Struct TlsClientConfig 

pub struct TlsClientConfig { /* private fields */ }

TLS Client Configuration

Implementations

impl TlsClientConfig

pub fn new<S: Into<String>>(server_name: S) -> Self

Create a new TLS client configuration

pub fn with_tls_versions(self, versions: Vec<TlsVersion>) -> Self

Set allowed TLS protocol versions

Only the listed versions are enabled. An empty list is rejected when the config is loaded.

pub fn with_cipher_suites( self, cipher_suites: Vec<SupportedCipherSuite>, ) -> Self

Set allowed cipher suites

Only the listed suites are enabled, matched by suite identifier and kept in this crate’s preference order. Loading the config fails if none of them is supported, or if none of them can be used with the enabled TLS versions.

pub fn with_root_ca<S: Into<String>>(self, ca_path: S) -> Self

Trust the CA certificates in ca_path (PEM) instead of the system roots

Use this for servers with certificates from a private CA. Only the given CAs are trusted; the system root store is not loaded. Hostname and chain validation still apply, and a pin set with with_pinned_cert_hash() is checked on top.

Cannot be combined with insecure(), which skips CA validation: load_client_config() returns an error for that combination.

pub fn with_client_certificate<S: Into<String>>( self, cert_path: S, key_path: S, ) -> Self

Configure client authentication for mTLS

pub fn insecure(self) -> Self

Allow insecure connections (skip certificate verification)

WARNING: Security Risk

This mode skips certificate validation (no CA chain or hostname checks), so any certificate is accepted unless one is pinned with with_pinned_cert_hash(). The server must still prove that it holds the private key for the certificate it presents: the handshake signature is always verified. This mode should ONLY be used for:

• Development and testing
• Debugging environments
• Internal networks with certificate pinning enabled

NEVER use this in production without explicit certificate pinning via with_pinned_cert_hash(). For a server with a private CA, trust that CA with with_root_ca() instead.

pub fn with_pinned_cert_hash(self, hash: Vec<u8>) -> Self

Pin a certificate by its SHA-256 hash/fingerprint

Only a server presenting the certificate with exactly this hash is accepted. Compute the hash with TlsServerConfig::calculate_cert_hash(): it is the 32-byte SHA-256 digest of the DER certificate, as raw bytes (not hex).

Without insecure() the pin is checked in addition to normal CA and hostname validation. With insecure() it replaces them, for development setups with a self-signed certificate. Either way the handshake signature is verified against the pinned certificate’s public key, so a server that has the certificate but not its private key is rejected.

A hash that is not 32 bytes long can never match, so load_client_config() returns an error for it.

pub fn load_client_config(&self) -> Result<ClientConfig>

Load the TLS client configuration

Errors

Returns ProtocolError::TlsError if a pinned hash is not 32 bytes, if with_root_ca() is combined with insecure(), if a certificate or key file cannot be read or parsed, or if the version or cipher-suite settings leave nothing usable.

pub fn server_name(&self) -> Result<ServerName<'_>>

Get the server name as a rustls::ServerName

pub fn server_name_string(&self) -> String

Get the server name as an owned String