Audience check: does this need to include "for the format of preferred_ciphers, see ciphers(1)" with the appropriate .Xr here and in SEE ALSO?

How does this look. I used openssl-ciphers(1), since that
seems to be directly related to the preferred-cipher list
format expected by openssl.

I also added a simple comment on what should work,
copied from recent email I received from jhb@.

I'm not sure if "many" is quite correct. All of the TLS 1.3 cipher suites that you get from openssl ciphers -s -tls1_3 work with KTLS for both send and receive. Of the TLS 1.2 ciphers listed in openssl ciphers -s -tls1_2, 16 are for AES-CBC and will not work, and 11 are for AES-GCM or ChaCha20-Poly1305 and will work with KTLS. However, using AES-CBC is a becoming more obscure. Most TLS 1.2 sessions use AES-GCM (as do most TLS 1.3 sessions).

The other thing to perhaps consider is that SSL_CTX_set_cipher_list only affects TLS <= 1.2. TLS 1.3 uses SSL_CTX_set_ciphersuites. (Sorry, I didn't realize this yesterday.) If NFS over TLS is supposed to only use TLS 1.3, then it's probably not worth letting users configure the TLS 1.2 cipher list.

I wasn't quite precise in my e-mail, so probably replace Chacha20-poly1305 with either "ChaCha20-Poly1305" or "Chacha20-Poly1305". crypto(7) uses the former (both C's capitalized).

Thanks John. Obviously, the "-C" option should be changed to use
SSL_CTX_ciphersuites() soon. Btw, I found this nice man page, but
it is in debian and not the generic OpenSSL stuff. I don't know if the
list there would be accurate for FreeBSD?

https://manpages.debian.org/experimental/libssl-doc/SSL_CTX_set_ciphersuites.3ssl.en.html

This variant references SSL_CTX_set_ciphersuites() and
describes the list, plus using "openssl ciphers -s -tls1_3"
for the set to select from.

How does this variant sound?

I got rid of this sentence and replaced it with
a note to do the openssl command.

I would perhaps s/what/which/.

s/and that/which/

Maybe "lists valid ciphers" or "lists available ciphers"