Varnish Cache Plus



vmod-tls lets you query details relating to a TLS connection.

If called from one of the client VCL subroutines (e.g. vcl_recv or vcl_deliver), it will provide details about the client TLS connection.

If called from vcl_backend_response, vmod-tls will show details from the currently established TLS backend connection.

Note that the client-side functionality relies on using Varnish’s native TLS implementation. If you are currently terminating TLS in a separate process (for example using Hitch), you should instead use the PROXY VMOD which offers similar functionality.


Client connection

The following example will report which TLS version and which cipher is used for the client connection.

import tls;

sub vcl_deliver {
	if (tls.is_tls()) {
		# Report cipher and TLS version as a response header
		set resp.http.tls-version = tls.version();
		set resp.http.tls-cipher = tls.cipher();

		# Alternatively, we can log it
		std.log("tls-version: " + tls.version());
		std.log("tls-cipher: " + tls.cipher());

Backend connection

The following example will report information about the backend connection. This is only available from vcl_backend_response.

import tls;

sub vcl_backend_response {
	if (tls.is_tls()) {
		# Report cipher and TLS version as a backend response header
		set = tls.version();
		set = tls.cipher();

		# Also log:
		std.log("backend-tls-version: " + tls.version());
		std.log("backend-tls-cipher: " + tls.cipher());



BOOL is_tls()

Indicates whether the peer is connected over an SSL/TLS connection.


STRING version()

Returns the TLS version in use for this connection. E.g. “TLSv1.2”.


STRING cipher()

Returns the cipher that was chosen during the TLS handshake.


STRING authority()

Returns the hostname presented for Server Name Indication (SNI).


STRING alpn()

Returns the result of the Application Layer Protocol Negotiation (ALPN). This will contain one of “http/1.1”, “h2” or NULL if no ALPN happened.

Varnish does not currently do ALPN with its backends, so if used in vcl_backend_response this will always return NULL.


STRING cert_sign()

Certificate signature algorithm. E.g. “SHA256”.


STRING cert_key()

The algorithm used to generate the certificate. E.g. “RSA2048”.