client.conf(5)

🎀 NAME 🎀

client.conf — the client configuration file for CUPS, bestie. (Also: deprecated on macOS, we'll get to that 💀)

---

✨ DESCRIPTION ✨

So the client.conf file is what configures your CUPS client, and it usually lives in the /etc/cups and/or ~/.cups directories. 👑

Every line in the file can be one of three things: a configuration directive, a blank line, or a comment. And comment lines? They start with the # character. Periodt.

Note: Starting with macOS 10.7, this file is only used by command-line and X11 applications plus the IPP backend. The ServerName directive is not supported on macOS at all. And starting with macOS 10.12, all applications can access these settings in the /Library/Preferences/org.cups.PrintingPrefs.plist file instead. Scroll down to the NOTES section for more, iykyk. 💖

🦋 DIRECTIVES 🦋

These are the directives the client understands. The online help has the detailed descriptions, but here's the whole squad:

• AllowAnyRoot Yes / AllowAnyRoot No — says whether to allow TLS with certificates that have not been signed by a trusted Certificate Authority. Default is "Yes". 🙈
• AllowExpiredCerts Yes / AllowExpiredCerts No — says whether to allow TLS with expired certificates. Default is "No".
• DigestOptions DenyMD5 / DigestOptions None — sets the HTTP Digest authentication options. DenyMD5 disables support for the original MD5 hash algorithm. 🚫
• Encryption IfRequested / Encryption Never / Encryption Required — sets the level of encryption that should be used.
• GSSServiceName name — sets the Kerberos service name used for authentication, typically "host", "http", or "ipp". CUPS adds the remote hostname ("name@server.example.com") for you. The default name is "http".
• ServerName hostname-or-ip-address[:port]
• ServerName /domain/socket — sets the address and optionally the port to use when connecting to the server. Note: this directive is not supported on macOS 10.7 or later. 😭
• ServerName hostname-or-ip-address[:port]/version=1.1 — sets the address and optionally the port to use when connecting to a server running CUPS 1.3.12 and earlier.
• SSLOptions — the full roster is:

SSLOptions [AllowDH] [AllowRC4] [AllowSSL3] [DenyCBC] [DenyTLS1.0]
[MaxTLS1.0] [MaxTLS1.1] [MaxTLS1.2] [MaxTLS1.3] [MinTLS1.0] [MinTLS1.1]
[MinTLS1.2] [MinTLS1.3] [NoSystem]

• SSLOptions None — sets encryption options (only in /etc/cups/client.conf, okay? only there). By default, CUPS only supports encryption using TLS v1.0 or higher with known secure cipher suites. 🔐 Security goes down when Allow options are used, and up when Deny options are used.
  • The AllowDH option enables cipher suites using plain Diffie-Hellman key negotiation (not supported on systems using GNU TLS).
  • The AllowRC4 option enables the 128-bit RC4 cipher suites, which are required for some older clients.
  • The AllowSSL3 option enables SSL v3.0, which is required for some older clients that do not support TLS v1.0.
  • The DenyCBC option disables all CBC cipher suites.
  • The DenyTLS1.0 option disables TLS v1.0 support — this sets the minimum protocol version to TLS v1.1.
  • The MinTLS options set the minimum TLS version to support.
  • The MaxTLS options set the maximum TLS version to support.
  • The NoSystem option disables applying system cryptographic policy.
  • Not all operating systems support TLS 1.3 at this time. 🥲
• TrustOnFirstUse Yes / TrustOnFirstUse No — says whether to trust new TLS certificates by default. Default is "Yes".
• User name — sets the default user name to use for requests.
• UserAgentTokens — what info gets stuffed into the User-Agent header of HTTP requests:
  • UserAgentTokens None — "None" disables the User-Agent header.
  • UserAgentTokens ProductOnly — "ProductOnly" reports "CUPS".
  • UserAgentTokens Major — "Major" reports "CUPS/major IPP/2".
  • UserAgentTokens Minor — "Minor" reports "CUPS/major.minor IPP/2.1".
  • UserAgentTokens Minimal — "Minimal" reports "CUPS/major.minor.patch IPP/2.1".
  • UserAgentTokens OS — "OS" reports "CUPS/major.minor.path (osname osversion) IPP/2.1".
  • UserAgentTokens Full — "Full" reports "CUPS/major.minor.path (osname osversion; architecture) IPP/2.1".
  • The default is "Minimal". 💅
• ValidateCerts Yes / ValidateCerts No — says whether to only allow TLS with certificates whose common name matches the hostname. Default is "No".

---

🌸 NOTES 🌸

Okay so real talk: the client.conf file is deprecated on macOS and will no longer be supported in a future version of CUPS. 😭 Instead, you can view or change these settings with the defaults(1) command:

defaults write /Library/Preferences/org.cups.PrintingPrefs.plist Encryption Required
defaults write /Library/Preferences/org.cups.PrintingPrefs.plist TrustOnFirstUse -bool NO

defaults read /Library/Preferences/org.cups.PrintingPrefs.plist Encryption

And on Linux and other systems using GNU TLS, the /etc/cups/ssl/site.crl file — if it's present — gives you a list of revoked X.509 certificates, and it gets used when validating certificates. 🧚

---

🌈 SEE ALSO 🌈

cups(1), default(1), CUPS Online Help (http://localhost:631/help)

---

👑 COPYRIGHT 👑

Copyright © 2020-2025 by OpenPrinting.

---

That's the whole page, bestie — slayed, no cap. 🫶

This was the client.conf(5) page from CUPS, dated 2021-02-28, and it's giving OpenPrinting energy from start to finish. Go configure something iconic. 💖✨