Server Settings

If enabled, verify that the certificate CN or SAN matches the peer hostname.

## openSSL.server.fips[​](#openssl.server.fips "Direct link to openSSL.server.fips")

Activates OpenSSL FIPS mode. Supported if the library's OpenSSL version supports FIPS.

## openSSL.server.invalidCertificateHandler.name[​](#openssl.server.invalidcertificatehandler.name "Direct link to openSSL.server.invalidCertificateHandler.name")

Class (a subclass of CertificateHandler) for verifying invalid certificates. For example: `<<invalidCertificateHandler> <name>RejectCertificateHandler</name> </invalidCertificateHandler>>`.

## openSSL.server.loadDefaultCAFile[​](#openssl.server.loaddefaultcafile "Direct link to openSSL.server.loadDefaultCAFile")

Determines whether built-in CA certificates for OpenSSL will be used. ClickHouse assumes that builtin CA certificates are in the file `</etc/ssl/cert.pem>` (resp. the directory `</etc/ssl/certs>`) or in file (resp. directory) specified by the environment variable `<SSL_CERT_FILE>` (resp. `<SSL_CERT_DIR>`).

## openSSL.server.preferServerCiphers[​](#openssl.server.preferserverciphers "Direct link to openSSL.server.preferServerCiphers")

Client-preferred server ciphers.

## openSSL.server.privateKeyFile[​](#openssl.server.privatekeyfile "Direct link to openSSL.server.privateKeyFile")

Path to the file with the secret key of the PEM certificate. The file may contain a key and certificate at the same time.

## openSSL.server.privateKeyPassphraseHandler.name[​](#openssl.server.privatekeypassphrasehandler.name "Direct link to openSSL.server.privateKeyPassphraseHandler.name")

Class (PrivateKeyPassphraseHandler subclass) that requests the passphrase for accessing the private key. For example: `<<privateKeyPassphraseHandler>>`, `<<name>KeyFileHandler</name>>`, `<<options><password>test</password></options>>`, `<</privateKeyPassphraseHandler>>`

## openSSL.server.requireTLSv1[​](#openssl.server.requiretlsv1 "Direct link to openSSL.server.requireTLSv1")

Require a TLSv1 connection. Acceptable values: `<true>`, `<false>`.

## openSSL.server.requireTLSv1\_1[​](#openssl.server.requiretlsv1_1 "Direct link to openSSL.server.requireTLSv1_1")

Require a TLSv1.1 connection. Acceptable values: `<true>`, `<false>`.

## openSSL.server.requireTLSv1\_2[​](#openssl.server.requiretlsv1_2 "Direct link to openSSL.server.requireTLSv1_2")

Require a TLSv1.2 connection. Acceptable values: `<true>`, `<false>`.

## openSSL.server.sessionCacheSize[​](#openssl.server.sessioncachesize "Direct link to openSSL.server.sessionCacheSize")

The maximum number of sessions that the server caches. A value of 0 means unlimited sessions.

## openSSL.server.sessionIdContext[​](#openssl.server.sessionidcontext "Direct link to openSSL.server.sessionIdContext")

A unique set of random characters that the server appends to each generated identifier. The length of the string must not exceed `<SSL_MAX_SSL_SESSION_ID_LENGTH>`. This parameter is always recommended since it helps avoid problems both if the server caches the session and if the client requested caching.

## openSSL.server.sessionTimeout[​](#openssl.server.sessiontimeout "Direct link to openSSL.server.sessionTimeout")

Time for caching the session on the server in hours.

## openSSL.server.verificationDepth[​](#openssl.server.verificationdepth "Direct link to openSSL.server.verificationDepth")

The maximum length of the verification chain. Verification will fail if the certificate chain length exceeds the set value.

## openSSL.server.verificationMode[​](#openssl.server.verificationmode "Direct link to openSSL.server.verificationMode")

The method for checking the node's certificates. Details are in the description of the [Context](https://github.com/ClickHouse/poco/blob/master/NetSSL_OpenSSL/include/Poco/Net/Context.h) class. Possible values: `<none>`, `<relaxed>`, `<strict>`, `<once>`.

## opentelemetry\_span\_log[​](#opentelemetry_span_log "Direct link to opentelemetry_span_log")

Settings for the [`opentelemetry_span_log`](/docs/operations/system-tables/opentelemetry_span_log) system table.

The following settings can be configured by sub-tags: