Skip to main content

Module tls

ullun

Module tls 

Source
Expand description

HTTPS (feature tls)

use ullun::prelude::*;
use ullun::tls::TlsConfig;

let tls = TlsConfig::from_pem_files("fullchain.pem", "privkey.pem").unwrap();
App::new()
    .get("/", |req: Request| async move { Ok(Response::text(format!("secure: {}", req.is_secure()))) })
    .tls(tls)
    .tls_reload_every(std::time::Duration::from_secs(3600))   // pick up renewed certificates
    .run("0.0.0.0:8443")
    .await
    .unwrap();
  • TLS 1.2 and 1.3 with rustls (ring provider); ALPN offers h2 and http/1.1, so clients that speak HTTP/2 get it automatically.
  • Reload without restart: TlsConfig::reload re-reads the certificate files; new connections use the new certificate, open ones keep running. A renewal that fails to load (half-written file, wrong key) is reported and the previous certificate stays in service.
  • Client certificates (mutual TLS) with TlsConfig::client_auth, required or optional; handlers read the presented certificate with Request::client_certificate.
  • A client that does not complete the handshake within TlsConfig::handshake_timeout (default 10 s) is dropped, so half-open connections cannot pile up.

Redirect plain HTTP with RequireHttps on a second listener and add Hsts to the HTTPS app.

Structsยง

TlsConfig
Certificate, key and client-auth policy of an HTTPS server; cheap to clone, clones share the (reloadable) configuration