Struct CaTlsConfig 

pub struct CaTlsConfig { /* private fields */ }

Configures the trusted CA root certificates for non-iroh TLS connections.

These roots are used whenever iroh establishes standard TLS connections to external services, such as iroh relays, pkarr servers, or DNS-over-HTTPS resolvers.

The configured Certificate Authority (CA) roots are only used for verifying the validity of TLS certificates presented by those external services. These CAs don’t need to be trusted for the integrity or authenticity of native iroh connections, which rely on iroh’s own cryptographic authentication mechanisms.

Implementations

impl CaTlsConfig

pub fn embedded() -> CaTlsConfig

Uses a compiled-in copy of the root certificates trusted by Mozilla.

See [webpki_roots] for details.

pub fn custom_roots( roots: impl IntoIterator<Item = CertificateDer<'static>>, ) -> CaTlsConfig

Only trusts the explicitly set root certificates.

pub fn custom( roots: impl IntoIterator<Item = CertificateDer<'static>>, ) -> CaTlsConfig

👎Deprecated since 1.0.0:

Renamed to custom_roots

Renamed to Self::custom_roots.

pub fn custom_server_cert_verifier( builder: Arc<dyn Fn(Arc<CryptoProvider>) -> Result<Arc<dyn ServerCertVerifier>, Error> + Send + Sync>, ) -> CaTlsConfig

Creates a CaTlsConfig that uses a callback function to create a [ServerCertVerifier].

This is an advanced feature and you should only use this if none of the other constructor functions cover your needs. Wrongly implementing the callback may lead to insecure connections being accepted.

The [CryptoProvider] passed to the callback should be used for all cryptographic operations.

Example

This example implements the behavior of Self::embedded via Self::custom_server_cert_verifier.

let tls_config = CaTlsConfig::custom_server_cert_verifier(Arc::new(move |crypto_provider| {
    let root_store = Arc::new(rustls::RootCertStore {
        roots: webpki_roots::TLS_SERVER_ROOTS.to_vec(),
    });
    let verifier = WebPkiServerVerifier::builder_with_provider(root_store, crypto_provider)
        .build()
        .map_err(io::Error::other)?;
    Ok(verifier)
}));

pub fn with_extra_roots( self, extra_roots: impl IntoIterator<Item = CertificateDer<'static>>, ) -> CaTlsConfig

Adds additional root certificates to the list of trusted certificates.

Ignored when using Self::custom_server_cert_verifier.

pub fn server_cert_verifier( &self, crypto_provider: Arc<CryptoProvider>, ) -> Result<Arc<dyn ServerCertVerifier>, Error>

Builds a [ServerCertVerifier] from this config.

pub fn client_config( &self, crypto_provider: Arc<CryptoProvider>, ) -> Result<ClientConfig, Error>

Builds a [ClientConfig] from this config.

Trait Implementations

impl Clone for CaTlsConfig

fn clone(&self) -> CaTlsConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CaTlsConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for CaTlsConfig

fn default() -> CaTlsConfig

Returns the “default value” for a type.