Struct rustls::ConfigBuilder

pub struct ConfigBuilder<Side: ConfigSide, State> { /* private fields */ }

Building a ServerConfig or ClientConfig in a linker-friendly and complete way.

Linker-friendly: meaning unused cipher suites, protocol versions, key exchange mechanisms, etc. can be discarded by the linker as they’ll be unreferenced.

Complete: the type system ensures all decisions required to run a server or client have been made by the time the process finishes.

Example, to make a ServerConfig:

ServerConfig::builder()
    .with_safe_default_cipher_suites()
    .with_safe_default_kx_groups()
    .with_safe_default_protocol_versions()
    .unwrap()
    .with_no_client_auth()
    .with_single_cert(certs, private_key)
    .expect("bad certificate/key");

This may be shortened to:

ServerConfig::builder()
    .with_safe_defaults()
    .with_no_client_auth()
    .with_single_cert(certs, private_key)
    .expect("bad certificate/key");

To make a ClientConfig:

ClientConfig::builder()
    .with_safe_default_cipher_suites()
    .with_safe_default_kx_groups()
    .with_safe_default_protocol_versions()
    .unwrap()
    .with_root_certificates(root_certs)
    .with_client_auth_cert(certs, private_key)
    .expect("bad certificate/key");

This may be shortened to:

ClientConfig::builder()
    .with_safe_defaults()
    .with_root_certificates(root_certs)
    .with_no_client_auth();

The types used here fit together like this:

1. Call ClientConfig::builder() or ServerConfig::builder() to initialize a builder.
2. You must make a decision on which cipher suites to use, typically by calling ConfigBuilder<S, WantsCipherSuites>::with_safe_default_cipher_suites().
3. Now you must make a decision on key exchange groups: typically by calling ConfigBuilder<S, WantsKxGroups>::with_safe_default_kx_groups().
4. Now you must make a decision on which protocol versions to support, typically by calling ConfigBuilder<S, WantsVersions>::with_safe_default_protocol_versions().
5. Now see ConfigBuilder<ClientConfig, WantsVerifier> or ConfigBuilder<ServerConfig, WantsVerifier> for further steps.

Implementations

impl<S: ConfigSide> ConfigBuilder<S, WantsCipherSuites>

pub fn with_safe_defaults(self) -> ConfigBuilder<S, WantsVerifier>

Start side-specific config with defaults for underlying cryptography.

If used, this will enable all safe supported cipher suites (DEFAULT_CIPHER_SUITES), all safe supported key exchange groups (ALL_KX_GROUPS) and all safe supported protocol versions (DEFAULT_VERSIONS).

These are safe defaults, useful for 99% of applications.

pub fn with_cipher_suites( self, cipher_suites: &[SupportedCipherSuite], ) -> ConfigBuilder<S, WantsKxGroups>

Choose a specific set of cipher suites.

pub fn with_safe_default_cipher_suites(self) -> ConfigBuilder<S, WantsKxGroups>

Choose the default set of cipher suites (DEFAULT_CIPHER_SUITES).

Note that this default provides only high-quality suites: there is no need to filter out low-, export- or NULL-strength cipher suites: rustls does not implement these.

impl<S: ConfigSide> ConfigBuilder<S, WantsKxGroups>

pub fn with_kx_groups( self, kx_groups: &[&'static SupportedKxGroup], ) -> ConfigBuilder<S, WantsVersions>

Choose a specific set of key exchange groups.

pub fn with_safe_default_kx_groups(self) -> ConfigBuilder<S, WantsVersions>

Choose the default set of key exchange groups (ALL_KX_GROUPS).

This is a safe default: rustls doesn’t implement any poor-quality groups.

impl<S: ConfigSide> ConfigBuilder<S, WantsVersions>

pub fn with_safe_default_protocol_versions( self, ) -> Result<ConfigBuilder<S, WantsVerifier>, Error>

Accept the default protocol versions: both TLS1.2 and TLS1.3 are enabled.

pub fn with_protocol_versions( self, versions: &[&'static SupportedProtocolVersion], ) -> Result<ConfigBuilder<S, WantsVerifier>, Error>

Use a specific set of protocol versions.

impl ConfigBuilder<ClientConfig, WantsVerifier>

pub fn with_root_certificates( self, root_store: impl Into<Arc<RootCertStore>>, ) -> ConfigBuilder<ClientConfig, WantsTransparencyPolicyOrClientCert>

Choose how to verify server certificates.

pub fn with_custom_certificate_verifier( self, verifier: Arc<dyn ServerCertVerifier>, ) -> ConfigBuilder<ClientConfig, WantsClientCert>

Set a custom certificate verifier.

impl ConfigBuilder<ClientConfig, WantsTransparencyPolicyOrClientCert>

pub fn with_certificate_transparency_logs( self, logs: &'static [&'static Log<'_>], validation_deadline: SystemTime, ) -> ConfigBuilder<ClientConfig, WantsClientCert>

Set Certificate Transparency logs to use for server certificate validation.

