Struct ClientTls 

pub struct ClientTls { /* private fields */ }

A client’s TLS trust: which server certificate(s) to accept. Use ClientTls::trusting to pin a specific self-signed server certificate.

Implementations

impl ClientTls

pub fn trusting(cert_der: Vec<u8>) -> Result<ClientTls, Error>

Trust the given certificate (DER bytes) as the one root: a self-signed server certificate, or a private CA’s certificate, rather than the public web PKI. It is a trust anchor, not a pin: a leaf issued by a CA does not verify against itself, and a CA here admits every certificate it issues for the name the client asks for.

pub fn trusting_pem(pem: &[u8]) -> Result<ClientTls, Error>

trusting for PEM: every certificate in pem becomes a trust anchor, so a private CA’s certificate, or a full chain pasted leaf-first, both work. This is how a service document carries a private trust root (tacenta-discovery’s private-ca mode).

pub async fn wrap<S>( &self, server_name: &str, stream: S, ) -> Result<impl AsyncRead + AsyncWrite + Unpin + Send + use<S>, Error>

where S: AsyncRead + AsyncWrite + Unpin + Send,

Wrap an already-connected stream in TLS to a server presenting server_name, under this trust. The four connect_tls paths and the gateway’s WebSocket carriage all reach TLS through here.

pub async fn wrap_tcp( &self, server_name: &str, tcp: TcpStream, ) -> Result<TlsStream<TcpStream>, Error>

wrap for a TCP stream, with the concrete TLS stream type, for a caller that stores it in an enum.

pub fn web_pki() -> ClientTls

Trust the public web PKI (Mozilla’s CA root store) — for connecting to a hosted server whose certificate is from a public CA such as Let’s Encrypt. This is the trust a client uses against tacenta.com.

Trait Implementations

impl Clone for ClientTls

fn clone(&self) -> ClientTls

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.