1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
title: HTTPS / TLS
description: Serve traffic over TLS with HTTP/2 and HTTP/1.1 on the same port using rustls and aws-lc-rs.
TLS is available when you build with the `http2` or `http3` (default) feature.
The `http1`-only build has no TLS support.
```bash
cargo build
cargo build --no-default-features --features http2
```
Use `openssl` to create a certificate and key for local development:
```bash
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem \
-days 365 -nodes -subj "/CN=localhost"
```
Pass the certificate and key on the command line:
```bash
cargo run -- --tls-cert-file=cert.pem --tls-key-file=key.pem
```
Alternatively, set environment variables or add them to `rws.config.toml`:
```bash
export RWS_CONFIG_TLS_CERT_FILE=cert.pem
export RWS_CONFIG_TLS_KEY_FILE=key.pem
cargo run
```
```toml
tls_cert_file = "cert.pem"
tls_key_file = "key.pem"
```
`rust-web-server` uses [rustls](https://github.com/rustls/rustls) with the
`aws-lc-rs` cryptography backend. There is no dependency on OpenSSL.
When a TLS certificate is configured, the server advertises both `h2` and
`http/1.1` via ALPN in the TLS handshake. A single port handles HTTP/2 and
HTTP/1.1 simultaneously — no extra configuration is required.
```
alpn_protocols = ["h2", "http/1.1"]
```
The `h2_handler` translates HTTP/2 frames into the same `Request` /
`Application::execute` / `Response` pipeline that HTTP/1.1 uses.
Set `RWS_CONFIG_HTTP_REDIRECT_PORT` to have the server also listen on a plain
HTTP port and issue `301 Moved Permanently` redirects to HTTPS:
```bash
export RWS_CONFIG_HTTP_REDIRECT_PORT=80
```
```toml
http_redirect_port = "80"
```
`Server::run_redirect()` binds the redirect listener and sends every incoming
request to the HTTPS port with a `301` response.
HTTP/1.1 TLS responses include an `Alt-Svc` header so clients learn that a
faster protocol is available:
- -
Browsers that support HTTP/3 will upgrade automatically on subsequent requests.
:::note[Hot reload]
Send `SIGHUP` or `POST /admin/config/reload` to reload the TLS certificate
from disk without restarting the server. This also rebuilds the TLS acceptor
for all configured virtual hosts.
:::
When using the config-driven proxy (`rws.config.toml`), prefix backend addresses with `https://` to connect to upstream services over TLS:
```toml
[[upstream]]
name = "secure-api"
backends = ["https://api.internal:443", "https://api2.internal:443"]
```
Certificate verification uses the WebPKI root store (same trust anchors as browsers). Requires the `http-client` or `http2` feature — included in all builds except `--no-default-features --features http1`.
See [Config-Driven Proxy → TLS upstreams](/proxy/config-driven/#tls-https-upstreams) for the full reference.