Expand description
TLS trust, certificates, and keys, split by role.
Client (--client-tls-*) picks who to trust: system roots, custom roots,
a pinned SHA-256 fingerprint, or nothing at all. Server (--server-tls-*)
supplies the certificate chain to serve, loaded from disk or self-signed on
startup, and optionally the roots that authenticate mTLS clients.
Certificates, keys, and custom root CAs loaded from disk are normally hot
reloaded for new handshakes. Quiche servers are the exception: all inbound
TLS material is fixed when the listener is built. Certificates reads the
current served set back out.
Structs§
- Certificates
- A live handle to the certificates a
crate::Serveris serving. - Client
- TLS configuration for the client.
- Peer
Identity - A peer’s validated client-certificate chain from the mTLS handshake.
- Server
- TLS configuration for the server.
Enums§
- Error
- Errors loading or generating TLS certificates and keys.
Functions§
- parse_
fingerprint - Parse a hex-encoded SHA-256 certificate fingerprint.
Type Aliases§
- Result
- Convenience alias for results produced by this module.