Module selfsigned 

Self-signed certificate generation, so TLS works on the first run with no prerequisites.

The gap this closes: enabling [tls] used to require the operator to already have a certificate — from a public CA, an internal CA, or a hand-run openssl req -x509 …. For the audience this proxy exists for (an app that reached production without a front door), “go generate a keypair first” is where adoption stops. [tls] self_signed = true makes the binary produce its own certificate on first boot and serve HTTPS immediately.

What a self-signed certificate is and is not. It encrypts the connection, so the six hardening headers, Secure cookies and HSTS become meaningful and traffic is no longer readable on the wire. It does not prove identity: no CA vouches for it, so a browser shows an interstitial and a strict client rejects it outright. That makes it right for localhost, a private network, a sidecar hop, or a staging box behind a VPN — and wrong for the public internet, where [tls.acme] should issue a real certificate instead. crate::doctor says so out loud when it sees this enabled.

Dependency note. This uses rcgen, which the 0.3.0 notes describe as “dropped”. That is true of direct use — instant-acme 0.8 builds its own key and CSR in finalize(), so the ACME path no longer constructs a certificate here. But instant-acme depends on rcgen itself, so the crate was still compiled on every build; re-declaring it is a direct edge to a node already in the graph. It adds no crate to the build and no transitive dependency.

Structs

SelfSigned

A generated certificate and its private key, both PEM-encoded.

Constants

DEFAULT_HOSTS

Hostnames used when the operator names none. localhost plus both loopback literals covers the case this feature exists for — running the proxy on the machine you are testing from.

Functions

ensure

Ensure a certificate exists at cert_path/key_path, generating a self-signed one if not.

generate

Build a self-signed certificate covering hosts, valid for days.

path_present

Is anything present at path — including a symlink whose target is missing?

write_to

Generate a certificate for hosts and write it to cert_path/key_path.