Struct TlsServerConfig 

pub struct TlsServerConfig { /* private fields */ }

TLS server configuration

Implementations

impl TlsServerConfig

pub fn new<P: AsRef<Path>>(cert_path: P, key_path: P) -> Self

Create a new TLS server configuration

pub fn with_tls_versions(self, versions: Vec<TlsVersion>) -> Self

Set allowed TLS protocol versions

Only the listed versions are enabled. An empty list is rejected when the config is loaded.

pub fn with_cipher_suites( self, cipher_suites: Vec<SupportedCipherSuite>, ) -> Self

Set allowed cipher suites

Only the listed suites are enabled, matched by suite identifier and kept in this crate’s preference order. Loading the config fails if none of them is supported, or if none of them can be used with the enabled TLS versions.

pub fn with_client_auth<S: Into<String>>(self, client_ca_path: S) -> Self

Enable mutual TLS authentication by providing a CA certificate path

pub fn require_client_auth(self, required: bool) -> Self

Set whether client authentication is required (true) or optional (false)

Client certificates are verified against the CA given to with_client_auth(), which also sets this to true. Call it after with_client_auth() to make client authentication optional: clients without a certificate are then accepted, but a certificate that is presented must still be signed by the client CA.

require_client_auth(true) without with_client_auth() has no CA to verify against, so load_server_config() returns an error instead of silently accepting clients without a certificate.

pub fn with_alpn_protocols(self, protocols: Vec<Vec<u8>>) -> Self

Set ALPN protocols to advertise during TLS handshake

pub fn generate_self_signed<P: AsRef<Path>>( cert_path: P, key_path: P, ) -> Result<Self>

Generate a self-signed certificate for development/testing purposes

pub fn load_server_config(&self) -> Result<ServerConfig>

Load the TLS configuration from files

Errors

Returns ProtocolError::TlsError if a file cannot be read or parsed, if the version or cipher-suite settings leave nothing usable, or if client authentication is required without a client CA (see require_client_auth()).

pub fn calculate_cert_hash(cert: &CertificateDer<'_>) -> Vec<u8>

Calculate SHA-256 hash for a certificate to use with pinning