solti_tls/error.rs
1//! # TLS configuration error type.
2
3#[derive(Debug, thiserror::Error)]
4#[non_exhaustive]
5pub enum TlsError {
6 /// Reading a [`PemSource::Path`](crate::PemSource::Path) from disk failed.
7 /// The underlying [`std::io::Error`] is the source.
8 #[error("PEM I/O error: {0}")]
9 Io(#[from] std::io::Error),
10
11 /// The PEM parsed but contained no `CERTIFICATE` blocks where at least one was required (a cert chain or a CA bundle).
12 #[error("no certificates found in PEM")]
13 NoCertificates,
14
15 /// The PEM parsed but contained no private key (`PKCS#8`, `PKCS#1`, or `SEC1`).
16 #[error("no private key found in PEM")]
17 NoPrivateKey,
18
19 /// A required builder field was absent at `build()` time, or a paired field was supplied alone (e.g. a client cert without its key).
20 /// Carries the field name (`"cert"`, `"key"`, `"ca"`, `"client_cert"`, `"client_key"`).
21 #[error("missing required field: {0}")]
22 MissingField(&'static str),
23
24 /// `rustls` rejected the assembled configuration - most commonly a certificate/key mismatch caught by `with_single_cert`.
25 /// The [`rustls::Error`] is the source.
26 #[error("rustls error: {0}")]
27 Rustls(#[from] rustls::Error),
28
29 /// Building the mTLS client-certificate verifier failed - e.g. an empty trust anchor set or an invalid CRL.
30 /// The structured [`rustls::server::VerifierBuilderError`] is preserved as the source.
31 #[error("client verifier build failed: {0}")]
32 ClientVerifier(#[from] rustls::server::VerifierBuilderError),
33}