OxL Reference
EnglishРусский

data TlsConfig

TLS options for both roles; only the fields that apply to the role are used.

  • client: ca / caPem (trust anchors; default: the system roots), serverName (SNI and certificate name; default: the host or address connected to), alpn (offered protocols), cert / key (client certificate for mutual TLS), pin (hex SHA-256 of the server's leaf certificate, checked in addition to the chain; with insecureSkipVerify it alone authenticates the server), verifyHostname, insecureSkipVerify (tests only: the server is not authenticated), minVersion / maxVersion (12 or 13).
  • server: cert + key (PEM files; cert holds the leaf followed by intermediates) or certPem + keyPem (PEM text), keyPassword, alpn (supported protocols in preference order; a client offering none of them is refused), clientAuth with ca / caPem for the client certificate authorities, minVersion / maxVersion.

Example:

oxl✓ checked in CI
use std.net { TlsConfig }

fn client() -> TlsConfig {
  // trust a private CA instead of the system roots and offer HTTP/2
  TlsConfig{ ca: "ca.pem", alpn: ["h2", "http/1.1"] }
}
@derive(Eq)
pub(api) data TlsConfig

Since. 1.0.0-beta

Fields

pub(api) ca: str = ""

File with the certificate authorities to trust (instead of the system roots).

pub(api) caPem: str = ""

Trust anchors as PEM text.

pub(api) cert: str = ""

Certificate chain file (a server's, or a client's for mutual TLS).

pub(api) key: str = ""

Private key file of cert.

pub(api) certPem: str = ""

Certificate chain as PEM text.

pub(api) keyPem: str = ""

Private key as PEM text.

pub(api) keyPassword: str = ""

Password of an encrypted private key.

pub(api) alpn: List<str> = []

Application protocols to offer (client) or accept (server), in order of preference.

pub(api) serverName: str = ""

Name to send in SNI and check in the certificate; defaults to the host.

pub(api) pin: str = ""

Hex SHA-256 of the peer's leaf certificate to require.

pub(api) insecureSkipVerify: bool = false

Skip certificate verification (tests only).

pub(api) verifyHostname: bool = true

Check that the certificate names the host.

pub(api) clientAuth: ClientAuth = ClientAuth.Off

Server: whether to ask clients for a certificate.

pub(api) minVersion: i64 = 12

Lowest TLS version: 12 or 13.

pub(api) maxVersion: i64 = 13

Highest TLS version: 12 or 13.

Defined in: std/net/tls.oxl:91

See also