Struct RustlsConfig 

pub struct RustlsConfig { /* private fields */ }

Available on crate feature tls-rustls only.

Rustls configuration.

Implementations

impl RustlsConfig

pub fn from_config(config: Arc<ServerConfig>) -> Self

Create config from Arc<ServerConfig>.

NOTE: You need to set ALPN protocols (like http/1.1 or h2) manually.

pub async fn from_der(cert: Vec<Vec<u8>>, key: Vec<u8>) -> Result<Self>

Create config from DER-encoded data.

The certificate must be DER-encoded X.509.

The private key must be DER-encoded ASN.1 in either PKCS#8 or PKCS#1 format.

pub async fn from_pem(cert: Vec<u8>, key: Vec<u8>) -> Result<Self>

Create config from PEM formatted data.

Certificate and private key must be in PEM format.

pub async fn from_pem_file( cert: impl AsRef<Path>, key: impl AsRef<Path>, ) -> Result<Self>

Create config from PEM formatted files.

Contents of certificate file and private key file must be in PEM format.

Examples found in repository

examples/rustls_session.rs (lines 16-19)

async fn main() {
    let app = Router::new().route("/", get(handler));

    let config = RustlsConfig::from_pem_file(
        "examples/self-signed-certs/cert.pem",
        "examples/self-signed-certs/key.pem",
    )
    .await
    .unwrap();

    let addr = SocketAddr::from(([127, 0, 0, 1], 3000));

    println!("listening on {}", addr);

    axum_server::bind_rustls(addr, config)
        .serve(app.into_make_service())
        .await
        .unwrap();
}

examples/rustls_server.rs (lines 13-16)

async fn main() {
    let app = Router::new().route("/", get(|| async { "Hello, world!" }));

    let config = RustlsConfig::from_pem_file(
        "examples/self-signed-certs/cert.pem",
        "examples/self-signed-certs/key.pem",
    )
    .await
    .unwrap();

    let addr = SocketAddr::from(([127, 0, 0, 1], 3000));
    println!("listening on {}", addr);
    axum_server::tls_rustls::bind_rustls(addr, config)
        .serve(app.into_make_service())
        .await
        .unwrap();
}

examples/http_and_https.rs (lines 39-42)

async fn https_server() {
    let app = Router::new().route("/", get(|| async { "Hello, world!" }));

    let config = RustlsConfig::from_pem_file(
        "examples/self-signed-certs/cert.pem",
        "examples/self-signed-certs/key.pem",
    )
    .await
    .unwrap();

    let addr = SocketAddr::from(([127, 0, 0, 1], 3443));
    println!("https listening on {}", addr);
    axum_server::bind_rustls(addr, config)
        .serve(app.into_make_service())
        .await
        .unwrap();
}

examples/rustls_reload.rs (lines 18-21)

async fn main() {
    let app = Router::new().route("/", get(|| async { "Hello, world!" }));

    let config = RustlsConfig::from_pem_file(
        "examples/self-signed-certs/cert.pem",
        "examples/self-signed-certs/key.pem",
    )
    .await
    .unwrap();

    // Spawn a task to reload tls.
    tokio::spawn(reload(config.clone()));

    let addr = SocketAddr::from(([127, 0, 0, 1], 3000));
    println!("listening on {}", addr);
    axum_server::bind_rustls(addr, config)
        .serve(app.into_make_service())
        .await
        .unwrap();
}

examples/from_std_listener_rustls.rs (lines 14-17)

async fn main() {
    let app = Router::new().route("/", get(|| async { "Hello, world!" }));

    let config = RustlsConfig::from_pem_file(
        "examples/self-signed-certs/cert.pem",
        "examples/self-signed-certs/key.pem",
    )
    .await
    .unwrap();

    let addr = SocketAddr::from(([127, 0, 0, 1], 3000));
    let listener = TcpListener::bind(addr).unwrap();
    println!("listening on {}", addr);
    axum_server::from_tcp_rustls(listener, config)
        .unwrap()
        .serve(app.into_make_service())
        .await
        .unwrap();
}

examples/async_sni.rs (line 152)

    async fn resolve(&self, server_name: Option<&str>) -> io::Result<RustlsConfig> {
        let server_name = server_name.ok_or_else(|| {
            io::Error::new(
                io::ErrorKind::InvalidData,
                "client did not send a server name",
            )
        })?;

        let (cert, key) = self.certificates.get(server_name).ok_or_else(|| {
            io::Error::new(
                io::ErrorKind::NotFound,
                format!("no certificate registered for {server_name}"),
            )
        })?;

        println!("resolving certificate for {server_name}");

        // Async I/O happens here, before the handshake continues. `from_pem_file`
        // also sets the `h2` and `http/1.1` ALPN protocols. A `ServerConfig`
        // built by hand must set them too.
        RustlsConfig::from_pem_file(cert, key).await
    }

Additional examples can be found in:

• examples/reverse_proxy.rs

pub async fn from_sni_pem_files<I, S, P, K>(files: I) -> Result<Self>

where I: IntoIterator<Item = (S, P, K)>, S: AsRef<str>, P: AsRef<Path>, K: AsRef<Path>,

Create config from PEM formatted files, selecting the certificate by the server name sent by the client using SNI.

