Struct MtlsConfig 

#[non_exhaustive]
pub struct MtlsConfig {

    pub ca_cert_path: PathBuf,
    pub required: bool,
    pub default_role: String,
    pub crl_enabled: bool,
    pub crl_refresh_interval: Option<Duration>,
    pub crl_fetch_timeout: Duration,
    pub crl_stale_grace: Duration,
    pub crl_deny_on_unavailable: bool,
    pub crl_end_entity_only: bool,
    pub crl_allow_http: bool,
    pub crl_enforce_expiration: bool,
    pub crl_max_concurrent_fetches: usize,
    pub crl_max_response_bytes: u64,
    pub crl_discovery_rate_per_min: u32,
    pub crl_max_host_semaphores: usize,
    pub crl_max_seen_urls: usize,
    pub crl_max_cache_entries: usize,
}

mTLS client certificate authentication configuration.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

ca_cert_path: PathBuf

Path to CA certificate(s) for verifying client certs (PEM format).

required: bool

If true, clients MUST present a valid certificate. If false, client certs are optional (verified if presented).

default_role: String

Default RBAC role for mTLS-authenticated clients. The client cert CN becomes the identity name.

crl_enabled: bool

Enable CRL-based certificate revocation checks using CDP URLs from the configured CA chain and connecting client certificates.

crl_refresh_interval: Option<Duration>

Optional fixed refresh interval for known CRLs. When omitted, refresh cadence is derived from nextUpdate and clamped internally.

crl_fetch_timeout: Duration

Timeout for individual CRL fetches.

crl_stale_grace: Duration

Grace window during which stale CRLs may still be used when refresh attempts fail.

crl_deny_on_unavailable: bool

When true, missing or unavailable CRLs cause revocation checks to fail closed.

crl_end_entity_only: bool

When true, apply revocation checks only to the end-entity certificate.

crl_allow_http: bool

Allow HTTP CRL distribution-point URLs in addition to HTTPS.

Defaults to true because RFC 5280 §4.2.1.13 designates HTTP (and LDAP) as the canonical transport for CRL distribution points. SSRF defense for HTTP CDPs is provided by the IP-allowlist guard (private/loopback/link-local/multicast/cloud-metadata addresses are always rejected), redirect=none, body-size cap, and per-host concurrency limit – not by forcing HTTPS.

crl_enforce_expiration: bool

Enforce CRL expiration during certificate validation.

crl_max_concurrent_fetches: usize

Maximum concurrent CRL fetches across all hosts. Defense in depth against SSRF amplification: even if many CDPs are discovered, no more than this many fetches run in parallel. Per-host concurrency is independently capped at 1 regardless of this value. Default: 4.

crl_max_response_bytes: u64

Hard cap on each CRL response body in bytes. Fetches exceeding this are aborted mid-stream to bound memory and prevent gzip-bomb-style amplification. Default: 5 MiB (5 * 1024 * 1024).

crl_discovery_rate_per_min: u32

Global CDP discovery rate limit, in URLs per minute. Throttles how many new CDP URLs the verifier may admit into the fetch pipeline across the whole process, bounding asymmetric DoS amplification when attacker-controlled certificates carry large CDP lists. The limit is global (not per-source-IP) in this release; per-IP scoping is deferred to a future version because it requires plumbing the peer SocketAddr through the verifier hook. URLs that lose the rate-limiter race are not marked as seen, so subsequent handshakes observing the same URL can retry admission. Default: 60.

crl_max_host_semaphores: usize

Maximum number of distinct hosts that may hold a CRL fetch semaphore at any time. Requests that would grow the map beyond this cap return McpxError::Config containing the literal substring "crl_host_semaphore_cap_exceeded". Bounds memory growth from attacker-controlled CDP URLs pointing at unique hostnames. Default: 1024.

crl_max_seen_urls: usize

Maximum number of distinct URLs tracked in the “seen” set. Beyond this, additional discovered URLs are silently dropped with a rate-limited warn! log; no error surfaces. Default: 4096.

crl_max_cache_entries: usize

Maximum number of cached CRL entries. Beyond this, new successful fetches are silently dropped with a rate-limited warn! log (newest-rejected, not LRU-evicted). Default: 1024.

Trait Implementations

impl Clone for MtlsConfig

fn clone(&self) -> MtlsConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for MtlsConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for MtlsConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.