Crate alktls 

alktls: shared TLS setup types — server and client rustls configs, cert resolvers, verifiers, ACME state-machine wiring, and the identity / credential / fingerprint types that drive config construction.

The crate owns config construction: given an identity and an ALPN list, produce a rustls::ServerConfig or rustls::ClientConfig and hand it to whichever transport wrapper the deployment runs (noq for QUIC, tokio-rustls for TCP+TLS). It does not dial, accept, dispatch, or resolve peer identities — those belong to the dial seam, the accept loop, and the auth layer.

Core types:

• TlsServerConfig — built once per identity + ALPN list, shared across transports via Arc (not Clone; it holds the ACME task’s JoinHandle).
• TlsClientConfig — built per dial from a ConnectionCredentials + ALPN; consumed by its accessors.
• TlsError — the config-construction error type. Handshake outcomes and ACME runtime errors are not TlsErrors.

Transport-specific accessors are feature-gated: noq (for_noq), tcp (for_tcp_tls), acme (the ACME path). default = [].

Re-exports

pub use fingerprint::extract_ed25519_raw_key_from_spki;

pub use fingerprint::fingerprint_from_cert_der;

pub use pem::load_cert_chain;

pub use pem::load_private_key;

pub use signing::Ed25519SigningKey;

pub use identity::AcmeDirectory;

pub use identity::Ed25519SecretKey;

pub use identity::TlsIdentity;

pub use client::build_client_auth;

pub use client::load_platform_root_cert_store;

pub use client::select_server_verifier;

pub use client::FingerprintPinVerifier;

pub use client::NoClientCertResolver;

pub use client::RawKeyClientCertResolver;

pub use client::TlsClientConfig;

pub use credentials::ConnectionCredentials;

pub use credentials::RemoteIdentity;

pub use server::build_rustls_server_config;

pub use server::generate_self_signed_cert;

pub use server::AcceptAnyCertVerifier;

pub use server::RawKeyCertResolver;

pub use server::SelfSignedCert;

pub use server::TlsServerConfig;

pub use server::VerifyPresentedCertVerifier;

Modules

client

Client-side TLS configuration: TlsClientConfig, FingerprintPinVerifier, RawKeyClientCertResolver, NoClientCertResolver, select_server_verifier, build_client_auth, load_platform_root_cert_store.

credentials

Transport-level credential bundle for outbound connections: ConnectionCredentials, RemoteIdentity (ADR-005, moved from alknet-core credentials.rs; alknet ADR-091’s semantics).

fingerprint

TLS certificate fingerprint extraction: fingerprint_from_cert_der, extract_ed25519_raw_key_from_spki, and the private manual DER parser (ADR-005, moved from alknet-core).

identity

Identity types: TlsIdentity, Ed25519SecretKey, AcmeDirectory (ADR-005, moved from alknet-core config.rs).

pem

PEM loading helpers: load_cert_chain, load_private_key. One copy used by both server and client.

server

Server-side TLS configuration: TlsServerConfig, build_rustls_server_config, RawKeyCertResolver, VerifyPresentedCertVerifier, AcceptAnyCertVerifier, SelfSignedCert / generate_self_signed_cert, and the ACME path (feature acme).

signing

Ed25519 signing key usable as both a rustls SigningKey and Signer: Ed25519SigningKey. One copy used by both server (RawKeyCertResolver) and client (RawKeyClientCertResolver).

Enums

TlsError