Each item is (server_name, certificate_path, private_key_path). The server name is matched against the client’s SNI value, and each certificate must be valid for the name it is registered under.

The certificate and private key files must be in PEM format.

pub fn get_inner(&self) -> Arc<ServerConfig>

Get inner Arc<ServerConfig>.

Examples found in repository

examples/async_sni.rs (line 90)

    fn accept(&self, stream: I, service: S) -> Self::Future {
        let store = self.store.clone();
        let handshake_timeout = self.handshake_timeout;

        Box::pin(async move {
            // One deadline covers reading the ClientHello and the handshake.
            let deadline = Instant::now() + handshake_timeout;

            let start = timeout_at(
                deadline,
                LazyConfigAcceptor::new(Acceptor::default(), stream),
            )
            .await
            .map_err(|_| timeout_error())??;

            let server_name = start.client_hello().server_name().map(str::to_owned);
            let config = store.resolve(server_name.as_deref()).await?;

            let stream = timeout_at(deadline, start.into_stream(config.get_inner()))
                .await
                .map_err(|_| timeout_error())??;

            Ok((stream, service))
        })
    }

pub fn reload_from_config(&self, config: Arc<ServerConfig>)

Reload config from Arc<ServerConfig>.

pub async fn reload_from_der( &self, cert: Vec<Vec<u8>>, key: Vec<u8>, ) -> Result<()>

Reload config from DER-encoded data.

The certificate must be DER-encoded X.509.

The private key must be DER-encoded ASN.1 in either PKCS#8 or PKCS#1 format.

pub async fn from_pem_chain_file( chain: impl AsRef<Path>, key: impl AsRef<Path>, ) -> Result<Self>

This helper will establish a TLS server based on strong cipher suites from a PEM-formatted certificate chain and key.

pub async fn reload_from_pem(&self, cert: Vec<u8>, key: Vec<u8>) -> Result<()>

Reload config from PEM formatted data.

Certificate and private key must be in PEM format.

pub async fn reload_from_pem_file( &self, cert: impl AsRef<Path>, key: impl AsRef<Path>, ) -> Result<()>

Reload config from PEM formatted files.

Contents of certificate file and private key file must be in PEM format.

Examples found in repository

examples/rustls_reload.rs (lines 44-47)

async fn reload(config: RustlsConfig) {
    // Wait for 20 seconds.
    sleep(Duration::from_secs(20)).await;

    println!("reloading rustls configuration");

    // Reload rustls configuration from new files.
    config
        .reload_from_pem_file(
            "examples/self-signed-certs/reload/cert.pem",
            "examples/self-signed-certs/reload/key.pem",
        )
        .await
        .unwrap();

    println!("rustls configuration reloaded");
}

impl RustlsConfig

pub async fn from_pem_with_password( cert: Vec<u8>, key: Vec<u8>, password: impl AsRef<[u8]>, ) -> Result<Self>

Create config from a PEM formatted certificate and an encrypted PKCS#8 private key.

The key must be a PKCS#8 ENCRYPTED PRIVATE KEY section, as produced by openssl pkcs8 -topk8.

pub async fn from_pem_file_with_password( cert: impl AsRef<Path>, key: impl AsRef<Path>, password: impl AsRef<[u8]>, ) -> Result<Self>

Create config from PEM formatted files, where the private key is an encrypted PKCS#8 key.

pub async fn reload_from_pem_with_password( &self, cert: Vec<u8>, key: Vec<u8>, password: impl AsRef<[u8]>, ) -> Result<()>

Reload config from a PEM formatted certificate and an encrypted PKCS#8 private key.

pub async fn reload_from_pem_file_with_password( &self, cert: impl AsRef<Path>, key: impl AsRef<Path>, password: impl AsRef<[u8]>, ) -> Result<()>

Reload config from PEM formatted files, where the private key is an encrypted PKCS#8 key.

Trait Implementations

impl Clone for RustlsConfig

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RustlsConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.