Struct TlsManager 

pub struct TlsManager { /* private fields */ }

TLS manager with SNI-based certificate selection and hot reload.

Performance (PERF-P2-2)

Uses ahash::RandomState for 2-3x faster HashMap operations.

Implementations

impl TlsManager

pub fn new(min_version: TlsVersion) -> Self

Creates a new TLS manager with the specified minimum version.

pub fn with_tls12_minimum() -> Self

Creates a TLS manager with TLS 1.2 minimum.

pub fn load_cert(&self, config: &TlsCertConfig) -> Result<(), TlsError>

Loads a certificate from files.

Security

• Validates file paths for traversal attacks
• Enforces file size limits
• Never logs private key paths or contents

pub fn set_default_cert(&self, config: &TlsCertConfig) -> Result<(), TlsError>

Sets the default certificate for unmatched domains.

pub fn get_cert(&self, domain: &str) -> Option<Arc<CertifiedKey>>

Gets the certificate for a domain using SNI matching.

Matching Order

1. Exact domain match
2. Wildcard match (*.example.com matches sub.example.com)
3. Default certificate

pub fn reload_all(&self) -> ReloadResult

Reloads all certificates from their original paths. This is called on SIGHUP for hot reload.

Hot Reload Strategy

Certificates are reloaded atomically: new certificates are loaded into temporary maps, then swapped in all at once. If any certificate fails to load, all successfully loaded certificates are still applied and failures are reported.

Returns

ReloadResult containing counts of succeeded/failed reloads and error details.

pub fn reload_cert(&self, domain: &str) -> Result<(), TlsError>

Reloads a single certificate by domain.

Arguments

• domain - The domain to reload (case-insensitive)

Returns

Ok(()) if successful, or the error that occurred.

pub fn configured_domains(&self) -> Vec<String>

Returns the list of configured domains (for monitoring/diagnostics).

pub fn has_cert_config(&self, domain: &str) -> bool

Returns true if a certificate is configured for the given domain.

pub fn min_version(&self) -> TlsVersion

Returns the minimum TLS version.

pub fn cert_count(&self) -> usize

Returns the number of loaded certificates.

Trait Implementations

impl Default for TlsManager

fn default() -> Self

Returns the “default value” for a type.