Module tls 

TLS metrics: what each handshake negotiated, and when the served certificates expire.

• rws_tls_handshakes_total{tls_protocol_version,tls_cipher,tls_group} — completed handshakes on the TLS-over-TCP listener (HTTP/1.1 and HTTP/2), by protocol version, cipher suite and key-exchange group (a post-quantum hybrid such as X25519MLKEM768, or a classical group). HTTP/3 handshakes aren’t counted: quinn doesn’t expose what its TLS session negotiated.
• rws_tls_handshake_failures_total — handshakes that failed (timeouts not included).
• rws_tls_certificate_expiry_timestamp_seconds{name} — the leaf certificate’s notAfter, Unix seconds, per configured name (default for the default certificate, the virtual host’s domain, an on-demand name); updated whenever certificates are (re)loaded.

Functions

record_handshake

Count a completed handshake by what it negotiated.

record_handshake_failure

Count a failed handshake.

set_configured_certificates

Replace the configured certificates’ expiry times: (name, leaf DER). A certificate that can’t be parsed is left out.

set_on_demand_certificate

Record an on-demand certificate’s expiry time.