Struct TlsPolicy 

pub struct TlsPolicy { /* private fields */ }

A crypto provider + protocol-version policy shared across every listener a Server runs.

Configure it once and it covers clearnet HTTPS (static cert or Let’s Encrypt via AcmeManager), the onion .onion HTTPS termination (OnionConfig), and the I2P eepsite’s optional TLS layer (I2pConfig), instead of being reconstructed by hand for each one.

Pass it once via Server::tls_policy; every listener that generates its own self-signed certificate (onion, I2P) will build it with this same provider, and clearnet’s ACME/static ServerConfig uses it too.

The Tor relay/channel layer is a separate concern

This policy governs TLS termination — the handshake a browser or I2P/Tor client completes with this process. It does not reach the TLS arti uses internally to connect out to Tor relays (the “channel” layer) — arti has no API to accept a custom rustls::ClientConfig for that. Instead, arti reads whatever CryptoProvider is installed as rustls’s process-wide default. Call install_as_process_default with this same policy before bootstrapping a TorClient (this is done for you by Server::serve_tor/ serve_onion) so the relay layer uses the same AEAD/KEM choices as your HTTPS listeners.

Restricting this policy to post-quantum-only or a single cipher suite is safe for the termination side (you control both ends), but risks breaking Tor bootstrap connectivity if also installed process-wide: plenty of relays on the live network don’t yet support hybrid PQ key-exchange groups on their TLS link layer. Prefer PQ, don’t require it exclusively, if this same policy will also be installed as the process default.

Implementations

impl TlsPolicy

pub fn hardened() -> Self

Tachyon’s curated default: hybrid post-quantum key-exchange groups preferred (X25519MLKEM768, SECP256R1MLKEM768, MLKEM1024, MLKEM768), falling back to classical ECDHE groups (SECP384R1, X25519, SECP256R1) for interoperability; AES-256-GCM and ChaCha20-Poly1305 preferred over AES-128 for both TLS 1.3 and TLS 1.2 cipher suites. Both TLS 1.3 and 1.2 are offered — see tls13_only to pin more strictly.

pub fn with_provider(provider: Arc<CryptoProvider>) -> Self

Builds a policy from a fully custom CryptoProvider — for example one pinned to TLS13_AES_256_GCM_SHA384 only, or built from rustls::crypto::default_fips_provider() (with the fips feature) for FIPS-140-3-validated aws-lc-rs primitives.

Defaults to offering both TLS 1.3 and TLS 1.2 — see tls13_only.

pub fn tls13_only(self) -> Self

Restricts this policy to TLS 1.3 only (default: TLS 1.3 and 1.2 both offered).

pub fn provider(&self) -> Arc<CryptoProvider>

The underlying crypto provider.

pub fn versions(&self) -> &[&'static SupportedProtocolVersion]

The protocol versions this policy negotiates.

pub fn install_as_process_default(&self)

Installs this policy’s crypto provider as rustls’s process-wide default, via CryptoProvider::install_default.

Idempotent and safe to call redundantly (e.g. once per listener sharing this policy): rustls’s global default can only be set once per process, so only the first call actually installs anything — later calls (even with a different policy) are silently ignored. Call this before bootstrapping a TorClient if you want arti’s relay/channel TLS connections to use this policy’s provider too — see the type docs for why that’s a separate concern from HTTPS termination.

Trait Implementations

impl Clone for TlsPolicy

fn clone(&self) -> TlsPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TlsPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for TlsPolicy

fn default() -> Self

Returns the “default value” for a type.