allow_tls10 = false
allow_tls11 = false
allow_tls12 = false
allow_tls13 = true
allow_dtls10 = false
allow_dtls12 = false
ciphers = AES-128/GCM ChaCha20Poly1305 AES-256/GCM
macs = AEAD
signature_schemes = ECDSA_SHA256 ECDSA_SHA384 ECDSA_SHA512 ECDSA_SHA1 RSA_PSS_SHA256 RSA_PSS_SHA384 RSA_PSS_SHA512 RSA_PKCS1_SHA256 RSA_PKCS1_SHA384 RSA_PKCS1_SHA512 RSA_PKCS1_SHA1 0x0402 0x0502 0x0602 0x0202
key_exchange_groups = x25519 secp256r1 secp384r1 secp521r1 ffdhe/ietf/2048 ffdhe/ietf/3072 ffdhe/ietf/4096 ffdhe/ietf/6144 ffdhe/ietf/8192
key_exchange_groups_to_offer = x25519
allow_insecure_renegotiation = false
include_time_in_hello_random = false
allow_server_initiated_renegotiation = false
hide_unknown_users = false
server_uses_own_ciphersuite_preferences = true
negotiate_encrypt_then_mac = true
session_ticket_lifetime = 86400
new_session_tickets_upon_handshake_success = 0
minimum_dh_group_size = 2048
minimum_ecdh_group_size = 255
minimum_rsa_bits = 1024
minimum_signature_strength = 110
record_size_limit = 16385

# TLS 1.3 compatibility mode is partially negotiated by the client. The server
# has no influence on whether compatibility mode is used or not. Hence, we
# disable compatibility mode for this server integration test to make sure that
# this configuration has no negative impact on the server's behaviour.
tls_13_middlebox_compatibility_mode = false

hash_hello_random = false
support_cert_status_message = false
