.disableProtocols[​](#openssl.server.disableprotocols "Direct link to openSSL.server.disableProtocols")

Protocols that are not allowed to be used.

## openSSL.server.extendedVerification[​](#openssl.server.extendedverification "Direct link to openSSL.server.extendedVerification")

If enabled, verify that the certificate CN or SAN matches the peer hostname.

## openSSL.server.fips[​](#openssl.server.fips "Direct link to openSSL.server.fips")

Activates OpenSSL FIPS mode. Supported if the library's OpenSSL version supports FIPS.

## openSSL.server.invalidCertificateHandler.name[​](#openssl.server.invalidcertificatehandler.name "Direct link to openSSL.server.invalidCertificateHandler.name")

Class (a subclass of CertificateHandler) for verifying invalid certificates. For example: `<<invalidCertificateHandler> <name>RejectCertificateHandler</name> </invalidCertificateHandler>>`.

## openSSL.server.loadDefaultCAFile[​](#openssl.server.loaddefaultcafile "Direct link to openSSL.server.loadDefaultCAFile")