| Server IP : 202.155.9.250 / Your IP : 216.73.217.135 Web Server : LiteSpeed System : Linux srv339029361 5.15.0-177-generic #187-Ubuntu SMP Sat Apr 11 22:54:33 UTC 2026 x86_64 User : rajaj4013 ( 1087) PHP Version : 8.0.30 Disable Function : pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare, MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : ON Directory : /usr/local/lsws/docs/ |
Upload File : |
<!DOCTYPE html>
<html lang="en-US">
<head>
<meta charset="utf-8" />
<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" />
<title>OpenLiteSpeed Users' Manual - Admin Listeners SSL</title>
<meta name="description" content="OpenLiteSpeed Users' Manual - Admin Listeners SSL." />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<meta name="robots" content="noindex">
<script>
(function () {
var theme = 'light';
var resolved = false;
try {
if (window.localStorage) {
var storedTheme = window.localStorage.getItem('hdoc.theme');
if (storedTheme === 'light' || storedTheme === 'dark') {
theme = storedTheme;
resolved = true;
}
}
} catch (err) {
}
if (!resolved && window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches) {
theme = 'dark';
}
document.documentElement.setAttribute('data-theme', theme);
document.documentElement.style.colorScheme = theme;
}());
</script>
<link rel="shortcut icon" href="img/favicon.ico" />
<link rel="stylesheet" type="text/css" href="css/hdoc.css">
<link rel="stylesheet" type="text/css" href="css/hdoc-product-accent.css">
<script src="hdoc-search-index.js" defer></script>
<script src="js/hdoc-search.js" defer></script>
</head>
<body>
<div class="doc-shell">
<header class="doc-topbar">
<a class="doc-brand" href="index.html" aria-label="OpenLiteSpeed Users' Manual">
<img src="img/ols_logo.svg" alt="OpenLiteSpeed logo" />
<strong>OpenLiteSpeed Users' Manual</strong>
</a>
<div class="doc-actions">
<button class="doc-menu-toggle" type="button" aria-label="Open menu" data-menu-toggle aria-expanded="false">
<svg viewBox="0 0 24 24" aria-hidden="true" focusable="false"><path d="M3 12h18M3 6h18M3 18h18" stroke="currentColor" stroke-width="2" stroke-linecap="round"/></svg>
</button>
<form class="doc-search" role="search" data-empty="Search pages and settings" data-no-results="No results found.">
<label class="sr-only" for="doc-search-input">Search the manual</label>
<div class="doc-search__box">
<input id="doc-search-input" type="search" autocomplete="off" placeholder="Search pages and settings" aria-controls="doc-search-results" />
<button type="submit">Search</button>
</div>
<div id="doc-search-results" class="doc-search__results" hidden></div>
</form>
</div>
<label class="doc-language"><select id="doc-language-switcher" name="doc_language" data-language-switcher aria-label="Language"><option value="AdminListeners_SSL_Help.html" data-lang="en-US" selected>English</option><option value="es-ES/AdminListeners_SSL_Help.html" data-lang="es-ES">Español</option><option value="de-DE/AdminListeners_SSL_Help.html" data-lang="de-DE">Deutsch</option><option value="fr-FR/AdminListeners_SSL_Help.html" data-lang="fr-FR">Français</option><option value="zh-CN/AdminListeners_SSL_Help.html" data-lang="zh-CN">简体中文</option><option value="ja-JP/AdminListeners_SSL_Help.html" data-lang="ja-JP">日本語</option></select></label>
<button class="doc-theme-toggle" type="button" aria-label="Toggle theme" data-theme-toggle data-theme-light-label="Light mode" data-theme-dark-label="Dark mode" title="Toggle theme">
<span class="doc-theme-toggle__icon" aria-hidden="true"></span>
</button>
</header>
<div class="doc-menu-backdrop" data-menu-backdrop></div>
