Crate eggnet_tls 

Neutral rustls server identity, trust, client-authentication, and reload configuration.

This crate intentionally contains no EggServe, Eggress, HTTP runtime, proxy, tracing, CLI, or Python dependencies. Applications own transport adapters, filesystem watching, and operational logging.

The crate provides bounded PEM parsing, validated SNI identity selection, explicit WebPKI client authentication, and atomic replacement of immutable snapshots for new handshakes. It does not provide certificate management, filesystem watching, or application-level TLS policy.

Structs

TlsReloadHandle

Atomic reload handle for TLS identity/trust state (Plan 203 Track F).

TlsServerConfig

Validated production TLS identity configuration (Plan 203 Tracks A–C).

TlsServerConfigBuilder

Builder for TlsServerConfig.

Enums

ClientAuthMode

Client-certificate authentication policy (Plan 203 Track C).

TlsError

Constants

MAX_ALPN_PROTOCOLS

Maximum ALPN protocols advertised by one server configuration.

MAX_ALPN_PROTOCOL_LEN

Maximum bytes per ALPN protocol identifier (TLS wire limit).

MAX_CRLS

Maximum CRLs for client authentication.

MAX_IDENTITY_CHAIN

Maximum certificates per server identity chain.

MAX_SNI_LEN

Maximum DNS length for an SNI identity (DNS limit, without *. prefix).

MAX_TLS_IDENTITIES

Maximum SNI identities per TlsServerConfig (exact + wildcard combined).

MAX_TRUST_PEM_BYTES

Maximum PEM bytes accepted for trust-root/CRL parsing (1 MiB).

MAX_TRUST_ROOTS

Maximum trust anchors for client authentication.

Functions

http_alpn_protocols

HTTP ALPN advertisement for the TlsServerConfigBuilder::http2 convenience: h2 before http/1.1 when enabled, else http/1.1 only.

load_identity

Load one certificate chain and exactly one private key from PEM files.

load_tls_config

Load a rustls server configuration from PEM certificate and key files.

load_tls_config_with_alpn

Load a rustls server configuration with an explicit ALPN advertisement.

load_tls_config_with_http2

Load a rustls server configuration and explicitly choose the advertised application protocols.

parse_crls_pem

Parse CRLs from PEM bytes (bounded, validated at load).

parse_identity_pem

Parse one identity from PEM bytes (caller-supplied in-memory material).

parse_trust_roots_pem

Parse trust anchors from PEM bytes (bounded, validated at load).