Struct MtlsIdentity 

pub struct MtlsIdentity { /* private fields */ }

A single-sided mTLS identity: a CA that signs one leaf certificate.

Each side of the mTLS connection generates its own MtlsIdentity. Only the CA certificate (public) is shared with the peer — private keys never leave the process that generated them.

Host (client)                         Container (server)
─────────────────                     ─────────────────────
MtlsIdentity::generate_client()       MtlsIdentity::generate_server()
  ├─ client CA cert  ──────────────►  trusted by server (verifies client)
  ├─ client leaf cert (in memory)     ├─ server CA cert  ◄── output to stdout
  └─ client leaf key (in memory)      ├─ server leaf cert (in memory)
                                      └─ server leaf key (in memory)

host trusts server CA cert ◄──────── parsed from stdout

Implementations

impl MtlsIdentity

pub fn generate_client() -> Result<Self>

Generate a client identity (CA + client leaf cert).

pub fn generate_server() -> Result<Self>

Generate a server identity (CA + server leaf cert with localhost SANs).

pub fn ca_cert_pem(&self) -> Result<String>

Get the CA certificate PEM (public, safe to share with the peer).

pub fn create_server_config( &self, trusted_client_ca_pem: &str, ) -> Result<ServerConfig>

Build a rustls::ServerConfig that serves with this identity’s leaf cert and trusts the given client CA PEM for client authentication.

pub fn create_client_config( &self, trusted_server_ca_pem: &str, ) -> Result<ClientConfig>

Build a rustls::ClientConfig that authenticates with this identity’s leaf cert and trusts the given server CA PEM.

Trait Implementations

impl Debug for MtlsIdentity

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.