Struct FetchTlsInit 

pub struct FetchTlsInit {
    pub ca_certs_der: Box<[Box<[u8]>]>,
    pub reject_unauthorized: Option<bool>,
    pub servername: Option<String>,
}

Per-fetch TLS options parsed from WHATWG-fetch init.tls (the Node undici dispatcher tls option subset): custom trust anchors, explicit verification opt-out, SNI override. None end-to-end = the previous behaviour byte-for-byte (stealth profile only, system roots, verify on).

Injection mapping (all fields land on the interned SSLConfig, so they participate in content_hash/is_same — distinct trust stores / SNI overrides never alias in the connection pool or TLS session cache):

• ca_certs_der → SSLConfig.ca_certs_der (servo CACertificates:: Override semantics: replaces the system roots for this connection’s peer verification only, via SSL_set0_verify_cert_store in configure_http_client_with_alpn)
• servername → SSLConfig.server_name (SNI override; get_tls_hostname prefers it)
• reject_unauthorized → AsyncHTTP::Options.reject_unauthorized → client.flags.reject_unauthorized (Node rejectUnauthorized:false explicit opt-out — verification still runs by default)

Fields

ca_certs_der: Box<[Box<[u8]>]>

DER-encoded CA certificates from init.tls.ca (PEM strings parsed via BoringSSL; DER byte views taken verbatim). Empty = system roots.

reject_unauthorized: Option<bool>

init.tls.rejectUnauthorized. None = default (verify).

servername: Option<String>

init.tls.servername SNI override (non-empty host string).

Trait Implementations

impl Default for FetchTlsInit

fn default() -> FetchTlsInit

Returns the “default value” for a type.