Crate waf_tls_managed 

Managed TLS for Light WAF: an implementation of the core’s waf_proxy::tls::TlsCertSource trait, injected with Proxy::builder(&cfg).cert_source(..) without forking the core (which itself only ships a static certificate from disk).

• ACME, hitless (resolver()): server certificates via TLS-ALPN-01 (acme) or DNS-01 with Cloudflare/Route53 (acme_dns01, dns), with background renewal that rotates the live certificate without rebuilding the acceptor. In cluster mode one node issues and renews and every node serves the same certificate from a shared store (waf-state-redis).
• mTLS (client_verifier()): require and verify client certificates against a configured CA bundle (mtls).

A source may carry either, both, or neither (with a file fallback for the server certificate when ACME is off but mTLS is on).

Re-exports

pub use acme::AcmeError;

pub use acme::AcmeParams;

pub use acme::ChallengeStrategy;

pub use mtls::verifier_from_ca_file;

pub use mtls::MtlsError;

Modules

acme

ACME server-cert provisioning — the L1 enterprise seam (TlsCertSource::resolver).

acme_dns01

ACME DNS-01 driver (enterprise). rustls-acme is TLS-ALPN-01 only, so DNS-01 runs on instant-acme, used purely as a protocol client: it yields the issued certificate PEM, and we build the rustls CertifiedKey with the core’s rustls (tokio_rustls 0.26). That is the load-bearing seam (“suture”) — the issued chain plus a key we own (generated with rcgen) become a CertifiedKey the core can serve. Because we only consume PEM bytes from instant-acme, its internal rustls version need not match ours.

dns

DNS provider abstraction for ACME DNS-01 — publish/remove the _acme-challenge.<base> TXT records the challenge needs. Concrete providers (Cloudflare, a test challtestsrv, …) implement this trait; the DNS-01 driver (crate::acme_dns01) is provider-agnostic.

mtls

mTLS / managed-PKI client-certificate verification — the L2 enterprise seam (TlsCertSource::client_verifier). Builds a rustls WebPkiClientVerifier from a configured CA bundle so the listener requires and verifies client certificates.

Structs

ManagedTlsBuilder

Builder for ManagedTlsCertSource.

ManagedTlsCertSource

A TlsCertSource that provides managed server certs (ACME resolver) and/or mTLS client verification, composed from the pieces in acme/mtls. Build it with ManagedTlsCertSource::builder.