1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
/*! # Using rustls with FIPS-approved cryptography
To use FIPS-approved cryptography with rustls, you should use a FIPS-approved `CryptoProvider`.
The easiest way to do this is to use the `rustls-aws-lc-rs` crate with the `fips` feature enabled.
## 1. Enable the `fips` crate feature for rustls-aws-lc-rs:
Use:
```toml
rustls = { version = "0.24" }
rustls-aws-lc-rs = { version = "0.24", features = ["fips"] }
```
## 2. Use the FIPS `CryptoProvider`
Instantiate your `ClientConfig` or `ServerConfig` using the FIPS `CryptoProvider`,
`rustls_aws_lc_rs::DEFAULT_FIPS_PROVIDER`.
## 3. Validate the FIPS status of your `ClientConfig`/`ServerConfig` at run-time
See [`ClientConfig::fips()`] or [`ServerConfig::fips()`].
You could, for example:
```rust,no_run
# use rustls::pki_types::FipsStatus;
# let client_config: rustls::ClientConfig = unreachable!();
assert!(matches!(client_config.fips(), FipsStatus::Certified { .. }));
```
But maybe your application has an error handling or health-check strategy better than panicking.
[`CryptoProvider`]: crate::crypto::CryptoProvider
[`ClientConfig::fips()`]: crate::client::ClientConfig::fips
[`ServerConfig::fips()`]: crate::server::ServerConfig::fips
*/