Struct TlsMitmEgressServerAuth 

pub struct TlsMitmEgressServerAuth { /* private fields */ }

Available on crate feature boring only.

Server-authentication policy for upstream TLS connections made by a TlsMitmRelay.

This deliberately exposes only certificate/identity verification controls. TLS fingerprint and protocol-negotiation settings remain owned by the relay and mirrored from the ingress ClientHello.

Verification is disabled by default. A transparent MITM relay should not reject an upstream certificate that the intercepted client may deliberately accept; doing so would make previously viable traffic fail at the relay. Configure ServerVerifyMode::Auto explicitly when the proxy operator wants to enforce upstream certificate and hostname verification.

Implementations

impl TlsMitmEgressServerAuth

pub fn new() -> TlsMitmEgressServerAuth

Create a policy with upstream certificate verification disabled.

pub fn with_server_name(self, server_name: Host) -> TlsMitmEgressServerAuth

Set the upstream identity used for certificate verification.

A DNS identity is also sent as SNI. Without an explicit identity, the relay uses ingress SNI. When verification or pinning is configured and ingress SNI is absent, it falls back to the connector-target host.

pub fn set_server_name( &mut self, server_name: Host, ) -> &mut TlsMitmEgressServerAuth

Set the upstream identity used for certificate verification.

A DNS identity is also sent as SNI. Without an explicit identity, the relay uses ingress SNI. When verification or pinning is configured and ingress SNI is absent, it falls back to the connector-target host.

pub fn with_server_verify( self, mode: ServerVerifyMode, ) -> TlsMitmEgressServerAuth

Set how the upstream certificate is verified.

Select ServerVerifyMode::Auto to opt into normal certificate and hostname verification.

pub fn set_server_verify( &mut self, mode: ServerVerifyMode, ) -> &mut TlsMitmEgressServerAuth

Set how the upstream certificate is verified.

Select ServerVerifyMode::Auto to opt into normal certificate and hostname verification.

pub fn with_server_cert_pins( self, pins: TlsServerCertPins, ) -> TlsMitmEgressServerAuth

Require the upstream leaf certificate to match an applicable pin set.

pub fn set_server_cert_pins( &mut self, pins: TlsServerCertPins, ) -> &mut TlsMitmEgressServerAuth

Require the upstream leaf certificate to match an applicable pin set.

pub fn with_server_trust(self, trust: TlsServerTrust) -> TlsMitmEgressServerAuth

Replace the complete upstream trust policy.

Trust settings are used only with ServerVerifyMode::Auto.

pub fn set_server_trust( &mut self, trust: TlsServerTrust, ) -> &mut TlsMitmEgressServerAuth

Replace the complete upstream trust policy.

Trust settings are used only with ServerVerifyMode::Auto.

pub fn try_with_server_trust_anchors( self, certificates: impl IntoIterator<Item = CertificateDer<'static>>, ) -> Result<TlsMitmEgressServerAuth, Box<dyn Error + Sync + Send>>

Replace the default roots with the supplied upstream trust anchors.

Trust settings are used only with ServerVerifyMode::Auto.

pub fn try_set_server_trust_anchors( &mut self, certificates: impl IntoIterator<Item = CertificateDer<'static>>, ) -> Result<&mut TlsMitmEgressServerAuth, Box<dyn Error + Sync + Send>>

Replace the default roots with the supplied upstream trust anchors.

Trust settings are used only with ServerVerifyMode::Auto.

pub fn try_with_extra_server_trust_anchors( self, certificates: impl IntoIterator<Item = CertificateDer<'static>>, ) -> Result<TlsMitmEgressServerAuth, Box<dyn Error + Sync + Send>>

Add certificates to the configured upstream trust roots.

Trust settings are used only with ServerVerifyMode::Auto.

pub fn try_set_extra_server_trust_anchors( &mut self, certificates: impl IntoIterator<Item = CertificateDer<'static>>, ) -> Result<&mut TlsMitmEgressServerAuth, Box<dyn Error + Sync + Send>>

Add certificates to the configured upstream trust roots.

Trust settings are used only with ServerVerifyMode::Auto.

pub fn with_webpki_roots(self) -> TlsMitmEgressServerAuth

Use Rama’s bundled Mozilla roots for upstream verification.

Trust settings are used only with ServerVerifyMode::Auto.

pub fn set_webpki_roots(&mut self) -> &mut TlsMitmEgressServerAuth

Use Rama’s bundled Mozilla roots for upstream verification.

Trust settings are used only with ServerVerifyMode::Auto.

pub fn with_server_verify_cert_store( self, store: Arc<X509Store>, ) -> TlsMitmEgressServerAuth

Set a BoringSSL certificate store for upstream verification.

The store takes precedence over the backend-neutral trust policy and is ignored when verification is explicitly disabled.

pub fn set_server_verify_cert_store( &mut self, store: Arc<X509Store>, ) -> &mut TlsMitmEgressServerAuth

Set a BoringSSL certificate store for upstream verification.

The store takes precedence over the backend-neutral trust policy and is ignored when verification is explicitly disabled.

Trait Implementations

impl Clone for TlsMitmEgressServerAuth

fn clone(&self) -> TlsMitmEgressServerAuth

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TlsMitmEgressServerAuth

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for TlsMitmEgressServerAuth

fn default() -> TlsMitmEgressServerAuth

Returns the “default value” for a type.