Module tls 

TLS trust, certificates, and keys, split by role.

Client (--client-tls-*) picks who to trust: system roots, custom roots, a pinned SHA-256 fingerprint, or nothing at all. Server (--server-tls-*) supplies the certificate chain to serve, loaded from disk or self-signed on startup, and optionally the roots that authenticate mTLS clients.

Certificates loaded from disk are watched and hot reloaded, so rotating them needs no restart. Certificates reads the current set back out.

Structs

Certificates

A live handle to the certificates a crate::Server is serving.

Client

TLS configuration for the client.

PeerIdentity

A peer’s validated client-certificate chain from the mTLS handshake.

Server

TLS configuration for the server.

Enums

Error

Errors loading or generating TLS certificates and keys.

Type Aliases

Result

Convenience alias for results produced by this module.