1. cPanel & WHM Documentation
  2. WHM
  3. Scripts
  4. The set-tls-settings Script
ssl whmadvanced

The set-tls-settings Script

Valid for versions 82 through the latest version

Version:

82

Last modified: July 28, 2022

Overview

The /usr/local/cpanel/bin/set-tls-settings script configures a server’s Secure Socket Layer (SSL) and Transport Layer Security (TLS) cipher suites and protocols for the following services:

  • Web Disk (cpdavd).

  • The cPanel server (cpsrvd).

  • The Dovecot mail server (dovecot).

  • Exim configuration settings (exim).

For more information about these services, read our Service Manager documentation.

Run the script

To run the /usr/local/cpanel/bin/set-tls-settings script on the command line, use the following format:

/usr/local/cpanel/bin/set-tls-settings [options]

Options

This script accepts the following options:

Option Description Example
--if-missing Configure the SSL/TLS protocols if they do not currently exist on the server. --if-missing
--cipher-suites A standard OpenSSL cipher suite string.
Note:
For more information about cipher suites available to OpenSSL, read OpenSSL’s Ciphers documentation.

--cipher-suites=ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
--protocols A colon-separated list of SSL/TLS protocols. This option accepts the following protocols:
  • SSLv2
  • SSLv3
  • TLSv1
  • TLSv1.1
  • TLSv1.2
    		 --protocols=SSLv3:TLSv1.2
    service The service for which to set SSL/TLS protocols. This option accepts the following services:
    • cpdavd
    • cpsrvd
    • dovecot
    • exim
    Important:
    Pass the --all option to set the SSL/TLS protocols for all of this option’s services.
    		dovecot
    --restart Restart the specified services to apply the changes. If you do not pass this option, the script sets the configuration parameters and rebuilds the configuration files. Changes to the services may not display until after a restart.
    Note:
    • This option **requires** you pass a `service` option.
    • This option restarts **all** services when you pass the `service` option's `--all` option.
    		--restart
    --verbose Run the script in verbose mode. --verbose

    Additional Documentation