<div class="pagewrapper" data-current-lang="en-US" data-supported-langs="["en-US","es-ES","de-DE","fr-FR","zh-CN","ja-JP"]"><aside class="sidetree"><div class="sidetree__masthead"><figure class="sidetree__figure"><img src="img/ols_logo.svg" alt="OpenLiteSpeed logo" /></figure><div class="sidetree__identity"><a class="sidetree__manual-link" href="index.html">Users' Manual</a><div class="sidetree__version">Version 1.9 — Rev. 4</div></div></div><nav class="sidetree__nav" aria-label="Table of Contents"><ul class="sidetree__list">
<li><a href="license.html">License</a></li>
<li><a href="intro.html">Introduction</a></li>
<li><a href="install.html">Installation/Uninstallation</a></li>
<li>
<a href="admin.html">Administration</a>
<ul class="level2">
<li><a href="ServerStat_Help.html">Service Manager</a></li>
<li><a href="Real_Time_Stats_Help.html">Real-Time Stats</a></li>
</ul>
</li>
<li><a href="security.html">Security</a></li>
<li>
<a href="config.html">Configuration</a>
<ul class="level2">
<li><a href="ServGeneral_Help.html">Server General</a></li>
<li><a href="ServLog_Help.html">Server Log</a></li>
<li><a href="ServTuning_Help.html">Server Tuning</a></li>
<li><a href="ServSecurity_Help.html">Server Security</a></li>
<li>
<a href="ExtApp_Help.html">External Apps</a>
<ul class="level3">
<li><a href="External_LSAPI.html">LSAPI App</a></li>
<li><a href="External_WS.html">Web Server (Proxy)</a></li>
<li><a href="External_FCGI.html">Fast CGI App</a></li>
<li><a href="External_FCGI_Auth.html">Fast CGI Authorizer</a></li>
<li><a href="External_SCGI.html">Simple CGI App</a></li>
<li><a href="External_Servlet.html">Servlet Engine</a></li>
<li><a href="External_PL.html">Piped Logger</a></li>
<li><a href="External_LB.html">Load Balancer</a></li>
<li><a href="External_UWSGI.html">uWSGI</a></li>
</ul>
</li>
<li><a href="ScriptHandler_Help.html">Script Handler</a></li>
<li><a href="App_Server_Help.html">App Server Settings</a></li>
<li><a href="Module_Help.html">Module Configuration</a></li>
<li><a href="Listeners_General_Help.html">Listener General</a></li>
<li><a href="Listeners_SSL_Help.html">Listener SSL</a></li>
<li><a href="Templates_Help.html">Virtual Host Templates</a></li>
<li><a href="VirtualHosts_Help.html">Virtual Host Registration</a></li>
<li><a href="VHGeneral_Help.html">Virtual Host General</a></li>
<li><a href="VHSecurity_Help.html">Virtual Host Security</a></li>
<li><a href="VHSSL_Help.html">Virtual Host SSL</a></li>
<li><a href="Rewrite_Help.html">Rewrite</a></li>
<li>
<a href="Context_Help.html">Context</a>
<ul class="level3">
<li><a href="Static_Context.html">Static Context</a></li>
<li><a href="Java_Web_App_Context.html">Java Web App Context</a></li>
<li><a href="Servlet_Context.html">Servlet Context</a></li>
<li><a href="FCGI_Context.html">Fast CGI Context</a></li>
<li><a href="SCGI_Context.html">Simple CGI Context</a></li>
<li><a href="LSAPI_Context.html">LSAPI Context</a></li>
<li><a href="Proxy_Context.html">Proxy Context</a></li>
<li><a href="CGI_Context.html">CGI Context</a></li>
<li><a href="LB_Context.html">Load Balancer Context</a></li>
<li><a href="Redirect_Context.html">Redirect Context</a></li>
<li><a href="App_Server_Context.html">App Server Context</a></li>
<li><a href="UWSGI_Context.html">uWSGI Context</a></li>
<li><a href="Module_Context.html">Module Handler Context</a></li>
</ul>
</li>
<li><a href="VHWebSocket_Help.html">Web Socket Proxy</a></li>
</ul>
</li>
<li><a href="webconsole.html">Web Console</a>
<ul class="level2">
<li><a href="AdminGeneral_Help.html">Admin Console General</a></li>
<li><a href="AdminSecurity_Help.html">Admin Console Security</a></li>
<li><a href="AdminListeners_General_Help.html">Admin Listener General</a></li>
<li><a class="current" href="AdminListeners_SSL_Help.html">Admin Listener SSL</a></li>
</ul>
</li>
</ul></nav></aside><article class="contentwrapper"><div class="nav-bar"><div class="prev">« <a href="AdminListeners_General_Help.html">Admin Listeners General</a></div><div class="center"><a href="webconsole.html">Web Console</a></div><div class="next"> </div></div>
