Struct CaTlsConfig 

pub struct CaTlsConfig { /* private fields */ }

Configures the trusted CA root certificates for non-iroh TLS connections.

These roots are used whenever iroh establishes standard TLS connections to external services, such as iroh relays, pkarr servers, or DNS-over-HTTPS resolvers.

The configured Certificate Authority (CA) roots are only used for verifying the validity of TLS certificates presented by those external services. These CAs don’t need to be trusted for the integrity or authenticity of native iroh connections, which rely on iroh’s own cryptographic authentication mechanisms.

Implementations

impl CaTlsConfig

pub fn system() -> Self

Available on crate feature platform-verifier only.

Uses the operating system’s certificate facilities for verifying the validity of TLS certificates.

See [rustls_platform_verifier] for details how trust anchors are retrieved on different platforms.

Note: Additional certificates added via Self::with_extra_roots will be ignored on Android due to missing support in [rustls].

pub fn embedded() -> Self

Uses a compiled-in copy of the root certificates trusted by Mozilla.

See [webpki_roots] for details.

pub fn insecure_skip_verify() -> Self

Available on crate features test-utils only.

INSECURE: Do not verify server certificates at all.

May only be used in tests or local development setups.

pub fn custom_roots( roots: impl IntoIterator<Item = CertificateDer<'static>>, ) -> Self

Only trusts the explicitly set root certificates.

pub fn custom(roots: impl IntoIterator<Item = CertificateDer<'static>>) -> Self

👎Deprecated since 1.0.0: Renamed to custom_roots

Renamed to Self::custom_roots.

pub fn custom_server_cert_verifier(builder: ServerCertVerifierBuilder) -> Self

Creates a CaTlsConfig that uses a callback function to create a [ServerCertVerifier].

This is an advanced feature and you should only use this if none of the other constructor functions cover your needs. Wrongly implementing the callback may lead to insecure connections being accepted.

The [CryptoProvider] passed to the callback should be used for all cryptographic operations.

Example

This example implements the behavior of Self::embedded via Self::custom_server_cert_verifier.

let tls_config = CaTlsConfig::custom_server_cert_verifier(Arc::new(move |crypto_provider| {
    let root_store = Arc::new(rustls::RootCertStore {
        roots: webpki_roots::TLS_SERVER_ROOTS.to_vec(),
    });
    let verifier = WebPkiServerVerifier::builder_with_provider(root_store, crypto_provider)
        .build()
        .map_err(io::Error::other)?;
    Ok(verifier)
}));

pub fn with_extra_roots( self, extra_roots: impl IntoIterator<Item = CertificateDer<'static>>, ) -> Self

Adds additional root certificates to the list of trusted certificates.

Ignored when using Self::custom_server_cert_verifier.

pub fn server_cert_verifier( &self, crypto_provider: Arc<CryptoProvider>, ) -> Result<Arc<dyn ServerCertVerifier>>

Builds a [ServerCertVerifier] from this config.

pub fn client_config( &self, crypto_provider: Arc<CryptoProvider>, ) -> Result<ClientConfig>

Builds a [ClientConfig] from this config.

Trait Implementations

impl Clone for CaTlsConfig

fn clone(&self) -> CaTlsConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CaTlsConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for CaTlsConfig

fn default() -> Self

Returns the “default value” for a type.