Do you consider supporting ssl_protocols and ssl_ciphers dynamically

in nginx, it can not implement in one port, domain A support tlsv1.2, tlsv1.3 and domain B support tlsv1.2. like it:

http {
    server {
        listen 443 ssl default_server;
        ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
        ssl_ciphers "!MD5";
        ssl_ciphers "EECDH+3DES:RSA+3DES:!MD5";
        ...
    }
     server {
        listen 443 ssl;
        server_name  b.com;
        ssl_protocols TLSv1.1 TLSv1.2;
        ssl_ciphers "!MD5";        
        ...
    }
}

OpenSSL 1.1.1+ introduces SSL_CTX_set_client_hello_cb() . Through it can implement control ssl handshake protocols and ciphers by servename. it will be very helpful in some scenarios, such as CDN.

i hope implement it like this

http {
    ssl_client_hello_by_lua_block {
        local ssl = require "ngx.ssl"
	local host = ssl.client_server_name();
	if host == "b.com" then
	    ssl.set_protocols({"TLSv1.1", "TLSv1.2"})
            ssl.set_ciphers("!MD5")
	else
            ssl.set_protocols({"TLSv1.1", "TLSv1.2", "TLSv1.3"})
            ssl.set_ciphers("EECDH+3DES:RSA+3DES:!MD5")
	end
    }
    server {
        listen 443 ssl default_server;
        ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
        ssl_ciphers "!MD5";
        ssl_ciphers "EECDH+3DES:RSA+3DES:!MD5";
        ...
    }
}

i try implement it by PR. https://github.com/openresty/lua-nginx-module/pull/1566

Start by reviewing pull request #1566 and the proposed OpenSSL SSL_CTX_set_client_hello_cb() approach in the issue. Check how SNI-based selection of TLS protocols and ciphers would fit the lua-nginx-module; done means the requested per-server-name behavior is implemented and documented.