<header class="doc-page-header"><h1>Admin Listeners SSL</h1><div class="doc-page-intro">Admin Listeners are dedicated to the Admin Server. Secure (SSL) listeners are recommended for the Admin Server.</div>
</header><section class="doc-toc" aria-labelledby="top"><header class="doc-toc__header"><h2 id="top">Table of Contents</h2></header><section class="doc-toc__row"><h3 class="doc-toc__heading"><a href="#sslCert">SSL Private Key & Certificate</a></h3><ul class="doc-toc__links"><li><a href="#keyFile">Private Key File</a></li><li><a href="#certFile">Certificate File</a></li><li><a href="#certChain">Chained Certificate</a></li><li><a href="#CACertPath">CA Certificate Path</a></li><li><a href="#CACertFile">CA Certificate File</a></li></ul></section>
<section class="doc-toc__row"><h3 class="doc-toc__heading">SSL Protocol</h3><ul class="doc-toc__links"><li><a href="#sslProtocol">Protocol Version</a></li><li><a href="#ciphers">Ciphers</a></li><li><a href="#enableECDHE">Enable ECDH Key Exchange</a></li><li><a href="#enableDHE">Enable DH Key Exchange</a></li><li><a href="#DHParam">DH Parameter</a></li></ul></section>
<section class="doc-toc__row"><h3 class="doc-toc__heading">Security & Features</h3><ul class="doc-toc__links"><li><a href="#renegProtection">SSL Renegotiation Protection</a></li><li><a href="#sslSessionCache">Enable Session Cache</a></li><li><a href="#sslSessionTickets">Enable Session Tickets</a></li><li><a href="#enableSpdy">ALPN</a></li><li><a href="#allowQuic">Open HTTP3/QUIC (UDP) Port</a></li></ul></section>
<section class="doc-toc__row"><h3 class="doc-toc__heading">Client Verification</h3><ul class="doc-toc__links"><li><a href="#clientVerify">Client Verification</a></li><li><a href="#verifyDepth">Verify Depth</a></li><li><a href="#crlPath">Client Revocation Path</a></li><li><a href="#crlFile">Client Revocation File</a></li></ul></section>
</section>
<section class="doc-content-flow"><div class="helpitem"><article class="ls-helpitem"><header class="ls-helpitem__header" id="sslCert"><h3>SSL Private Key & Certificate<span class="ls-permlink"><a href="#sslCert"></a></span></h3></header><h4>Description</h4><p>Every SSL listener requires a paired SSL private key and SSL certificate. Multiple SSL listeners can share the same key and certificate.<br/><br/> You can generate SSL private keys yourself using an SSL software package, such as OpenSSL. SSL certificates can also be purchased from an authorized certificate issuer like VeriSign or Thawte. You can also sign the certificate yourself. Self-signed certificates will not be trusted by web browsers and should not be used on public websites containing critical data. However, a self-signed certificate is good enough for internal use, e.g. for encrypting traffic to LiteSpeed Web Server's WebAdmin Console.</p> </article> </div>
<div class="helpitem"><article class="ls-helpitem"><header class="ls-helpitem__header" id="keyFile"><h3>Private Key File<span class="ls-permlink"><a href="#keyFile"></a></span></h3></header><h4>Description</h4><p>The filename of the SSL private key file. The key file should not be encrypted.</p> <h4>Syntax</h4><p>Filename which can be an absolute path or a relative path to $SERVER_ROOT.</p> <h4>Tips</h4><p><span class="ls-badge ls-badge--security">Security</span> The private key file should be placed in a secured directory that allows read-only access to the user the server runs as.</p> </article> </div>
<div class="helpitem"><article class="ls-helpitem"><header class="ls-helpitem__header" id="certFile"><h3>Certificate File<span class="ls-permlink"><a href="#certFile"></a></span></h3></header><h4>Description</h4><p>The filename of the SSL certificate file.</p> <h4>Syntax</h4><p>Filename which can be an absolute path or a relative path to $SERVER_ROOT.</p> <h4>Tips</h4><p><span class="ls-badge ls-badge--security">Security</span> The certificate file should be placed in a secured directory, which allows read-only access to the user that the server runs as.</p> </article> </div>
