---
name: "stud"
section: "8"
platform: "linux"
package: "stud"
version: "0.3-3"
release: "Debian 7 (Wheezy)"
platforms: ["linux"]
url: "https://new.carta.tech/stud"
---

# stud(8)

The Scalable TLS Unwrapping Daemon

## NAME

**stud** – The Scalable TLS Unwrapping Daemon

## SYNOPSIS

**stud** \[**--tls**\] \[**--ssl**\] \[**-c** *ciphers*\] \[**-b** *host,port*\] \[**-f** *host,port*\] \[**-n** *cores*\] \[**-r** *path*\] \[**-u** *username*\] \[**--write-ip**\] \[**--write-proxy**\] *certificate.pem*

## DESCRIPTION

**stud** is a network proxy that terminates TLS/SSL connections and forwards the unencrypted traffic to some backend.  It's designed to handle 10s of thousands of connections efficiently on multicore machines.

**stud** has very few features -- it's designed to be paired with an intelligent backend like haproxy or nginx.  It maintains a strict 1:1 connection pattern with this backend handler so that the backend can dictate throttling behavior, maxmium connection behavior, availability of service, etc.

The only required argument is a path to a PEM file that contains the certificate (or a chain of certificates) and private key. It should also contain DH parameter if you wish to use Diffie-Hellman cipher suites.

The options are as follows:

- **--tls**

  Use TLSv1 (default).

- **--ssl**

  Use only SSLv3 and no TLSv1.

- **-c** *ciphers*

  Set allowed ciphers using the same format as **openssl** **ciphers**. For example, you can use *RSA:!COMPLEMENTOFALL*.

- **-b** *host,port*

  Define backend. Default is *127.0.0.1,8000*. Incoming connections will be unwrapped and sent to this IP and port.

- **-f** *host,port*

  Define frontend. Default is *\*,8443*. Incoming connections will be accepted to this IP and port and will be sent to the backend defined above.

- **-n** *cores*

  Use *cores* worker processes. Default is 1.

- **-r** *path*

  Chroot to the given path. By default, no chroot is done.

- **-u** *username*

  Set GID/UID after binding the socket. By default, no privilege is dropped.

- **--write-ip**

  Write 1 octet with the IP family followed by the IP address in 4 (IPv4) or 16 (IPv6) octets little-endian to backend before the actual data.

- **--write-proxy**

  Write HaProxy's PROXY (IPv4 or IPv6) protocol line before actual data.

## SEE ALSO

ciphers(1SSL), dhparam(1SSL), [haproxy(1)](/haproxy/1.md)

## AUTHORS

**stud** was originally written by Jamie Turner (@jamwt) and is maintained by the Bump server team.  It currently provides server-side TLS termination for over 40 million Bump users.