Hi, Varnish Author here... The reason why Varnish does not have built in TLS, is a matter of security design and flexibility. First, as to flexibility: If we

Hi, Varnish Author here... The reason why Varnish does not have built in TLS, is a matter of security design and flexibility. First, as to flexibility: If we added TLS support to Varnish, we would have to pick a TLS library, which means our users would automatically be locked into that library. This would violate one of our core principles, which is "Tools, not policies". And given the state of TLS implementations, I /really/ dont want to make that choice, I want to leave that to the person responsible for the security at the site running Varnish. Second, I think it is sound security engineering to confine the server certificate in a process which does that one thing and does it well. I know several sites that have two different TLS frontends in front of Varnish, using different TLS implementations, so that whenever a CVE hits one of them, they can just shut that half down until the issue is fixed, and still remain in production. That would not be possible if TLS was bolted into Varnish.