<div class="helpitem"><article class="ls-helpitem"><header class="ls-helpitem__header" id="certChain"><h3>Chained Certificate<span class="ls-permlink"><a href="#certChain"></a></span></h3></header><h4>Description</h4><p>Specifies whether the certificate is a chained certificate or not. The file that stores a certificate chain must be in PEM format, and the certificates must be in the chained order, from the lowest level (the actual client or server certificate) to the highest level (root) CA.</p> <h4>Syntax</h4><p>Select from radio box</p> </article> </div>
<div class="helpitem"><article class="ls-helpitem"><header class="ls-helpitem__header" id="CACertPath"><h3>CA Certificate Path<span class="ls-permlink"><a href="#CACertPath"></a></span></h3></header><h4>Description</h4><p>Specifies the directory where the certificates of certification authorities (CAs) are kept. Those certificates are used for client certificate authentication and constructing the server certificate chain, which will be sent to browsers in addition to the server certificate.</p> <h4>Syntax</h4><p>path</p> </article> </div>
<div class="helpitem"><article class="ls-helpitem"><header class="ls-helpitem__header" id="CACertFile"><h3>CA Certificate File<span class="ls-permlink"><a href="#CACertFile"></a></span></h3></header><h4>Description</h4><p>Specifies the file that contains all certificates of certification authorities (CAs) for chained certificates. This file is simply the concatenation of PEM-encoded certificate files, in order of preference. This can be used as an alternative or in addition to <span class="tagl"><a href="#CACertPath">CA Certificate Path</a></span>. Those certificates are used for client certificate authentication and constructing the server certificate chain, which will be sent to browsers in addition to the server certificate.</p> <h4>Syntax</h4><p>Filename which can be an absolute path or a relative path to $SERVER_ROOT.</p> </article> </div>
<div class="helpitem"><article class="ls-helpitem"><header class="ls-helpitem__header" id="sslProtocol"><h3>Protocol Version<span class="ls-permlink"><a href="#sslProtocol"></a></span></h3></header><h4>Description</h4><p>A selection of SSL protocols accepted by the listener.<br/><br/> Options include: <span class="val">SSL v3.0</span>, <span class="val">TLS v1.0</span>, <span class="val">TLS v1.1</span>, <span class="val">TLS v1.2</span>, <span class="val">TLS v1.3</span>.</p> <h4>Syntax</h4><p>Select from checkbox</p> </article> </div>
<div class="helpitem"><article class="ls-helpitem"><header class="ls-helpitem__header" id="ciphers"><h3>Ciphers<span class="ls-permlink"><a href="#ciphers"></a></span></h3></header><h4>Description</h4><p>Specifies the cipher suite to be used when negotiating the SSL handshake. LSWS supports cipher suites implemented in SSL v3.0, TLS v1.0, TLS v1.2, and TLS v1.3.</p> <h4>Syntax</h4><p>Colon-separated string of cipher specifications.</p> <h4>Example</h4><div class="ls-example">ECDHE-RSA-AES128-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH</div><h4>Tips</h4><p><span class="ls-badge ls-badge--security">Security</span> We recommend leaving this field blank to use our default cipher which follows SSL cipher best practices.</p> </article> </div>
