Module tls 

rustls TLS stack (SSH-over-TLS, mTLS, ACME) — feature tls (default). Product TLS via rustls (aws_lc_rs only): SSH-over-TLS, mTLS, ACME.

Design (Rules Rust — rustls)

Concern	Rule
Provider	CryptoProvider::install_default once in binary main
Libraries	use ClientConfig::builder / get_default — never reinstall
Stack	rustls ≥ 0.23.18 only; no native-tls / OpenSSL / ring
Storage	XDG under tls/ — no product env vars for cert material
Secrets	PEM keys 0o600; never log private key material

Workload

I/O-bound (TCP + TLS handshake). No Rayon. Multi-host fan-out stays in callers.

Modules

commandstls

CLI handlers for ssh-cli tls … (feature tls).

Structs

MtlsIdentitytls

Named mTLS client identity on disk.

TlsClientOptionstls

Inputs for building a shared ClientConfig.

TlsConnectOptions

Options for wrapping the SSH TCP path in TLS (SSH-over-TLS).

Enums

AcmeDirectorytls

ACME directory selection.

Functions

acme_account_pathtls

…/tls/acme/account.json

acme_completetls

Completes ACME after DNS TXT is published: resume order → set_ready → finalize.

acme_domain_dirtls

…/tls/acme/<domain>/ — domain leaf is NFC-normalized validated name.

acme_issue_print_challengetls

Starts DNS-01 order and returns challenge details (does not wait for DNS).

acme_listtls

Lists all domain directories under ACME storage.

acme_statustls

Status for one domain or all under ACME dir.

build_client_configtls

Builds an Arc<ClientConfig> with webpki-roots and optional mTLS.

create_accounttls

Creates (or refuses if exists unless force) an ACME account under XDG.

dial_tlstls

Dials host:port, completes TLS with SNI/TlsConnectOptions, returns the stream.

install_default_providertls

Installs aws_lc_rs::default_provider once for the process.

load_account_statustls

Loads account presence / path without contacting ACME.

mtls_identity_dirtls

…/tls/mtls/<name>/

mtls_importtls

Imports PEM cert+key into XDG as identity name (overwrites).

mtls_listtls

Lists imported mTLS identity names.

mtls_removetls

Removes an identity directory.

mtls_showtls

Shows paths for one identity.

provider_is_installedtls

Returns true when a process default provider is available.

provider_nametls

Static provider name string (aws_lc_rs).

resolve_mtls_pathstls

Resolves mTLS paths: either explicit paths or an XDG identity name.

resolve_tls_roottls

Resolves the TLS root directory under the active config dir.

tls_root_dirtls

Same as resolve_tls_root (alias for call-site clarity).

Type Aliases

TlsStreamtls

Product TLS stream type (client half over TCP).