The `tls` parameters are valid for `api` and `ops` listeners. `cluster`
and `proxy` connections use their own ephemeral TLS stacks. For more
information, refer to [TLS in Boundary](/boundary/docs/secure/encryption/connections-tls).

- `tls_disable` `(string: "false")` – Specifies if TLS will be disabled. Boundary
  assumes TLS by default, so you must explicitly disable TLS to opt-in to
  insecure communication.

- `tls_cert_file` `(string: <required-if-enabled, reloads-on-SIGHUP>)` –
  Specifies the path to the certificate for TLS. To configure the listener to
  use a CA certificate, concatenate the primary certificate and the CA
  certificate together. The primary certificate should appear first in the
  combined file. On `SIGHUP`, the path set here _at Boundary startup_ will be
  used for reloading the certificate; modifying this value while Boundary is
  running will have no effect for `SIGHUP`s.

- `tls_key_file` `(string: <required-if-enabled, reloads-on-SIGHUP>)` –
  Specifies the path to the private key for the certificate. If the key file is
  encrypted, you will be prompted to enter the passphrase on server startup. The
  passphrase must stay the same between key files when reloading your
  configuration using `SIGHUP`. On `SIGHUP`, the path set here _at Boundary
  startup_ will be used for reloading the certificate; modifying this value
  while Boundary is running will have no effect for `SIGHUP`s.

- `tls_min_version` `(string: "tls12")` – Specifies the minimum supported
  version of TLS. Accepted values are "tls10", "tls11", "tls12" or "tls13".

  TLS 1.1 and lower are generally considered insecure.

- `tls_max_version` `(string: "tls13")` – Specifies the maximum supported
  version of TLS, useful if appliances (e.g. load balancers) are not yet capable
  of higher levels. Accepted values are "tls10", "tls11", "tls12" or "tls13".

  TLS 1.1 and lower are generally considered insecure.

- `tls_cipher_suites` `(string: "")` – Override the default list of supported
  ciphersuites (which varies by TLS version) with the the specified
  comma-delimited list. The list of all available ciphersuites is available in
  the [Golang TLS documentation][golang-tls].

- `tls_prefer_server_cipher_suites` `(string: "false")` – Specifies to prefer the
  server's ciphersuite over the client ciphersuites.

- `tls_require_and_verify_client_cert` `(string: "false")` – Turns on client
  authentication for this listener; the listener will require a presented
  client cert that successfully validates against system CAs.

- `tls_client_ca_file` `(string: "")` – PEM-encoded Certificate Authority file
  used for checking the authenticity of client.

<!-- Not enabled yet
- `x_forwarded_for_authorized_addrs` `(string: <required-to-enable>)` –
  Specifies the list of source IP CIDRs for which an X-Forwarded-For header
  will be trusted. Comma-separated list or JSON array. This turns on
  X-Forwarded-For support.

- `x_forwarded_for_hop_skips` `(string: "0")` – The number of addresses that will be
  skipped from the _rear_ of the set of hops. For instance, for a header value
  of `1.2.3.4, 2.3.4.5, 3.4.5.6`, if this value is set to `"1"`, the address that
  will be used as the originating client IP is `2.3.4.5`.

- `x_forwarded_for_reject_not_authorized` `(string: "true")` – If set false,
  if there is an X-Forwarded-For header in a connection from an unauthorized
  address, the header will be ignored and the client connection used as-is,
  rather than the client connection rejected.

- `x_forwarded_for_reject_not_present` `(string: "true")` – If set false, if
  there is no X-Forwarded-For header or it is empty, the client address will be
  used as-is, rather than the client connection rejected.
!-->
