Conversation
|
I'd like to add an example in the |
| acceptor_builder.set_verify( | ||
| openssl::ssl::SslVerifyMode::PEER | openssl::ssl::SslVerifyMode::FAIL_IF_NO_PEER_CERT, | ||
| ); |
There was a problem hiding this comment.
It would be nice to offer this stuff as some easy to set up options on the server and the client in a follow-up, like tcp_tls::config::Server::default().enable_mtls() etc etc
Karrq
left a comment
Karrq
left a comment
There was a problem hiding this comment.
Cant say much about the overall functionality in the scope of the lib yet, but left some “style” comments
| let mut acceptor_builder = helpers::default_acceptor_builder(); | ||
| // By specifying peer verification mode, we essentially toggle mTLS. | ||
| acceptor_builder.set_verify( | ||
| openssl::ssl::SslVerifyMode::PEER | openssl::ssl::SslVerifyMode::FAIL_IF_NO_PEER_CERT, |
There was a problem hiding this comment.
For abstracting between tls backends we might want to expose a method to enable mtls, and have it manage how that’s done in openssl and rustls
|
IIRC rust docs include links to examples (and doc tests) if it finds the usage in the example code, so it can double as an example and also doc test |
mempirate
left a comment
mempirate
left a comment
There was a problem hiding this comment.
This works as a first iteration. What would be nice to add later:
- Easily configurable servers and clients for dangerous authentication (skipping server cert verification), client authentication. Basically stuff that wraps
SslAcceptorandSslConnectorconfiguration - #97
Also, I think we could feature-gate TLS as well since building it requires openssl installed. Could be enabled by default.
|
Also, I don't mind copied code if it can serve as an example @thedevbirb |
thedevbirb
force-pushed
the
lore/feat/mtls
branch
2 times, most recently
from
9a9d063 to
e71c543
Compare
thedevbirb
force-pushed
the
lore/feat/mtls
branch
from
e71c543 to
b0dadfa
Compare
thedevbirb
force-pushed
the
lore/feat/mtls
branch
from
b0dadfa to
97935bb
Compare
3 participants
Closes #92.
The code is unaware whether mTLS is enabled or not, that is configured in the TLS
Acceptors/Connectorsprovided.