
This virtual server controls caching of TLS sessions.

When a TLS session is used, the server will automatically create
the following attributes in the session-state list.  These attributes
are the ones for the *server* certificate.


If a client certificate is required (e.g. EAP-TLS or sometimes PEAP / TTLS),
the following attributes are also created in the session-state list:






This section is run whenever the server needs to read an
entry from the TLS session cache.

It should read the attribute &session-state.TLS-Session-Data
from the cache, along with any other attributes which
were in the cache

On success it should return 'ok' or 'updated'.

The return code has no real effect on session processing
and will just cause the server to emit a warning.




This section is run whenever the server needs to write an
entry to the TLS session cache.

It should write the attribute &session-state.Session-Data
to the cache, along with any other attributes which
need to be cached.

On success it should return 'ok' or 'updated'.

The return code has no real effect on session processing
and will just cause the server to emit a warning.




This section is run whenever the server needs to delete an
entry from the TLS session cache.

On success it should return 'ok', 'updated', 'noop' or 'notfound'

The return code has no real effect on session processing
and will just cause the server to emit a warning.




This section is run after certificate attributes are added
to the request list, and before performing OCSP validation.

It should read the attribute &control.TLS-OCSP-Cert-Valid
from the cache.

On success it should return 'ok', 'updated', 'noop' or 'notfound'
To force OCSP validation failure, it should return 'reject'.




This section is run after OCSP validation has completed.

It should write the attribute &reply.TLS-OCSP-Cert-Valid
to the cache.

On success it should return 'ok' or 'updated'.

The return code has no real effect on session processing
and will just cause the server to emit a warning.



== Default Configuration

```
#	       TLS-Cert-Serial
#	       TLS-Cert-Expiration
#	       TLS-Cert-Subject
#	       TLS-Cert-Issuer
#	       TLS-Cert-Common-Name
#	       TLS-Cert-Subject-Alt-Name-Email
#	       TLS-Client-Cert-Serial
#	       TLS-Client-Cert-Expiration
#	       TLS-Client-Cert-Subject
#	       TLS-Client-Cert-Issuer
#	       TLS-Client-Cert-Common-Name
#	       TLS-Client-Cert-Subject-Alt-Name-Email
server tls-cache {
	namespace = tls_cache
	load tls-session {
		&control.Cache-Allow-Insert := no
		cache_tls_session
	}
	store tls-session {
		&control.Cache-TTL := 0
		cache_tls_session
	}
	clear tls-session {
		&control.Cache-TTL := 0
		&control.Cache-Allow-Insert := no
		cache_tls_session
	}
	load ocsp-state {
		&control.Cache-Allow-Insert := no
		cache_ocsp
	}
	store ocsp-state {
		&control.Cache-TTL := "%{&reply.TLS-OCSP-Next-Update * -1}"
		&control.Cache-Allow-Merge := no
		cache_ocsp
	}
}
```
