@varbin@infosec.exchange it'd probably be a 1 line patch at this point to make --tls-keylog default to the value of SSLKEYLOGFILE rather than empty. I'm no longer a core dev, but I might do it someday