Struct TlsClientConfig 

pub struct TlsClientConfig { /* private fields */ }

TLS Client Configuration

Implementations

impl TlsClientConfig

pub fn new<S: Into<String>>(server_name: S) -> Self

Create a new TLS client configuration

pub fn with_tls_versions(self, versions: Vec<TlsVersion>) -> Self

Set allowed TLS protocol versions

pub fn with_cipher_suites( self, cipher_suites: Vec<SupportedCipherSuite>, ) -> Self

Set allowed cipher suites

pub fn with_client_certificate<S: Into<String>>( self, cert_path: S, key_path: S, ) -> Self

Configure client authentication for mTLS

pub fn insecure(self) -> Self

Allow insecure connections (skip certificate verification)

WARNING: Security Risk

This mode disables certificate verification entirely and should ONLY be used for:

• Development and testing
• Debugging environments
• Internal networks with certificate pinning enabled

NEVER use this in production without explicit certificate pinning via with_pinned_cert_hash().

For maximum security, only use this with the “dangerous_configuration” feature enabled, which is a strong indicator this is for testing/development only.

pub fn with_pinned_cert_hash(self, hash: Vec<u8>) -> Self

Pin a certificate by its SHA-256 hash/fingerprint

This provides additional security by only accepting connections from servers with the exact certificate matching this hash. Can be combined with insecure mode for development environments where you want to skip standard CA verification but still verify a specific cert.

pub fn calculate_cert_hash(cert: &Certificate) -> Vec<u8>

Calculate SHA-256 hash for a certificate to use with pinning

pub fn load_client_config(&self) -> Result<ClientConfig>

Load the TLS client configuration

pub fn server_name(&self) -> Result<ServerName>

Get the server name as a rustls::ServerName