- # at all
- for my $sockname (@inherited_names) {
- $sockname =~ /:([0-9]+)\z/ or next;
- if (my $scheme = $KNOWN_TLS{$1}) {
- $xnetd->{$sockname} = load_mod($scheme);
- $tls_opt{"$scheme://$sockname"} ||= accept_tls_opt('');
- } elsif (($scheme = $KNOWN_STARTTLS{$1})) {
- $xnetd->{$sockname} = load_mod($scheme);
- $tls_opt{"$scheme://$sockname"} ||= accept_tls_opt('');
- $tls_opt{''} ||= accept_tls_opt('');
+ # at all. This allows socket-activation users to set certs once
+ # and not have to configure each socket:
+ if (defined $default_cert) {
+ my ($stls) = (($default_scheme // '') =~ /\A(pop3|nntp|imap)/);
+ for my $x (@inherited_names) {
+ $x =~ /:([0-9]+)\z/ or next; # no TLS for AF_UNIX
+ if (my $scheme = $KNOWN_TLS{$1}) {
+ $xnetd->{$x} //= load_mod($scheme);
+ $tls_opt{"$scheme://$x"} ||= accept_tls_opt('');
+ } elsif (($scheme = $KNOWN_STARTTLS{$1})) {
+ $xnetd->{$x} //= load_mod($scheme);
+ $tls_opt{"$scheme://$x"} ||= accept_tls_opt('');
+ } elsif (defined $stls) {
+ $tls_opt{"$stls://$x"} ||= accept_tls_opt('');
+ }
+ }
+ }
+ if (defined $default_scheme) {
+ for my $x (@inherited_names) {
+ $xnetd->{$x} //= load_mod($default_scheme);