<div class="helpitem"><article class="ls-helpitem"><header class="ls-helpitem__header" id="enableECDHE"><h3>Enable ECDH Key Exchange<span class="ls-permlink"><a href="#enableECDHE"></a></span></h3></header><h4>Description</h4><p>Allows use of Elliptic Curve Diffie-Hellman key exchange for further SSL encryption.</p> <h4>Syntax</h4><p>Select from radio box</p> <h4>Tips</h4><p><span class="ls-badge ls-badge--security">Security</span> ECDH key exchange is more secure than using just an RSA key. ECDH and DH key exchange are equally secure.<br/><br/> <span class="ls-badge ls-badge--performance">Performance</span> Enabling ECDH key exchange will increase CPU load and is slower than using just an RSA key.</p> </article> </div>
<div class="helpitem"><article class="ls-helpitem"><header class="ls-helpitem__header" id="enableDHE"><h3>Enable DH Key Exchange<span class="ls-permlink"><a href="#enableDHE"></a></span></h3></header><h4>Description</h4><p>Allows use of Diffie-Hellman key exchange for further SSL encryption.</p> <h4>Syntax</h4><p>Select from radio box</p> <h4>Tips</h4><p><span class="ls-badge ls-badge--security">Security</span> DH key exchange is more secure than using just an RSA key. ECDH and DH key exchange are equally secure.<br/><br/> <span class="ls-badge ls-badge--performance">Performance</span> Enabling DH key exchange will increase CPU load and is slower than ECDH key exchange and RSA. ECDH key exchange is preferred when available.</p> </article> </div>
<div class="helpitem"><article class="ls-helpitem"><header class="ls-helpitem__header" id="DHParam"><h3>DH Parameter<span class="ls-permlink"><a href="#DHParam"></a></span></h3></header><h4>Description</h4><p>Specifies the location of the Diffie-Hellman parameter file necessary for DH key exchange.</p> <h4>Syntax</h4><p>Filename which can be an absolute path or a relative path to $SERVER_ROOT.</p> </article> </div>
<div class="helpitem"><article class="ls-helpitem"><header class="ls-helpitem__header" id="renegProtection"><h3>SSL Renegotiation Protection<span class="ls-permlink"><a href="#renegProtection"></a></span></h3></header><h4>Description</h4><p>Specifies whether to enable SSL Renegotiation Protection to defend against SSL handshake-based attacks. The default value is "Yes".</p> <h4>Syntax</h4><p>Select from radio box</p> <h4>Tips</h4><p><span class="ls-badge ls-badge--info">Information</span> This setting can be enabled at the listener and virtual host levels.</p> </article> </div>
<div class="helpitem"><article class="ls-helpitem"><header class="ls-helpitem__header" id="sslSessionCache"><h3>Enable Session Cache<span class="ls-permlink"><a href="#sslSessionCache"></a></span></h3></header><h4>Description</h4><p>Enables session ID caching using OpenSSL's default setting. Server-level setting must be set to "Yes" for Virtual Host setting to take effect.<br/><br/> Default values:<br/> <b>Server-level:</b> Yes<br/> <b>VH-Level:</b> Yes</p> <h4>Syntax</h4><p>Select from radio box</p> </article> </div>
<div class="helpitem"><article class="ls-helpitem"><header class="ls-helpitem__header" id="sslSessionTickets"><h3>Enable Session Tickets<span class="ls-permlink"><a href="#sslSessionTickets"></a></span></h3></header><h4>Description</h4><p>Enables session tickets using OpenSSL's default session ticket setting. Server-level setting must be set to "Yes" for Virtual Host setting to take effect.<br/><br/> Default values:<br/> <b>Server-level:</b> Yes<br/> <b>VH-Level:</b> Yes</p> <h4>Syntax</h4><p>Select from radio box</p> </article> </div>
<div class="helpitem"><article class="ls-helpitem"><header class="ls-helpitem__header" id="enableSpdy"><h3>ALPN<span class="ls-permlink"><a href="#enableSpdy"></a></span></h3></header><h4>Description</h4><p>Application-Layer Protocol Negotiation(ALPN) is used to selectively enable HTTP/3 and HTTP/2 network protocols.<br/><br/> If you wish to disable HTTP/2 and HTTP3, check <span class="val">None</span> and leave all other boxes unchecked.<br/><br/> Default value: All enabled</p> <h4>Syntax</h4><p>Select from checkbox</p> <h4>Tips</h4><p><span class="ls-badge ls-badge--info">Information</span> This can be set at the listener and virtual host levels.</p> </article> </div>
