Struct TlsClientConfig 

pub struct TlsClientConfig { /* private fields */ }

TLS Client Configuration

Implementations

impl TlsClientConfig

pub fn new<S: Into<String>>(server_name: S) -> Self

Create a new TLS client configuration

pub fn with_tls_versions(self, versions: Vec<TlsVersion>) -> Self

Set allowed TLS protocol versions

Only the listed versions are enabled. An empty list is rejected when the config is loaded.

pub fn with_cipher_suites( self, cipher_suites: Vec<SupportedCipherSuite>, ) -> Self

Set allowed cipher suites

Only the listed suites are enabled, matched by suite identifier and kept in this crate’s preference order. Loading the config fails if none of them is supported, or if none of them can be used with the enabled TLS versions.

pub fn with_client_certificate<S: Into<String>>( self, cert_path: S, key_path: S, ) -> Self

Configure client authentication for mTLS

pub fn insecure(self) -> Self

Allow insecure connections (skip certificate verification)

WARNING: Security Risk

This mode skips certificate validation (no CA chain or hostname checks), so any certificate is accepted unless one is pinned with with_pinned_cert_hash(). The server must still prove that it holds the private key for the certificate it presents: the handshake signature is always verified. This mode should ONLY be used for:

• Development and testing
• Debugging environments
• Internal networks with certificate pinning enabled

NEVER use this in production without explicit certificate pinning via with_pinned_cert_hash().

For maximum security, only use this with the “dangerous_configuration” feature enabled, which is a strong indicator this is for testing/development only.

pub fn with_pinned_cert_hash(self, hash: Vec<u8>) -> Self

Pin a certificate by its SHA-256 hash/fingerprint

This provides additional security by only accepting connections from servers with the exact certificate matching this hash. Can be combined with insecure mode for development environments where you want to skip standard CA verification but still verify a specific cert. The handshake signature is verified against the pinned certificate’s public key, so a server that has the certificate but not its private key is rejected.

pub fn load_client_config(&self) -> Result<ClientConfig>

Load the TLS client configuration

pub fn server_name(&self) -> Result<ServerName<'_>>

Get the server name as a rustls::ServerName

pub fn server_name_string(&self) -> String

Get the server name as an owned String