Struct TlsConfig 

pub struct TlsConfig { /* private fields */ }

What a store needs to speak TLS to somewhere this machine does not already trust.

Data only — no client type appears anywhere in it, which is what makes it the same three settings in all seven crates and what makes it expressible from a language that has never heard of tonic.

Empty by default, and an empty one is not “no TLS”: it is the platform’s own trust store, which is what a public certificate authority needs and what every store already did.

See the module documentation for what each store can express and for why there is no way to turn verification off.

Implementations

impl TlsConfig

pub fn new() -> TlsConfig

An empty configuration: the platform’s trust store, no client certificate.

pub fn with_ca_certificate_file(self, path: impl Into<PathBuf>) -> TlsConfig

Trust the certificate authority in this PEM file.

The file may hold several certificates; all of them are trusted, which is what a private CA with an intermediate needs.

The file is read when the store builds its client, not here — so a rotated CA is picked up by rebuilding the source, and a missing file is an error naming it rather than a panic in a builder chain.

pub fn with_ca_certificate_pem(self, pem: impl Into<Vec<u8>>) -> TlsConfig

Trust the certificate authority in these PEM bytes.

For a program that already has the material — from a secrets manager, from its own configuration — and should not have to put it on a disk for a client to read back.

pub fn with_client_certificate_files( self, certificate: impl Into<PathBuf>, key: impl Into<PathBuf>, ) -> TlsConfig

Present this client certificate and private key (mTLS).

Both are PEM files. certificate may be a chain; the leaf comes first, as every TLS stack here expects.

pub fn with_client_certificate_pem( self, certificate: impl Into<Vec<u8>>, key: impl Into<Vec<u8>>, ) -> TlsConfig

Present this client certificate and private key (mTLS), from bytes.

The private key is the sharpest secret this crate handles. It is never rendered by Debug, never quoted into an error, and never written anywhere: it goes from here into the client’s own key type and stops.

pub fn is_empty(&self) -> bool

Whether this asks for nothing at all.

A store uses it to tell “the caller wants the platform defaults” from “the caller wants something”, which is the difference between leaving its client alone and building one.

pub fn ca_certificate(&self) -> Option<&Pem>

The certificate authority to trust, if one was named.

pub fn client_certificate(&self) -> Option<&ClientCertificate>

The client certificate to present, if one was named.

pub fn ca_certificate_pem( &self, described: &str, ) -> Result<Option<Vec<u8>>, Error>

The CA certificate’s PEM bytes, reading the file if that is what it is.

Errors

If the file cannot be read; the message names the path.

pub fn client_certificate_pem( &self, described: &str, ) -> Result<Option<(Vec<u8>, Vec<u8>)>, Error>

The client certificate and key as PEM bytes, reading the files if that is what they are.

Errors

If either file cannot be read; the message names the path and never the contents.

Trait Implementations

impl Clone for TlsConfig

fn clone(&self) -> TlsConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TlsConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for TlsConfig

fn default() -> TlsConfig

Returns the “default value” for a type.

impl Eq for TlsConfig

impl PartialEq for TlsConfig

fn eq(&self, other: &TlsConfig) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for TlsConfig