Enum TlsMode 

pub enum TlsMode {
    Disable,
    Prefer,
    Require,
    VerifyCa,
    VerifyFull,
}

How hard to insist on TLS, and how much of the certificate to believe.

The names match PostgreSQL’s sslmode and MySQL’s --ssl-mode, because a person configuring this has almost certainly met them before and a third spelling of the same idea helps nobody.

Variants

Disable

Never encrypt. Everything, the password included, is on the wire in the clear.

Prefer

Encrypt if the server offers it, otherwise carry on in the clear.

The default, and it is worth being blunt about what it is worth: it guarantees nothing. An attacker positioned to read the connection is also positioned to answer “no, I don’t do TLS”, and the client will obligingly continue in plain text. It defends against a passive eavesdropper on a well-behaved network and against nobody else. Anything facing a real network wants TlsMode::VerifyFull.

Require

Refuse to connect without encryption, but believe whatever certificate is presented.

Stops passive eavesdropping outright. Does not stop an active attacker, who simply presents a certificate of their own.

VerifyCa

Encrypt, and check the certificate chains to a trusted root — but do not check the hostname.

The mode for a managed database reached through a name that is not on its certificate, which is common enough that PostgreSQL and MySQL both name it.

VerifyFull

Encrypt, and check both the chain and the hostname. The only mode that is secure against an active attacker.

Implementations

impl TlsMode

pub fn parse(raw: &str) -> Result<TlsMode>

pub fn as_str(self) -> &'static str

pub fn wants_tls(self) -> bool

Whether the driver should ask the server to encrypt at all.

pub fn demands_tls(self) -> bool

Whether a server that declines to encrypt is a failure.

pub fn verifies_certificate(self) -> bool

Whether the certificate is checked against a trust anchor.

Trait Implementations

impl Clone for TlsMode

fn clone(&self) -> TlsMode

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for TlsMode

impl Debug for TlsMode

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for TlsMode

fn default() -> TlsMode

Returns the “default value” for a type.

impl Display for TlsMode

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for TlsMode

impl PartialEq for TlsMode

fn eq(&self, other: &TlsMode) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for TlsMode