Struct TlsState 

pub struct TlsState {
    pub intercept_ca: CertAuthority,
    pub connector: TlsConnector,
    pub config: TlsConfig,
    pub secrets: SecretsHandle,
    /* private fields */
}

Shared TLS interception state.

Holds the CA, per-domain certificate cache, upstream TLS connectors, and configuration. Shared across all TLS proxy tasks via Arc.

Fields

intercept_ca: CertAuthority

Interception CA for signing per-domain certs presented to the guest.

connector: TlsConnector

Default TLS connector for upstream (real server) connections.

config: TlsConfig

TLS configuration.

secrets: SecretsHandle

Live-swappable secrets configuration for placeholder substitution. Loaded per connection so live secret updates apply to future traffic.

Implementations

impl TlsState

pub fn new( config: TlsConfig, secrets: SecretsHandle, ) -> Result<Self, TlsStateError>

Create TLS state from configuration.

CA resolution order:

1. User-provided paths (config.intercept_ca.cert_path + config.intercept_ca.key_path)
2. Microsandbox home TLS path ($MSB_HOME/tls or ~/.microsandbox/tls)
3. Auto-generate and persist to the microsandbox home TLS path

pub fn get_or_generate_cert( &self, domain: &str, ) -> Result<Arc<DomainCert>, DomainCertError>

Get or generate a certificate for the given domain.

pub fn should_bypass(&self, sni: &str) -> bool

Check if a domain should bypass TLS interception.

pub fn upstream_connector_for(&self, sni: &str) -> &TlsConnector

Select the upstream connector for the given server name.

Falls back to the default connector when no host-scoped connector matches; when several match, the most specific pattern wins.

pub fn ca_cert_pem(&self) -> Vec<u8>

Get the CA certificate PEM bytes for guest installation.