export declare const _envoy_extensions_transport_sockets_tls_v3_TlsParameters_TlsProtocol: {
    /**
     * Envoy will choose the optimal TLS version.
     */
    readonly TLS_AUTO: "TLS_AUTO";
    /**
     * TLS 1.0
     */
    readonly TLSv1_0: "TLSv1_0";
    /**
     * TLS 1.1
     */
    readonly TLSv1_1: "TLSv1_1";
    /**
     * TLS 1.2
     */
    readonly TLSv1_2: "TLSv1_2";
    /**
     * TLS 1.3
     */
    readonly TLSv1_3: "TLSv1_3";
};
export type _envoy_extensions_transport_sockets_tls_v3_TlsParameters_TlsProtocol = 
/**
 * Envoy will choose the optimal TLS version.
 */
'TLS_AUTO' | 0
/**
 * TLS 1.0
 */
 | 'TLSv1_0' | 1
/**
 * TLS 1.1
 */
 | 'TLSv1_1' | 2
/**
 * TLS 1.2
 */
 | 'TLSv1_2' | 3
/**
 * TLS 1.3
 */
 | 'TLSv1_3' | 4;
export type _envoy_extensions_transport_sockets_tls_v3_TlsParameters_TlsProtocol__Output = typeof _envoy_extensions_transport_sockets_tls_v3_TlsParameters_TlsProtocol[keyof typeof _envoy_extensions_transport_sockets_tls_v3_TlsParameters_TlsProtocol];
/**
 * [#next-free-field: 6]
 */
export interface TlsParameters {
    /**
     * Minimum TLS protocol version. By default, it's ``TLSv1_2`` for both clients and servers.
     *
     * TLS protocol versions below TLSv1_2 require setting compatible ciphers with the
     * ``cipher_suites`` setting as the default ciphers no longer include compatible ciphers.
     *
     * .. attention::
     *
     * Using TLS protocol versions below TLSv1_2 has serious security considerations and risks.
     */
    'tls_minimum_protocol_version'?: (_envoy_extensions_transport_sockets_tls_v3_TlsParameters_TlsProtocol);
    /**
     * Maximum TLS protocol version. By default, it's ``TLSv1_2`` for clients and ``TLSv1_3`` for
     * servers.
     */
    'tls_maximum_protocol_version'?: (_envoy_extensions_transport_sockets_tls_v3_TlsParameters_TlsProtocol);
    /**
     * If specified, the TLS listener will only support the specified `cipher list
     * <https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#Cipher-suite-configuration>`_
     * when negotiating TLS 1.0-1.2 (this setting has no effect when negotiating TLS 1.3).
     *
     * If not specified, a default list will be used. Defaults are different for server (downstream) and
     * client (upstream) TLS configurations.
     * Defaults will change over time in response to security considerations; If you care, configure
     * it instead of using the default.
     *
     * In non-FIPS builds, the default server cipher list is:
     *
     * .. code-block:: none
     *
     * [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
     * [ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]
     * ECDHE-ECDSA-AES256-GCM-SHA384
     * ECDHE-RSA-AES256-GCM-SHA384
     *
     * In builds using :ref:`BoringSSL FIPS <arch_overview_ssl_fips>`, the default server cipher list is:
     *
     * .. code-block:: none
     *
     * ECDHE-ECDSA-AES128-GCM-SHA256
     * ECDHE-RSA-AES128-GCM-SHA256
     * ECDHE-ECDSA-AES256-GCM-SHA384
     * ECDHE-RSA-AES256-GCM-SHA384
     *
     * In non-FIPS builds, the default client cipher list is:
     *
     * .. code-block:: none
     *
     * [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
     * [ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]
     * ECDHE-ECDSA-AES256-GCM-SHA384
     * ECDHE-RSA-AES256-GCM-SHA384
     *
     * In builds using :ref:`BoringSSL FIPS <arch_overview_ssl_fips>`, the default client cipher list is:
     *
     * .. code-block:: none
     *
     * ECDHE-ECDSA-AES128-GCM-SHA256
     * ECDHE-RSA-AES128-GCM-SHA256
     * ECDHE-ECDSA-AES256-GCM-SHA384
     * ECDHE-RSA-AES256-GCM-SHA384
     */
    'cipher_suites'?: (string)[];
    /**
     * If specified, the TLS connection will only support the specified ECDH
     * curves. If not specified, the default curves will be used.
     *
     * In non-FIPS builds, the default curves are:
     *
     * .. code-block:: none
     *
     * X25519
     * P-256
     *
     * In builds using :ref:`BoringSSL FIPS <arch_overview_ssl_fips>`, the default curve is:
     *
     * .. code-block:: none
     *
     * P-256
     */
    'ecdh_curves'?: (string)[];
    /**
     * If specified, the TLS connection will only support the specified signature algorithms.
     * The list is ordered by preference.
     * If not specified, the default signature algorithms defined by BoringSSL will be used.
