Struct TlsConfig 

pub struct TlsConfig {
    pub identity: TlsIdentity,
    pub trusted_certs: TrustedCerts,
    pub server_name: String,
}

TLS configuration for Noxu DB replication channels.

A TlsConfig bundles this node’s identity (certificate + key) with the policy for verifying remote peers. Pass it to:

• TlsTcpChannelListener::bind_with_tls — encrypted TCP server
• TlsTcpChannel::connect_with_tls — encrypted TCP client
• TlsConfig::to_quinn_server_config — QUIC server with real certs
• TlsConfig::to_quinn_client_config — QUIC client with real certs

Fields

identity: TlsIdentity

This node’s certificate and private key.

trusted_certs: TrustedCerts

How to verify the remote peer’s certificate.

server_name: String

TLS SNI server name used by the client during the handshake.

Must match the certificate’s Common Name or a Subject Alternative Name. Use "localhost" when connecting to a SelfSigned cert with subject_alt_names = ["localhost"].

Implementations

impl TlsConfig

pub fn insecure(server_name: impl Into<String>) -> Self

Create an insecure TLS configuration for trusted private networks.

Generates a self-signed certificate at first use and skips peer certificate verification entirely. Equivalent to the current default QUIC channel behaviour.

Requires the tls-rustls feature.

pub fn from_pem_files( cert: impl Into<PathBuf>, key: impl Into<PathBuf>, ca: impl Into<PathBuf>, server_name: impl Into<String>, ) -> Self

Create a TLS configuration using PEM cert/key files and a CA file.

Verifies the remote peer’s certificate against ca. Requires the tls-rustls feature.

pub fn from_pkcs12( der: Vec<u8>, password: impl Into<String>, ca_pem: Vec<u8>, server_name: impl Into<String>, ) -> Self

Create a TLS configuration from a PKCS #12 archive.

Verifies the remote peer against ca_pem bytes. Requires the tls-native feature.

pub fn for_replication( identity: TlsIdentity, trusted_certs: TrustedCerts, server_name: impl Into<String>, ) -> Result<Self>

Create a TLS configuration intended for replication: requires both a non-self-signed identity and a non-empty CA list. Returns Err for any input that would produce a configuration where the peer cannot be authenticated.

This is the documented path for production replication per docs/src/internal/auth-mtls-design-2026-05.md. It is stricter than the from_pem_files and from_pkcs12 constructors:

• Rejects TlsIdentity::SelfSigned (a runtime-generated cert has no consistent subject across restarts — incompatible with subject-based authorisation).
• Rejects TrustedCerts::SkipVerification (skip-verify is a development-only path).
• Rejects empty CaFiles / CaBytes lists.

[TlsConfig::insecure] remains available for tests and trusted-network deployments where the operator explicitly accepts an unauthenticated transport.

Trait Implementations

impl Clone for TlsConfig

fn clone(&self) -> TlsConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TlsConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.