Struct ClientTlsConfig 

pub struct ClientTlsConfig {
    pub ca: PemSource,
    pub client_cert: Option<PemSource>,
    pub client_key: Option<PemSource>,
    pub alpn: Vec<Vec<u8>>,
}

Client-side TLS configuration.

Construct via ClientTlsConfig::builder. client_cert and client_key are paired: supply both (mTLS) or neither - the builder rejects one without the other.

Security

client_key is held as a PemSource whose Bytes variant keeps the raw key; the derived Debug redacts it (see PemSource). The key is not zeroized while the config is alive.

Also

• ServerTlsConfig - the peer side.
• ClientTlsConfigBuilder - the builder.
• PemSource, TlsError.

Fields

ca: PemSource

Trusted CA bundle for verifying the server’s certificate.

client_cert: Option<PemSource>

Client certificate chain (None = no client cert).

client_key: Option<PemSource>

Client private key.

alpn: Vec<Vec<u8>>

ALPN protocol list, in preference order.

Implementations

impl ClientTlsConfig

pub fn builder() -> ClientTlsConfigBuilder

Start a new builder.

pub fn into_rustls_config(self) -> Result<ClientConfig, TlsError>

Build a rustls::ClientConfig.

Reads the PEM sources, builds a RootCertStore from ca, optionally adds the client cert+key for mTLS, and applies ALPN. Auto-installs the ring CryptoProvider if none is set.

Security: read this!

The resulting config verifies that the server’s certificate chains to the ca bundle you supplied (rustls’ WebPkiServerVerifier; trust roots come only from your PEM, not the OS store). It does not itself check the server hostname: SAN/identity matching is done by rustls when you connect, against the ServerName you pass to TlsConnector::connect(server_name, ..) (or the tonic/reqwest equivalent).

Pass the real server name - a wrong or placeholder name silently defeats identity checking even though the chain still validates. Do not install a dangerous() certificate verifier on the returned config. Revocation (OCSP/CRL) is not checked.

If client_cert + client_key are set, they are presented for mTLS.

Errors

TlsError::Io (PEM read), TlsError::NoCertificates / TlsError::NoPrivateKey (parse), TlsError::Rustls.

Trait Implementations

impl Clone for ClientTlsConfig

fn clone(&self) -> ClientTlsConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ClientTlsConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.