Module server 

Available on crate feature tls only.

TLS implementation agnostic server types

Structs

CertificateAuthorityData

An issuing CA chain and its private key.

CertificateIssuanceContext

Inputs available to a dynamic certificate issuer for one handshake.

CertificateSubject

X.509 subject metadata. Service identities belong in SANs, not the CN.

CertificateValidity

Validity policy relative to certificate generation time.

InputWithClientHello

An input with a Client Hello (tls) attached to it, usually used in combination with PeekTlsClientHelloService.

LeafCertConfig

Reusable policy for an end-entity server certificate.

LeafCertRequest

One concrete leaf-certificate request.

NoTlsRejectError

non-tls connection is rejected

PeekTlsClientHelloService

A peek Service which returns the ClientHello to the inner service for tls-detected traffic, and otherwise make use of the Reject service.

SelfSignedCaConfig

Configuration for a generated self-signed certificate authority.

ServerAuthData

Raw private key and certificate data to facilitate server authentication.

SniRequest

A request ready for SNI routing, usually used in combination with SniRouter.

SniRouter

A Service router that can be used to support routing of tls traffic as well as non-tls traffic.

TlsClientVerify

How the client is verified (mTLS).

TlsPeekRouter

A Service router that can be used to support tls traffic as well as non-tls traffic.

TlsServerAuth

Server auth (cert chain + key) to use, as configured on TlsServerConfig.

TlsServerConfig

A backend agnostic TLS server config

TlsStoreClientCertChain

Whether to capture the client certificate chain into NegotiatedTlsParameters.

Enums

CertificateIdentity

DNS or IP service identity encoded in a certificate’s SAN extension.

CertificateKeyKind

Key algorithm to use when generating a self-signed key pair.

ClientVerifyMode

Mode of client verification by a (tls) server

GeneratedServerAuthConfig

Configuration for generating static server-authentication material.

Traits

DynamicCertIssuer

Trait that needs to be implemented by cert issuers to support dynamically issueing (external) certs based on client_hello input.

Functions

peek_client_hello_from_input

Functional API to try to peek TLS:CH from an existing I/O input, returning the stream as-is with the read data prefixed from memory.

peek_client_hello_from_input_with_timeout_policy

Functional API to try to peek a TLS ClientHello with an explicit timeout policy, returning the stream with every consumed byte prefixed from memory.

Type Aliases

SniPrefixedIo

PrefixedIo alias used by SniRouter.

TlsClientHelloPrefixedIo

PrefixedIo alias used by PeekTlsClientHelloService.

TlsPrefixedIo

PrefixedIo alias used by TlsPeekRouter.