<div class="helpitem"><article class="ls-helpitem"><header class="ls-helpitem__header" id="allowQuic"><h3>Open HTTP3/QUIC (UDP) Port<span class="ls-permlink"><a href="#allowQuic"></a></span></h3></header><h4>Description</h4><p>Allows the use of the HTTP3/QUIC network protocol for virtual hosts mapped to this listener. For this setting to take effect, <span class="tagl"><a href="ServTuning_Help.html#quicEnable">Enable HTTP3/QUIC</a></span> must also be set to <span class="val">Yes</span> at the server level. Default value is <span class="val">Yes</span>.</p> <h4>Tips</h4><p><span class="ls-badge ls-badge--info">Information</span> When this setting is set to <span class="val">Yes</span>, HTTP3/QUIC can still be disabled at the virtual host level through the <span class="tagl"><a href="VHSSL_Help.html#vhEnableQuic">Enable HTTP3/QUIC</a></span> setting.</p> </article> </div>
<div class="helpitem"><article class="ls-helpitem"><header class="ls-helpitem__header" id="clientVerify"><h3>Client Verification<span class="ls-permlink"><a href="#clientVerify"></a></span></h3></header><h4>Description</h4><p> Specifies the type of client certifcate authentication. Available types are: <ul> <li><b>None:</b> No client certificate is required.</li> <li><b>Optional:</b> Client certificate is optional.</li> <li><b>Require:</b> The client must has valid certificate.</li> <li><b>Optional_no_ca:</b> Same as optional.</li> </ul> The default is "None".</p> <h4>Syntax</h4><p>Select from drop down list</p> <h4>Tips</h4><p><span class="ls-badge ls-badge--info">Information</span> "None" or "Require" are recommended.</p> </article> </div>
<div class="helpitem"><article class="ls-helpitem"><header class="ls-helpitem__header" id="verifyDepth"><h3>Verify Depth<span class="ls-permlink"><a href="#verifyDepth"></a></span></h3></header><h4>Description</h4><p> Specifies how deeply a certificate should be verified before determining that the client does not have a valid certificate. The default is "1".</p> <h4>Syntax</h4><p>Select from drop down list</p> </article> </div>
<div class="helpitem"><article class="ls-helpitem"><header class="ls-helpitem__header" id="crlPath"><h3>Client Revocation Path<span class="ls-permlink"><a href="#crlPath"></a></span></h3></header><h4>Description</h4><p> Specifies the directory containing PEM-encoded CA CRL files for revoked client certificates. The files in this directory have to be PEM-encoded. These files are accessed through hash filenames, hash-value.rN. Please refer to openSSL or Apache mod_ssl documentation regarding creating the hash filename.</p> <h4>Syntax</h4><p>path</p> </article> </div>
<div class="helpitem"><article class="ls-helpitem"><header class="ls-helpitem__header" id="crlFile"><h3>Client Revocation File<span class="ls-permlink"><a href="#crlFile"></a></span></h3></header><h4>Description</h4><p> Specifies the file containing PEM-encoded CA CRL files enumerating revoked client certificates. This can be used as an alternative or in addition to <span class="tagl"><a href="#crlPath">Client Revocation Path</a></span>.</p> <h4>Syntax</h4><p>Filename which can be an absolute path or a relative path to $SERVER_ROOT.</p> </article> </div>
</section>
</article></div><button class="doc-back-to-top" type="button" aria-label="Back to top" data-back-to-top><svg viewBox="0 0 24 24" aria-hidden="true" focusable="false"><path d="M12 19V5" /><path d="m6 11 6-6 6 6" /></svg><span class="sr-only">Back to top</span></button><footer class="copyright">Copyright © 2013-2026. <a href="https://www.litespeedtech.com">LiteSpeed Technologies Inc.</a> All rights reserved.</footer>
</div>
</body>
</html>