Struct TlsConfig 

pub struct TlsConfig {
    pub mode: SslMode,
    pub ca_pem_path: Option<PathBuf>,
    pub sni_hostname: Option<String>,
    pub client_cert_pem_path: Option<PathBuf>,
    pub client_key_pem_path: Option<PathBuf>,
}

TLS/SSL configuration for PostgreSQL connections.

Fields

mode: SslMode

SSL mode controlling connection security level.

ca_pem_path: Option<PathBuf>

Path to PEM file containing trusted CA certificates.

If None and verification is enabled (VerifyCa/VerifyFull), the Mozilla root certificates (webpki-roots) are used.

sni_hostname: Option<String>

Override SNI hostname sent during TLS handshake.

Useful when:

• Connecting via IP address but certificate has a DNS name
• Using a load balancer with different internal/external names

If None, the connection host is used for SNI.

client_cert_pem_path: Option<PathBuf>

Path to PEM file containing client certificate chain.

Required for mutual TLS (mTLS) authentication. Must be paired with client_key_pem_path.

client_key_pem_path: Option<PathBuf>

Path to PEM file containing client private key.

Required for mutual TLS (mTLS) authentication. Must be paired with client_cert_pem_path. Supports PKCS#8, PKCS#1 (RSA), and SEC1 (EC) formats.

Implementations

impl TlsConfig

pub fn disabled() -> TlsConfig

Create a configuration with TLS disabled.

Example

use pgwire_replication::config::TlsConfig;

let tls = TlsConfig::disabled();
assert!(!tls.mode.requires_tls());

pub fn require() -> TlsConfig

Create a configuration requiring TLS without certificate verification.

Warning: This mode is vulnerable to MITM attacks. Use verify_ca() or verify_full() for production.

Example

use pgwire_replication::config::TlsConfig;

let tls = TlsConfig::require();
assert!(tls.mode.requires_tls());
assert!(!tls.mode.verifies_certificate());

pub fn verify_ca(ca_path: Option<PathBuf>) -> TlsConfig

Create a configuration with certificate chain verification.

Arguments

• ca_path - Path to CA certificate PEM file, or None for system roots

Example

use pgwire_replication::config::TlsConfig;

// Using system/Mozilla roots
let tls = TlsConfig::verify_ca(None);

// Using custom CA
let tls = TlsConfig::verify_ca(Some("/path/to/ca.pem".into()));

pub fn verify_full(ca_path: Option<PathBuf>) -> TlsConfig

Create a configuration with full verification (chain + hostname).

Recommended for production.

Arguments

• ca_path - Path to CA certificate PEM file, or None for system roots

Example

use pgwire_replication::config::TlsConfig;

let tls = TlsConfig::verify_full(Some("/etc/ssl/certs/ca.pem".into()));
assert!(tls.mode.verifies_hostname());

pub fn with_sni_hostname(self, hostname: impl Into<String>) -> TlsConfig

Set SNI hostname override.

Example

use pgwire_replication::config::TlsConfig;

let tls = TlsConfig::verify_full(None)
    .with_sni_hostname("db.example.com");

pub fn with_client_cert( self, cert_path: impl Into<PathBuf>, key_path: impl Into<PathBuf>, ) -> TlsConfig

Configure client certificate for mutual TLS.

Example

use pgwire_replication::config::TlsConfig;

let tls = TlsConfig::verify_full(Some("/ca.pem".into()))
    .with_client_cert("/client.pem", "/client.key");

pub fn is_mtls(&self) -> bool

Returns true if mutual TLS (client certificate) is configured.

Trait Implementations

impl Clone for TlsConfig

fn clone(&self) -> TlsConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TlsConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for TlsConfig

fn default() -> TlsConfig

Returns the “default value” for a type.

impl Eq for TlsConfig

impl PartialEq for TlsConfig

fn eq(&self, other: &TlsConfig) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for TlsConfig