Struct TlsConfig 

pub struct TlsConfig {
    pub enabled: bool,
    pub cert_file: String,
    pub key_file: String,
    pub client_auth: ClientAuthMode,
    pub ca_file: String,
    pub min_protocol: String,
    pub max_protocol: String,
    pub ciphersuites: Vec<String>,
    pub ocsp_stapling: OcspStaplingConfig,
}

[tls] section — TLS configuration for the EST listener.

NIAP CA PP FTP_TRP.1 compliance

• TLS 1.2 is the minimum supported version; TLS 1.0 and 1.1 are rejected.
• Only AEAD cipher suites with forward secrecy (ECDHE/DHE key exchange) are permitted.
• The default cipher suite list excludes CBC-mode suites and static RSA key exchange.

Fields

enabled: bool

Enable TLS on the EST listener. Default: false.

When false, the server listens in plain HTTP mode (intended only for development behind a TLS-terminating reverse proxy).

cert_file: String

Path to the server certificate chain in PEM format.

The file MUST contain the server’s end-entity certificate first, followed by any intermediate CA certificates.

key_file: String

Path to the server private key in PEM format.

client_auth: ClientAuthMode

Client certificate authentication mode.

• required — mTLS is mandatory; unauthenticated clients are rejected at the TLS layer.
• optional (default) — the server requests a client certificate but accepts connections without one. EST enrollment can fall back to HTTP-layer authentication (OTP, HTTP Basic, etc.).
• none — no client certificate is requested.

ca_file: String

Path to the CA certificate bundle (PEM) for validating EST client certificates.

RHELBU-3536 R18: this truststore is dedicated to the EST listener. Admin operator mTLS uses a separate truststore configured in [admin].

min_protocol: String

Minimum TLS protocol version.

NIAP CA PP FTP_TRP.1: must be "1.2" or "1.3". Default: "1.2".

max_protocol: String

Maximum TLS protocol version.

Default: "1.3".

ciphersuites: Vec<String>

Allowed cipher suites (IANA names).

When empty, the server uses the rustls default selection which already satisfies FTP_TRP.1 (AEAD + forward secrecy only).

Example:

ciphersuites = [
    "TLS_AES_256_GCM_SHA384",
    "TLS_AES_128_GCM_SHA256",
    "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
    "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
]

ocsp_stapling: OcspStaplingConfig

OCSP stapling configuration (RFC 7633 / RFC 6066 Section 8).

When the server’s TLS certificate contains the TLS Feature Extension (must-staple, OID 1.3.6.1.5.5.7.1.24), OCSP stapling MUST be enabled to satisfy RFC 7633 Section 4 requirements. Clients that understand must-staple will abort the handshake if no stapled OCSP response is provided.

Even without must-staple, enabling OCSP stapling improves TLS handshake performance by eliminating the client-side OCSP lookup.

Implementations

impl TlsConfig

pub fn validate(&self) -> Result<(), String>

Validate TLS configuration constraints.

Trait Implementations

impl Clone for TlsConfig

fn clone(&self) -> TlsConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TlsConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for TlsConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for TlsConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.