Struct TlsConfig 

pub struct TlsConfig { /* private fields */ }

What a store needs to speak TLS to somewhere this machine does not already trust.

Data only — no client type appears anywhere in it, which is what makes it the same three settings in all seven crates and what makes it expressible from a language that has never heard of tonic.

Empty by default, and an empty one is not “no TLS”: it is the platform’s own trust store, which is what a public certificate authority needs and what every store already did.

See the module documentation for what each store can express.

Implementations

impl TlsConfig

pub fn new() -> TlsConfig

An empty configuration: the platform’s trust store, no client certificate.

pub fn with_ca_certificate_file(self, path: impl Into<PathBuf>) -> TlsConfig

Trust the certificate authority in this PEM file.

The file may hold several certificates; all of them are trusted, which is what a private CA with an intermediate needs.

The file is read when the store builds its client, not here — so a rotated CA is picked up by rebuilding the source, and a missing file is an error naming it rather than a panic in a builder chain.

pub fn with_ca_certificate_pem(self, pem: impl Into<Vec<u8>>) -> TlsConfig

Trust the certificate authority in these PEM bytes.

For a program that already has the material — from a secrets manager, from its own configuration — and should not have to put it on a disk for a client to read back.

pub fn with_client_certificate_files( self, certificate: impl Into<PathBuf>, key: impl Into<PathBuf>, ) -> TlsConfig

Present this client certificate and private key (mTLS).

Both are PEM files. certificate may be a chain; the leaf comes first, as every TLS stack here expects.

pub fn with_client_certificate_pem( self, certificate: impl Into<Vec<u8>>, key: impl Into<Vec<u8>>, ) -> TlsConfig

Present this client certificate and private key (mTLS), from bytes.

The private key is the sharpest secret this crate handles. It is never rendered by Debug, never quoted into an error, and never written anywhere: it goes from here into the client’s own key type and stops.

pub fn with_server_name(self, name: impl Into<String>) -> TlsConfig

Verify the certificate against this name rather than the address’s.

For an endpoint written as an IP — a Service’s cluster IP, a load balancer, a NodePort — against a certificate issued for a hostname. The certificate still has to chain to a trusted authority and still has to carry this name; only which name is checked moves.

Refused by the stores whose clients cannot express it; see the module documentation.

pub fn with_skip_verification(self, skip: bool) -> TlsConfig

Do not authenticate the server at all.

This is not a weaker TLS; it is TLS without the part that makes it mean anything. Any party on the network path can present any certificate, read what is sent, and rewrite what comes back — and what comes back from a store is the configuration and the credentials a process is about to run on.

Try with_ca_certificate_file first. A development server with a self-signed certificate and an enterprise private CA are both one more certificate to trust, which is one line and keeps the server authenticated.

Refused by the stores whose clients cannot express it; see the module documentation.

pub fn is_empty(&self) -> bool

Whether this asks for nothing at all.

A store uses it to tell “the caller wants the platform defaults” from “the caller wants something”, which is the difference between leaving its client alone and building one.

pub fn ca_certificate(&self) -> Option<&Pem>

The certificate authority to trust, if one was named.

pub fn client_certificate(&self) -> Option<&ClientCertificate>

The client certificate to present, if one was named.

pub fn server_name(&self) -> Option<&str>

The name to verify against, if it is not the address’s.

pub const fn skips_verification(&self) -> bool

Whether the server is to go unauthenticated.

pub fn ca_certificate_pem( &self, described: &str, ) -> Result<Option<Vec<u8>>, Error>

The CA certificate’s PEM bytes, reading the file if that is what it is.

Errors

If the file cannot be read; the message names the path.

pub fn client_certificate_pem( &self, described: &str, ) -> Result<Option<(Vec<u8>, Vec<u8>)>, Error>

The client certificate and key as PEM bytes, reading the files if that is what they are.

Errors

If either file cannot be read; the message names the path and never the contents.

Trait Implementations

impl Clone for TlsConfig

fn clone(&self) -> TlsConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TlsConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for TlsConfig

fn default() -> TlsConfig

Returns the “default value” for a type.

impl Eq for TlsConfig

impl PartialEq for TlsConfig

fn eq(&self, other: &TlsConfig) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for TlsConfig