+#LogDestination x-syslog:///
+#LogDestination x-syslog:///log_local2
+
+# There is an option for doing some simple loop prevention. Note that
+# the LoopPrevention directive can be used in server blocks too,
+# overriding what's set here in the basic settings.
+#LoopPrevention on
+# Add TTL attribute with value 20 if not present (prevents endless loops)
+#addTTL 20
+
+# If we have TLS clients or servers we must define at least one tls block.
+# You can name them whatever you like and then reference them by name when
+# specifying clients or servers later. There are however three special names
+# "default", "defaultclient" and "defaultserver". If no name is defined for
+# a client, the "defaultclient" block will be used if it exists, if not the
+# "default" will be used. For a server, "defaultserver" followed by "default"
+# will be checked.
+#
+# The simplest configuration you can do is:
+tls default {
+ # You must specify at least one of CACertificateFile or CACertificatePath
+ # for TLS to work. We always verify peer certificate (client and server)
+ # CACertificateFile /etc/cacerts/CA.pem
+ CACertificatePath /etc/cacerts
+
+ # You must specify the below for TLS, we always present our certificate
+ CertificateFile /etc/hostcertkey/host.example.com.pem
+ CertificateKeyFile /etc/hostcertkey/host.example.com.key.pem
+ # Optionally specify password if key is encrypted (not very secure)
+ CertificateKeyPassword "follow the white rabbit"
+ # Optionally enable CRL checking
+ # CRLCheck on
+ # Optionally specify how long CAs and CRLs are cached, default forever
+ # CacheExpiry 3600
+ # Optionally require that peer certs have one of the specified policyOIDs
+ # policyoid 1.2.3 # this option can be used multiple times
+ # policyoid 1.3.4
+}