Function init_crypto_provider 

pub fn init_crypto_provider() -> Result<(), CryptoProviderError>

Install the process-wide default rustls CryptoProvider.

Dispatch:

• fips feature + macOS: installs the Apple corecrypto-backed provider from rustls-corecrypto-provider, restricted to TLS 1.3 cipher suites via fips_provider(). corecrypto is shipped inside macOS and validated by Apple under FIPS 140-3 per OS release; see https://csrc.nist.gov/projects/cryptographic-module-validation-program for the cert matching the running macOS version. TLS 1.2 cipher suites are excluded under fips because Apple does not expose a separately CAVS-validated TLS PRF primitive (unlike aws-lc-fips on Linux); see the cf-gears-rustls-corecrypto-provider README “FIPS claim boundaries” section. On macOS the rustls/fips feature is not activated (see rustls-fips-shim), so the AWS-LC FIPS dylib is not linked.
• fips feature + Windows: installs the Windows CNG-backed provider from rustls-cng-crypto’s fips_provider(). CNG is shipped inside Windows and validated by Microsoft under FIPS 140-3 per OS release. Requires Windows to be in system-wide FIPS mode (HKLM\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy = 1, set via Group Policy); fails closed with [CryptoProviderError::SystemFipsModeNotEnabled] otherwise. As with macOS, rustls/fips is not activated on this target, so the AWS-LC FIPS dylib is not linked.
• fips feature + other (Linux, etc.): installs the FIPS-validated AWS-LC provider (aws-lc-fips-sys, NIST Certificate #4816). The cert’s OE covers Linux but not Darwin/Windows, which is why those targets use different providers.
• Standard mode (no fips feature): installs the aws-lc-rs provider explicitly. This is required because both ring and aws-lc-rs are compiled into the binary (ring via pingora-rustls), and rustls 0.23 panics when it cannot auto-detect a single provider. Conflicts here are non-fatal: if another provider was installed first, it stays active, the conflict is logged at warn!, and Ok(()) is returned.

This must be called before any TLS configuration, HTTP client, database connection, or JWT operation is created.

Safe to call multiple times – only the first invocation has an effect; subsequent calls return the cached first-call result.

FIPS-claim caveats

On the resulting provider, provider.fips() == true is a runtime witness under the witness-pattern rework — it is true only when both (a) every primitive routes through a CMVP-validated module and (b) the runtime OE check agrees. It is no longer an unconditional design- intent claim.

macOS: the corecrypto crate runs an OE check at first provider construction (cf_gears_rustls_corecrypto_provider::oe::fips_witness_ok). On a macOS major outside the active corecrypto CMVP cert OE, every fips() impl in the provider returns false and a single tracing::warn! is emitted. The post-install witness assert! then panics — a misconfigured FIPS build must never silently proceed. Use CF_GEARS_FIPS_OE_OVERRIDE=1 to force the witness to true for CI on pre-release macOS — never for production. See the cf-gears-rustls-corecrypto-provider README “Runtime FIPS witness” section and FIPS PRD §8.3.

Downstream TLS configuration code (toolkit_http::tls::apply_fips_hardening) performs its own config.fips() check and returns Err rather than panicking — ClientConfig::fips() depends on per-config settings (require_ems, protocol versions) beyond the provider itself, so the TLS-layer check is a defence-in-depth complement to the bootstrap assertion here.

Linux / Windows: runtime OE-validation is not yet implemented; OE coverage is verified via the release checklist (manual CMVP cert search, PRD §9.3). Tracked as a follow-up in PRD §10.

Errors

• CryptoProviderError::FipsProviderConflict if the fips feature is enabled and another rustls provider was installed first.
• [CryptoProviderError::SystemFipsModeNotEnabled] on Windows+fips when the OS is not in system-wide FIPS mode.

Panics

Panics (via assert!) under --features fips if the installed crypto provider does not report fips() == true. This is an intentional fail-closed guard against misconfigured builds (wrong feature flags, wrong OS, or macOS OE mismatch without the override env-var).