anchor.diff:        };
   
         clients = mkOption {
  -        description = "Define the client configurations.";
  -        type = with types; attrsOf (submodule clientConfig);
  +        description = ''
  +          Define the client configurations.
  +
  +          By default, verifyChain and OCSPaia are enabled and a CAFile is provided from pkgs.cacert.
  +
  +          See "SERVICE-LEVEL OPTIONS" in <citerefentry><refentrytitle>stunnel</refentrytitle>
  +          <manvolnum>8</manvolnum></citerefentry>.
  +        '';
  +        type = with types; attrsOf (attrsOf (nullOr (oneOf [bool int str])));
  +
  +        apply = let
  +          applyDefaults = c:
  +            {
  +              CAFile = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
  +              OCSPaia = true;
  +              verifyChain = true;
  +            } // c;
  +          setCheckHostFromVerifyHostname = c:
  +            # To preserve backward-compatibility with the old NixOS stunnel module
  +            # definition, allow "verifyHostname" as an alias for "checkHost".
  +            c // {
  +              checkHost = c.checkHost or c.verifyHostname or null;
  +              verifyHostname = null; # Not a real stunnel configuration setting
  +            };
  +          forceClient = c: c // { client = true; };
  +        in mapAttrs (_: c: forceClient (setCheckHostFromVerifyHostname (applyDefaults c)));
  +
           example = {
             foobar = {
               accept = "0.0.0.0:8080";
  
positive.code:       })
  
        (mapAttrsToList verifyChainPathAssert cfg.clients)
      ];
  
      environment.systemPackages = [ pkgs.stunnel ];
  
negative.code:       ${ optionalString cfg.enableInsecureSSLv3 "options = -NO_SSLv3" }
  
        ; ----- SERVER CONFIGURATIONS -----
        ${ generateConfig cfg.servers }
  
        ; ----- CLIENT CONFIGURATIONS -----
        ${ generateConfig cfg.clients }
      '';
  
      systemd.services.stunnel = {
  