+# initially set this variable to the value of the environment
+# variable $MAIL or $MAILDIR if either is defined.
+#
+#
+# set ssl_ca_certificates_file=""
+#
+# Name: ssl_ca_certificates_file
+# Type: path
+# Default: ""
+#
+#
+# This variable specifies a file containing trusted CA certificates.
+# Any server certificate that is signed with one of these CA
+# certificates is also automatically accepted.
+#
+# Example:
+# set ssl_ca_certificates_file=/etc/ssl/certs/ca-certificates.crt
+#
+#
+# set ssl_client_cert=""
+#
+# Name: ssl_client_cert
+# Type: path
+# Default: ""
+#
+#
+# The file containing a client certificate and its associated private
+# key.
+#
+#
+# set ssl_force_tls=no
+#
+# Name: ssl_force_tls
+# Type: boolean
+# Default: no
+#
+#
+# If this variable is set, Mutt will require that all connections
+# to remote servers be encrypted. Furthermore it will attempt to
+# negotiate TLS even if the server does not advertise the capability,
+# since it would otherwise have to abort the connection anyway. This
+# option supersedes $ssl_starttls.
+#
+#
+# set ssl_min_dh_prime_bits=0
+#
+# Name: ssl_min_dh_prime_bits
+# Type: number
+# Default: 0
+#
+#
+# This variable specifies the minimum acceptable prime size (in bits)
+# for use in any Diffie-Hellman key exchange. A value of 0 will use
+# the default from the GNUTLS library.
+#
+#
+# set ssl_starttls=yes
+#
+# Name: ssl_starttls
+# Type: quadoption
+# Default: yes
+#
+#
+# If set (the default), mutt will attempt to use STARTTLS on servers
+# advertising the capability. When unset, mutt will not attempt to
+# use STARTTLS regardless of the server's capabilities.
+#
+#
+# set ssl_use_sslv2=no
+#
+# Name: ssl_use_sslv2
+# Type: boolean
+# Default: no
+#
+#
+# This variable specifies whether to attempt to use SSLv2 in the
+# SSL authentication process.
+#
+#
+# set ssl_use_sslv3=yes
+#
+# Name: ssl_use_sslv3
+# Type: boolean
+# Default: yes
+#
+#
+# This variable specifies whether to attempt to use SSLv3 in the
+# SSL authentication process.
+#
+#
+# set ssl_use_tlsv1=yes
+#
+# Name: ssl_use_tlsv1
+# Type: boolean
+# Default: yes
+#
+#
+# This variable specifies whether to attempt to use TLSv1 in the
+# SSL authentication process.
+#
+#
+# set ssl_usesystemcerts=yes
+#
+# Name: ssl_usesystemcerts
+# Type: boolean
+# Default: yes
+#
+#
+# If set to yes, mutt will use CA certificates in the
+# system-wide certificate store when checking if a server certificate
+# is signed by a trusted CA.
+#
+#
+# set ssl_verify_dates=yes
+#
+# Name: ssl_verify_dates
+# Type: boolean
+# Default: yes
+#
+#
+# If set (the default), mutt will not automatically accept a server
+# certificate that is either not yet valid or already expired. You should
+# only unset this for particular known hosts, using the
+# <account-hook> function.
+#
+#
+# set ssl_verify_host=yes
+#
+# Name: ssl_verify_host
+# Type: boolean
+# Default: yes
+#
+#
+# If set (the default), mutt will not automatically accept a server
+# certificate whose host name does not match the host used in your folder
+# URL. You should only unset this for particular known hosts, using
+# the <account-hook> function.