Struct ServerTlsConfig 

pub struct ServerTlsConfig {
    pub cert: PemSource,
    pub key: PemSource,
    pub client_ca: Option<PemSource>,
    pub alpn: Vec<Vec<u8>>,
}

Server-side TLS configuration.

Construct via ServerTlsConfig::builder.

Security

key (and cert/client_ca) are held as PemSource; the Bytes variant keeps the raw private key. The derived Debug redacts those bytes (see PemSource), so logging this struct will not leak the key, but the key is not zeroed while the config is alive.

Also

• ClientTlsConfig - the peer side.
• ServerTlsConfigBuilder - the builder.
• PemSource, TlsError.

Fields

cert: PemSource

Server certificate chain (leaf first).

key: PemSource

Server private key (PKCS#8, PKCS#1, or SEC1).

client_ca: Option<PemSource>

Trusted CA bundle for verifying client certificates (mTLS). None = standard TLS (no client cert required).

alpn: Vec<Vec<u8>>

ALPN protocol list, in preference order (e.g. [b"h2"] for gRPC). Empty = no ALPN negotiation requested.

Implementations

impl ServerTlsConfig

pub fn builder() -> ServerTlsConfigBuilder

Start a new builder.

pub fn into_rustls_config(self) -> Result<ServerConfig, TlsError>

Build a rustls::ServerConfig from this configuration.

Reads the PEM sources (disk or memory), parses the cert chain and key, optionally constructs a WebPkiClientVerifier for mTLS, and applies ALPN. Auto-installs the ring CryptoProvider if none is set process-wide.

Security

The server always presents cert + key. If client_ca is set, client authentication is mandatory: the server demands a client certificate chaining to that CA and rejects unauthenticated clients at the handshake (WebPkiClientVerifier defaults to deny-anonymous).

Server hostname is not this method’s concern: it is the client that verifies the server’s identity.

Errors

• TlsError::Io: PEM read
• TlsError::NoCertificates / TlsError::NoPrivateKey: parse
• TlsError::ClientVerifier: mTLS trust-anchor build
• TlsError::Rustls: e.g. cert/key mismatch

Trait Implementations

impl Clone for ServerTlsConfig

fn clone(&self) -> ServerTlsConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ServerTlsConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.