Struct TlsConfig 

pub struct TlsConfig {
    pub cert_chain_path: PathBuf,
    pub private_key_path: PathBuf,
    pub trust_roots_path: Option<PathBuf>,
    pub client_ca_path: Option<PathBuf>,
    pub client_auth: ClientAuthMode,
}

Fields

cert_chain_path: PathBuf

private_key_path: PathBuf

trust_roots_path: Option<PathBuf>

Roots used by the client side (this broker as an outbound inter-broker dialer) to verify server certs. Mirrors Kafka’s ssl.truststore.location on the client.

client_ca_path: Option<PathBuf>

PEM file containing the CA(s) used to verify incoming client certs when client_auth != Disabled. Mirrors Kafka’s ssl.client.auth.truststore.location (operator-supplied clients CA secret).

client_auth: ClientAuthMode

Client-cert request mode. Defaults to Disabled (no client cert requested).

Implementations

impl TlsConfig

pub fn build_server_config(&self) -> Result<Arc<ServerConfig>, TlsError>

pub fn build_client_config(&self) -> Result<Arc<ClientConfig>, TlsError>

pub fn build_client_config_with_identity( &self, ) -> Result<Arc<ClientConfig>, TlsError>

Build a rustls ClientConfig that BOTH verifies the peer’s server cert against trust_roots_path AND presents this node’s own cert_chain_path/private_key_path as a client certificate (mTLS). Used by peer-to-peer dialers (e.g. the gRPC gateway forwarding to an owning replica) that must mutually authenticate.

Errors

Propagates TlsError from cert/key loading or rustls config building.

Trait Implementations

impl Clone for TlsConfig

fn clone(&self) -> TlsConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TlsConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.