tlshd(8)

💖 tlshd — the TLS handshake bestie for kernel sockets 💖

okay so this page is tlshd(8) from the System Manager's Manual, and she is the girl for making kernel TLS actually happen. let's get into it 🫶

---

✨ NAME ✨

tlshd — TLS handshake for kernel TLS sockets

---

🌸 SYNOPSIS 🌸

/usr/sbin/tlshd [options]

---

🦋 DESCRIPTION 🦋

so tlshd is this little user agent program, right, and her whole job — her entire personality — is servicing TLS handshake requests on behalf of kernel TLS consumers. like, the kernel needs a handshake done and she's the one who shows up. 💅

how does she do it? she materializes kernel socket endpoints in user space so she can actually perform TLS handshakes using a standard TLS library. that's the whole trick. she takes the kernel socket, brings it into userspace, does the handshake with a real grown-up TLS library, and then—

after each handshake completes, tlshd plants TLS session metadata into the kernel socket so kTLS can be used to secure all the subsequent communication on that socket. then she hands the socket back to the kernel. slay. 🌈✨

---

💅 OPTIONS 💅

• -c or --config — when you specify this, it sets the location for tlshd's config file. pick where your config lives, queen.
• -h or --help — when specified, tlshd shows you a help message and then exits immediately. she's helpful and she doesn't overstay. 🎀
• -s or --stderr — when specified, this forces messages to go to both stderr and the system log. by default, messages go only to the system log. so if you want that double-dipping message energy, this is the flag.
• -v or --version — when specified, tlshd displays build version information and then exits immediately. short, sweet, iconic. ⭐

---

🧚 ENVIRONMENT VARIABLES 🧚

the GnuTLS library brings certain capabilities to the table that you can turn on by setting environment variables before tlshd is started. ngl, more info about these variables lives in the GnuTLS library documentation — that's where the lore is. 📚

• SSLKEYLOGFILE — when set, this variable specifies the pathname of a file that the GnuTLS library appends negotiated session keys to, in the NSS Key Log format. and bestie, the NSS Key Log format can be read by wireshark, which means you can decrypt recorded sessions. 😭 not me enabling full session decryption, okay, it's for debugging.
• GNUTLS_FORCE_FIPS_MODE — when set to 1, this variable forces the TLS library into FIPS mode, if FIPS140-2 support is available. no support, no FIPS, that's the deal. 🔥

---

🍓 FILES 🍓

• /etc/tlshd/config — primary configuration file 👑
• /etc/tlshd.conf — legacy configuration file (deprecated). deprecated, babes. she's still around but she's giving vintage. 🙈

---

⚡ SIGNALS ⚡

• SIGHUP or SIGUSR1 — reload the configuration file. debug verbosity and keyring associations get updated without terminating active TLS sessions. and once the reload completes, tlshd just keeps on polling for netlink messages like nothing happened. unbothered. thriving. ✨
• SIGINT or SIGTERM — terminate the daemon cleanly. she leaves the party politely. 💜

---

👑 SEE ALSO 👑

tls-session-tags(7), tlshd.conf(5), ssl(7)

---

💖 AUTHOR 💖

Chuck Lever

---

and that's the whole page, bestie!! tlshd(8), System Manager's Manual, dated <b>20 Dec 2021</b>. go forth and handshake 💅🌈💖