Struct TlsClientPolicyConfig 

#[non_exhaustive]
pub struct TlsClientPolicyConfig {
    pub crypto_provider: CryptoProviderConfig,
    pub allowed_versions: AllowedTlsVersionsConfig,
    pub certificate_verification: CertificateVerificationConfig,
    pub insecure: InsecureTlsClientConfig,
}

Configure the TLS policy for a client.

It covers:

• The cryptographic stack used to secure the connection.
• Which TLS versions are allowed.
• The certificate verification mechanism used to verify server certificates.

For testing/development purposes only, it exposes a few insecure configuration options that lower the security posture of your client.

Defaults

The default configuration should be suitable for most production environments:

# In YAML format
crypto_provider: aws_lc_rs
allowed_versions:
  v1_2: true
  v1_3: true
certificate_verification:
  use_os_verifier: true
  additional_roots: []
insecure:
  skip_verification: false

Overriding the default configuration

If you want to deviate from the default configuration, it’s enough to specify the fields you want to override.

Example: Disable TLS 1.2

# In YAML format
allowed_versions:
  v1_2: false

Example: Trust additional root certificates

# In YAML format
certificate_verification:
  additional_roots:
    - file:
        path: "/path/to/certificate.pem"
        encoding: "pem"
    - inline:
        data: |
          -----BEGIN CERTIFICATE-----
          MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
          -----END CERTIFICATE-----

Example: Disable certificate verification

# In YAML format
insecure:
  skip_verification: true

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

crypto_provider: CryptoProviderConfig

The cryptographic stack used to secure the connection.

Refer to the documentation for CryptoProviderConfig for more details.

allowed_versions: AllowedTlsVersionsConfig

Which TLS versions are allowed.

Refer to the documentation for AllowedTlsVersionsConfig for more details.

certificate_verification: CertificateVerificationConfig

The mechanism used to verify server certificates.

Refer to the documentation for CertificateVerificationConfig for more details.

insecure: InsecureTlsClientConfig

Dangerous configuration options that lower the security posture of your client.

These options should never be used in production scenarios. They are available for testing/development purposes only.

Implementations

impl TlsClientPolicyConfig

pub fn rustls_0_23_config(&self) -> Result<ClientConfig, Rustls023ConfigError>

Build a rustls::ClientConfig according to the specified configuration.

Trait Implementations

impl Clone for TlsClientPolicyConfig

fn clone(&self) -> TlsClientPolicyConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TlsClientPolicyConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for TlsClientPolicyConfig

fn default() -> TlsClientPolicyConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for TlsClientPolicyConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for TlsClientPolicyConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl TryFrom<&TlsClientPolicyConfig> for ClientConfig

type Error = Rustls023ConfigError

The type returned in the event of a conversion error.

fn try_from(value: &TlsClientPolicyConfig) -> Result<Self, Self::Error>

Performs the conversion.