     *
     * Default signature algorithms selected by BoringSSL (may be out of date):
     *
     * .. code-block:: none
     *
     * ecdsa_secp256r1_sha256
     * rsa_pss_rsae_sha256
     * rsa_pkcs1_sha256
     * ecdsa_secp384r1_sha384
     * rsa_pss_rsae_sha384
     * rsa_pkcs1_sha384
     * rsa_pss_rsae_sha512
     * rsa_pkcs1_sha512
     * rsa_pkcs1_sha1
     *
     * Signature algorithms supported by BoringSSL (may be out of date):
     *
     * .. code-block:: none
     *
     * rsa_pkcs1_sha256
     * rsa_pkcs1_sha384
     * rsa_pkcs1_sha512
     * ecdsa_secp256r1_sha256
     * ecdsa_secp384r1_sha384
     * ecdsa_secp521r1_sha512
     * rsa_pss_rsae_sha256
     * rsa_pss_rsae_sha384
     * rsa_pss_rsae_sha512
     * ed25519
     * rsa_pkcs1_sha1
     * ecdsa_sha1
     */
    'signature_algorithms'?: (string)[];
}
/**
 * [#next-free-field: 6]
 */
export interface TlsParameters__Output {
    /**
     * Minimum TLS protocol version. By default, it's ``TLSv1_2`` for both clients and servers.
     *
     * TLS protocol versions below TLSv1_2 require setting compatible ciphers with the
     * ``cipher_suites`` setting as the default ciphers no longer include compatible ciphers.
     *
     * .. attention::
     *
     * Using TLS protocol versions below TLSv1_2 has serious security considerations and risks.
     */
    'tls_minimum_protocol_version': (_envoy_extensions_transport_sockets_tls_v3_TlsParameters_TlsProtocol__Output);
    /**
     * Maximum TLS protocol version. By default, it's ``TLSv1_2`` for clients and ``TLSv1_3`` for
     * servers.
     */
    'tls_maximum_protocol_version': (_envoy_extensions_transport_sockets_tls_v3_TlsParameters_TlsProtocol__Output);
    /**
     * If specified, the TLS listener will only support the specified `cipher list
     * <https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#Cipher-suite-configuration>`_
     * when negotiating TLS 1.0-1.2 (this setting has no effect when negotiating TLS 1.3).
     *
     * If not specified, a default list will be used. Defaults are different for server (downstream) and
     * client (upstream) TLS configurations.
     * Defaults will change over time in response to security considerations; If you care, configure
     * it instead of using the default.
     *
     * In non-FIPS builds, the default server cipher list is:
     *
     * .. code-block:: none
     *
     * [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
     * [ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]
     * ECDHE-ECDSA-AES256-GCM-SHA384
     * ECDHE-RSA-AES256-GCM-SHA384
     *
     * In builds using :ref:`BoringSSL FIPS <arch_overview_ssl_fips>`, the default server cipher list is:
     *
     * .. code-block:: none
     *
     * ECDHE-ECDSA-AES128-GCM-SHA256
     * ECDHE-RSA-AES128-GCM-SHA256
     * ECDHE-ECDSA-AES256-GCM-SHA384
     * ECDHE-RSA-AES256-GCM-SHA384
     *
     * In non-FIPS builds, the default client cipher list is:
     *
     * .. code-block:: none
     *
     * [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
     * [ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]
     * ECDHE-ECDSA-AES256-GCM-SHA384
     * ECDHE-RSA-AES256-GCM-SHA384
     *
     * In builds using :ref:`BoringSSL FIPS <arch_overview_ssl_fips>`, the default client cipher list is:
     *
     * .. code-block:: none
     *
     * ECDHE-ECDSA-AES128-GCM-SHA256
     * ECDHE-RSA-AES128-GCM-SHA256
     * ECDHE-ECDSA-AES256-GCM-SHA384
     * ECDHE-RSA-AES256-GCM-SHA384
     */
    'cipher_suites': (string)[];
    /**
     * If specified, the TLS connection will only support the specified ECDH
     * curves. If not specified, the default curves will be used.
     *
     * In non-FIPS builds, the default curves are:
     *
     * .. code-block:: none
     *
     * X25519
     * P-256
     *
     * In builds using :ref:`BoringSSL FIPS <arch_overview_ssl_fips>`, the default curve is:
     *
     * .. code-block:: none
     *
     * P-256
     */
    'ecdh_curves': (string)[];
    /**
     * If specified, the TLS connection will only support the specified signature algorithms.
     * The list is ordered by preference.
     * If not specified, the default signature algorithms defined by BoringSSL will be used.
     *
     * Default signature algorithms selected by BoringSSL (may be out of date):
     *
     * .. code-block:: none
     *
     * ecdsa_secp256r1_sha256
     * rsa_pss_rsae_sha256
     * rsa_pkcs1_sha256
     * ecdsa_secp384r1_sha384
     * rsa_pss_rsae_sha384
     * rsa_pkcs1_sha384
     * rsa_pss_rsae_sha512
     * rsa_pkcs1_sha512
     * rsa_pkcs1_sha1
     *
     * Signature algorithms supported by BoringSSL (may be out of date):
     *
     * .. code-block:: none
     *
     * rsa_pkcs1_sha256
     * rsa_pkcs1_sha384
     * rsa_pkcs1_sha512
     * ecdsa_secp256r1_sha256
     * ecdsa_secp384r1_sha384
     * ecdsa_secp521r1_sha512
     * rsa_pss_rsae_sha256
     * rsa_pss_rsae_sha384
     * rsa_pss_rsae_sha512
     * ed25519
     * rsa_pkcs1_sha1
     * ecdsa_sha1
     */
    'signature_algorithms': (string)[];
}