pub struct TlsServerConfigBuilder { /* private fields */ }Expand description
Builder for TlsServerConfig.
Implementations§
Source§impl TlsServerConfigBuilder
impl TlsServerConfigBuilder
Sourcepub fn http2(self, enabled: bool) -> Self
pub fn http2(self, enabled: bool) -> Self
Advertise H2 before HTTP/1.1 when true (default follows the crate
http2 feature). Coherent with RuntimeConfig::http2.enabled.
Clears any explicit Self::alpn_protocols override (last call wins).
Sourcepub fn alpn_protocols(self, protocols: Vec<Vec<u8>>) -> Result<Self, TlsError>
pub fn alpn_protocols(self, protocols: Vec<Vec<u8>>) -> Result<Self, TlsError>
Advertise an explicit ALPN list instead of the HTTP convenience.
Neutral hook for non-HTTP transports (Plan 222): proxy or custom
transports supply their own protocol identifiers. An empty list
advertises no ALPN. Entries are bounded (MAX_ALPN_PROTOCOLS ×
MAX_ALPN_PROTOCOL_LEN); out-of-range input fails here, never at
the first handshake. Overrides Self::http2 (last call wins).
Sourcepub fn add_identity(
self,
name: &str,
certs: Vec<CertificateDer<'static>>,
key: PrivateKeyDer<'static>,
) -> Result<Self, TlsError>
pub fn add_identity( self, name: &str, certs: Vec<CertificateDer<'static>>, key: PrivateKeyDer<'static>, ) -> Result<Self, TlsError>
Add one SNI identity (exact DNS or *.suffix wildcard).
Sourcepub fn default_identity(
self,
certs: Vec<CertificateDer<'static>>,
key: PrivateKeyDer<'static>,
) -> Result<Self, TlsError>
pub fn default_identity( self, certs: Vec<CertificateDer<'static>>, key: PrivateKeyDer<'static>, ) -> Result<Self, TlsError>
Set the default identity for no-SNI/no-match clients.
Sourcepub fn single_identity(
self,
certs: Vec<CertificateDer<'static>>,
key: PrivateKeyDer<'static>,
) -> Result<Self, TlsError>
pub fn single_identity( self, certs: Vec<CertificateDer<'static>>, key: PrivateKeyDer<'static>, ) -> Result<Self, TlsError>
Convenience for a single identity (default-only, SNI-agnostic).
Sourcepub fn client_auth_disabled(self) -> Self
pub fn client_auth_disabled(self) -> Self
Disable client authentication (default).
Sourcepub fn client_auth_required(
self,
roots: Vec<CertificateDer<'static>>,
) -> Result<Self, TlsError>
pub fn client_auth_required( self, roots: Vec<CertificateDer<'static>>, ) -> Result<Self, TlsError>
Require client certificates verified against roots.
Sourcepub fn client_auth_optional(
self,
roots: Vec<CertificateDer<'static>>,
) -> Result<Self, TlsError>
pub fn client_auth_optional( self, roots: Vec<CertificateDer<'static>>, ) -> Result<Self, TlsError>
Offer client authentication; allow unauthenticated clients.
Sourcepub fn with_crls(
self,
crls: Vec<CertificateRevocationListDer<'static>>,
) -> Result<Self, TlsError>
pub fn with_crls( self, crls: Vec<CertificateRevocationListDer<'static>>, ) -> Result<Self, TlsError>
Attach CRLs to the current client-auth policy (explicit revocation).
Without CRLs no revocation checking is implied. Bounded and validated at build time.
Sourcepub fn build(self) -> Result<TlsServerConfig, TlsError>
pub fn build(self) -> Result<TlsServerConfig, TlsError>
Build the validated TlsServerConfig.
Fails before readiness on invalid names, key/cert mismatch, empty trust, or unparsable CRLs. Never defers obvious pairing errors to the first hostile connection.