Module tls 

TLS connector construction for the connection pool, via rustls.

Enabled by the tls cargo feature (on by default). Certificates are verified against the Mozilla root store (webpki_roots) — chain and hostname — for every TLS-capable crate::config::SslMode. This is deliberately stricter than libpq, whose sslmode=require performs no certificate verification; there is no encrypt-without-verify mode.

A server whose CA is deliberately not publicly trusted therefore cannot be verified out of the box. Amazon RDS is the common case: its rds-ca-* authorities are Amazon-operated and absent from the Mozilla store, so with rds.force_ssl on there is no working combination — the TLS-requiring modes cannot verify the chain and the plaintext modes are refused by the server. Point crate::config::PgConfig::ssl_root_cert (the libpq sslrootcert URL parameter) at the provider’s CA bundle for those.

Functions

make_tls_connector

Build the TLS connector handed to deadpool’s Manager.

make_tls_connector_with_root_cert

Build the TLS connector, optionally verifying against a PEM bundle instead of the Mozilla root store.