Module tls 

rustls / QUIC TLS configuration construction. TLS and QUIC configuration construction.

flexd uses rustls exclusively — there is no OpenSSL dependency. This module turns the parsed SslSettings (or explicit cert/key paths, for ACME-issued certificates) into the acceptors the server needs:

• build_tls_acceptor — a tokio_rustls acceptor for static certs, advertising h2 and http/1.1 via ALPN.
• build_tls_acceptor_acme — like the above but with a challenge-aware certificate resolver that also serves TLS-ALPN-01 validation certs.
• build_quinn_server_config / build_quinn_server_config_from_paths — a QUIC server config advertising h3 for HTTP/3 listeners.

Only TLS 1.2 and 1.3 are ever negotiated; the configuration validator rejects older versions before these functions run.

Functions

build_quinn_server_config

Build a QUIC (HTTP/3) server config from SslSettings.

build_quinn_server_config_from_paths

QUIC server config from explicit cert/key paths (used for ACME-issued certs, where SslSettings.certificate is absent).

build_tls_acceptor

Build a tokio_rustls acceptor from static-certificate SslSettings.

build_tls_acceptor_acme

Build a TLS acceptor for an acme.enabled block. The default cert is the ACME-issued chain at cert_path/key_path; an crate::acme::AcmeResolver additionally serves TLS-ALPN-01 challenge certs from store. The acceptor advertises acme-tls/1 alongside h2/http1.1 so the CA’s validation handshake (C52) negotiates it.

load_certificate

Load a PEM certificate chain from cert_path.

load_private_key

Load a private key from key_path, trying PKCS#8 first and then RSA.