OptionalcaOptionalinsecureAccept ANY certificate (self-signed servers); explicit opt-in only.
TLS here is transport hygiene, not the trust anchor (headers are
validated by PoW/checkpoints either way), but verified TLS still stops
trivial on-path tampering and downgrade games. Prefer ca or
pinnedCertSha256 over this.
Optionalmaxcap on a single buffered protocol line (default 4 MiB)
OptionalpinnedPin the server certificate by SHA-256 fingerprint (hex, colons optional,
as printed by openssl x509 -fingerprint -sha256). Replaces CA
validation: the connection is accepted iff the presented certificate
matches, which also supports self-signed deployments without insecure.
Optionalportdefault 50002 (TLS); 50001 with tls:false
OptionaltimeoutOptionaltls
additional trusted CA certificate(s), PEM (e.g. a self-hosted server's own CA)