Because Certificate Transparency logs are sharded on a per-year basis and can be trusted or distrusted relatively quickly, rustls stores a validation deadline. Server certificates will be validated against the configured CT logs until the deadline expires. After the deadline, certificates will no longer be validated, and a warning message will be logged. The deadline may vary depending on how often you deploy builds with updated dependencies.

pub fn with_client_auth_cert( self, cert_chain: Vec<Certificate>, key_der: PrivateKey, ) -> Result<ClientConfig, Error>

Sets a single certificate chain and matching private key for use in client authentication.

cert_chain is a vector of DER-encoded certificates. key_der is a DER-encoded RSA, ECDSA, or Ed25519 private key.

This function fails if key_der is invalid.

pub fn with_single_cert( self, cert_chain: Vec<Certificate>, key_der: PrivateKey, ) -> Result<ClientConfig, Error>

👎Deprecated since 0.21.4: Use with_client_auth_cert instead

Sets a single certificate chain and matching private key for use in client authentication.

cert_chain is a vector of DER-encoded certificates. key_der is a DER-encoded RSA, ECDSA, or Ed25519 private key.

This function fails if key_der is invalid.

pub fn with_no_client_auth(self) -> ClientConfig

Do not support client auth.

pub fn with_client_cert_resolver( self, client_auth_cert_resolver: Arc<dyn ResolvesClientCert>, ) -> ClientConfig

Sets a custom ResolvesClientCert.

impl ConfigBuilder<ClientConfig, WantsClientCert>

pub fn with_client_auth_cert( self, cert_chain: Vec<Certificate>, key_der: PrivateKey, ) -> Result<ClientConfig, Error>

Sets a single certificate chain and matching private key for use in client authentication.

cert_chain is a vector of DER-encoded certificates. key_der is a DER-encoded RSA, ECDSA, or Ed25519 private key.

This function fails if key_der is invalid.

pub fn with_single_cert( self, cert_chain: Vec<Certificate>, key_der: PrivateKey, ) -> Result<ClientConfig, Error>

👎Deprecated since 0.21.4: Use with_client_auth_cert instead

Sets a single certificate chain and matching private key for use in client authentication.

cert_chain is a vector of DER-encoded certificates. key_der is a DER-encoded RSA, ECDSA, or Ed25519 private key.

This function fails if key_der is invalid.

pub fn with_no_client_auth(self) -> ClientConfig

Do not support client auth.

pub fn with_client_cert_resolver( self, client_auth_cert_resolver: Arc<dyn ResolvesClientCert>, ) -> ClientConfig

Sets a custom ResolvesClientCert.

impl ConfigBuilder<ServerConfig, WantsVerifier>

pub fn with_client_cert_verifier( self, client_cert_verifier: Arc<dyn ClientCertVerifier>, ) -> ConfigBuilder<ServerConfig, WantsServerCert>

Choose how to verify client certificates.

pub fn with_no_client_auth(self) -> ConfigBuilder<ServerConfig, WantsServerCert>

Disable client authentication.

impl ConfigBuilder<ServerConfig, WantsServerCert>

pub fn with_single_cert( self, cert_chain: Vec<Certificate>, key_der: PrivateKey, ) -> Result<ServerConfig, Error>

Sets a single certificate chain and matching private key. This certificate and key is used for all subsequent connections, irrespective of things like SNI hostname.

Note that the end-entity certificate must have the Subject Alternative Name extension to describe, e.g., the valid DNS name. The commonName field is disregarded.

cert_chain is a vector of DER-encoded certificates. key_der is a DER-encoded RSA, ECDSA, or Ed25519 private key.

This function fails if key_der is invalid.

pub fn with_single_cert_with_ocsp_and_sct( self, cert_chain: Vec<Certificate>, key_der: PrivateKey, ocsp: Vec<u8>, scts: Vec<u8>, ) -> Result<ServerConfig, Error>

Sets a single certificate chain, matching private key, OCSP response and SCTs. This certificate and key is used for all subsequent connections, irrespective of things like SNI hostname.

cert_chain is a vector of DER-encoded certificates. key_der is a DER-encoded RSA, ECDSA, or Ed25519 private key. ocsp is a DER-encoded OCSP response. Ignored if zero length. scts is an SignedCertificateTimestampList encoding (see RFC6962) and is ignored if empty.

This function fails if key_der is invalid.

pub fn with_cert_resolver( self, cert_resolver: Arc<dyn ResolvesServerCert>, ) -> ServerConfig

Sets a custom ResolvesServerCert.

Trait Implementations

impl<Side: Clone + ConfigSide, State: Clone> Clone for ConfigBuilder<Side, State>

fn clone(&self) -> ConfigBuilder<Side, State>

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<Side: ConfigSide, State: Debug> Debug for ConfigBuilder<Side, State>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.