Struct TlsManager 

pub struct TlsManager { /* private fields */ }

Manages TLS configuration for the proxy, supporting both automatic ACME certificate issuance (via certon) and manually-provided PEM certificates.

The manager builds a rustls::ServerConfig that uses a composite certificate resolver:

• Sites with explicit SiteTlsConfig (cert/key PEM paths) are loaded immediately and registered as manual overrides.
• Sites without explicit certs are enrolled in ACME management through certon, which obtains, caches, and auto-renews their certificates.

Additionally supports:

• mTLS (mutual TLS): client certificate verification using configured CA certificates. When client_auth is configured, the server requests (and optionally requires) client certificates.
• On-demand TLS: automatic certificate issuance at handshake time for previously unknown domains, with optional ask-URL gating and rate limiting.

Call TlsManager::reload to hot-swap the TLS configuration when the proxy config changes.

Implementations

impl TlsManager

pub async fn build(config: &AppConfig) -> Result<Self, ProxyError>

Build a new TlsManager from the application configuration.

This performs the initial TLS setup:

1. Loads manual certificates for sites that specify cert/key paths.
2. Configures certon for ACME-managed sites (if ACME is enabled).
3. Calls manage_sync to obtain/load certificates for ACME domains.
4. Starts the certon maintenance loop.
5. Sets up mTLS client certificate verification if configured.
6. Configures on-demand TLS if configured.

Errors

Returns an error if manual certificate loading fails or if ACME management cannot be initialized.

pub fn acceptor(&self) -> TlsAcceptor

Get a TlsAcceptor for use with tokio-rustls.

The returned acceptor references the current ServerConfig via an Arc, so it will continue to use the config snapshot at the time of this call. For hot-reload, call this again after reload.

pub fn server_config(&self) -> Arc<ServerConfig>

Get the current rustls::ServerConfig as an Arc.

pub fn challenge_map(&self) -> Arc<RwLock<HashMap<String, String>>>

Get a reference to the shared ACME HTTP-01 challenge map.

This is the same map that the AcmeChallengeHoop reads from to serve challenge responses.

pub async fn reload(&self, config: &AppConfig) -> Result<(), ProxyError>

Hot-reload the TLS configuration.

This rebuilds manual certificates and re-enrolls ACME domains based on the new config. The ServerConfig is atomically swapped so that in-flight connections are not affected.

Errors

Returns an error if any manual certificate cannot be loaded.

pub fn stop_maintenance(&self)

Stop the certon maintenance loop.

This should be called during graceful shutdown. After calling this, no further certificate renewals or OCSP refreshes will occur.

Trait Implementations

impl Drop for TlsManager

fn drop(&mut self)

Executes the destructor for this type.