Module tls 

TLS termination and protocol (HTTP/1.1 vs HTTP/2) selection for the listeners.

This is the single place that knows how to load a PEM cert/key, build a rustls [ServerConfig] (with ALPN and a min_version floor), turn it into a [tokio_rustls::TlsAcceptor], and serve a connection over the negotiated protocol. Both the data-plane listener (server::listener) and the optional Admin API TLS reuse build_acceptor + serve_connection, so cert handling lives in exactly one module.

Everything is pinned to the rustls ring provider, matching the rest of the dependency tree (see install_crypto_provider).

Structs

ClientCertIdentity

Verified identity of an mTLS client, read from its leaf certificate.

SniCertResolver 🔒

Resolves the server certificate by ClientHello SNI hostname (exact or single-label wildcard), falling back to the default cert. Enables multi-domain TLS termination on one listener.

Enums

TlsError

Failure loading a cert/key or building the rustls config. Every variant carries enough detail (the offending path or message) for a fail-fast startup error.

Functions

build_acceptor

Builds a [TlsAcceptor] ready to wrap accepted TCP streams. Fail-fast: any cert/key/config error surfaces here at startup.

build_connection

Builds (but does not drive) a connection future for io, ready to be either .awaited directly or handed to a graceful-shutdown watcher.

build_reloadable

Builds a hot-reloadable TLS config: the initial ServerConfig wrapped in an [ArcSwap] so spawn_cert_watcher can swap it in on cert rotation. Fail-fast: a bad cert/key at startup surfaces here.

build_server_config

Builds a rustls [ServerConfig] from tls, enforcing min_version and advertising ALPN h2+http/1.1 when http2_enabled (else http/1.1 only). Uses an explicit ring provider so the version floor is honored regardless of global-provider install ordering.

certified_key 🔒

Loads a cert chain + key into a validated [CertifiedKey] (same load + key-match check with_single_cert performs).

client_cert_identity

The verified client identity on an mTLS connection, or None if the client presented no certificate (anonymous client in optional mode, or mTLS not enabled). Read after the handshake.

current_acceptor

A [TlsAcceptor] over the current config. Call this per connection (it’s an atomic load + Arc clone) so reloads take effect for new connections.

install_crypto_provider

Installs the process-level rustls ring CryptoProvider exactly once.

load_cert_chain

Loads the PEM certificate chain at path. Errors if the file is missing or contains no certificates.

load_client_ca_roots 🔒

Loads a PEM CA bundle at path into a [RootCertStore] for verifying client certificates (mTLS). Errors if the file is missing or yields no usable certificates.

load_private_key

Loads the PEM private key at path (PKCS#8, PKCS#1, or SEC1). Errors if the file is missing or contains no private key.

parse_client_identity 🔒

Extracts the subject CN and SAN DNS names from a DER-encoded certificate. Panic-free: any parse error yields (None, empty).

serve_connection

Serves a single (already-handshaked, TokioIo-wrapped) connection.

spawn_cert_watcher

Watches the cert/key files and hot-reloads shared when they change.

Type Aliases

SharedTlsConfig

A live TLS ServerConfig that can be atomically swapped for cert rotation. New connections read the current config; in-flight ones are unaffected.