Type Alias TlsServerConfig 

pub type TlsServerConfig = ServerConfig;

Alias of crate::tls::rustls::ServerConfig.

Aliased Type

pub struct TlsServerConfig {

    pub ignore_client_order: bool,
    pub max_fragment_size: Option<usize>,
    pub session_storage: Arc<dyn StoresServerSessions>,
    pub ticketer: Arc<dyn ProducesTickets>,
    pub cert_resolver: Arc<dyn ResolvesServerCert>,
    pub alpn_protocols: Vec<Vec<u8>>,
    pub key_log: Arc<dyn KeyLog>,
    pub enable_secret_extraction: bool,
    pub max_early_data_size: u32,
    pub send_half_rtt_data: bool,
    pub send_tls13_tickets: usize,
    pub time_provider: Arc<dyn TimeProvider>,
    pub cert_compressors: Vec<&'static dyn CertCompressor>,
    pub cert_compression_cache: Arc<CompressionCache>,
    pub cert_decompressors: Vec<&'static dyn CertDecompressor>,
    /* private fields */
}

Fields

ignore_client_order: bool

Ignore the client’s ciphersuite order. Instead, choose the top ciphersuite in the server list which is supported by the client.

max_fragment_size: Option<usize>

The maximum size of plaintext input to be emitted in a single TLS record. A value of None is equivalent to the TLS maximum of 16 kB.

rustls enforces an arbitrary minimum of 32 bytes for this field. Out of range values are reported as errors from ServerConnection::new.

Setting this value to a little less than the TCP MSS may improve latency for stream-y workloads.

session_storage: Arc<dyn StoresServerSessions>

How to store client sessions.

See [ServerConfig#sharing-resumption-storage-between-serverconfigs] for a warning related to this field.

ticketer: Arc<dyn ProducesTickets>

How to produce tickets.

See [ServerConfig#sharing-resumption-storage-between-serverconfigs] for a warning related to this field.

cert_resolver: Arc<dyn ResolvesServerCert>

How to choose a server cert and key. This is usually set by [ConfigBuilder::with_single_cert] or [ConfigBuilder::with_cert_resolver]. For async applications, see also [Acceptor].

alpn_protocols: Vec<Vec<u8>>

Protocol names we support, most preferred first. If empty we don’t do ALPN at all.

key_log: Arc<dyn KeyLog>

How to output key material for debugging. The default does nothing.

enable_secret_extraction: bool

Allows traffic secrets to be extracted after the handshake, e.g. for kTLS setup.

max_early_data_size: u32

Amount of early data to accept for sessions created by this config. Specify 0 to disable early data. The default is 0.

Read the early data via [ServerConnection::early_data].

The units for this are both plaintext bytes, and ciphertext bytes, depending on whether the server accepts a client’s early_data or not. It is therefore recommended to include some slop in this value to account for the unknown amount of ciphertext expansion in the latter case.

send_half_rtt_data: bool

Whether the server should send “0.5RTT” data. This means the server sends data after its first flight of handshake messages, without waiting for the client to complete the handshake.

This can improve TTFB latency for either server-speaks-first protocols, or client-speaks-first protocols when paired with “0RTT” data. This comes at the cost of a subtle weakening of the normal handshake integrity guarantees that TLS provides. Note that the initial ClientHello is indirectly authenticated because it is included in the transcript used to derive the keys used to encrypt the data.

This only applies to TLS1.3 connections. TLS1.2 connections cannot do this optimisation and this setting is ignored for them. It is also ignored for TLS1.3 connections that even attempt client authentication.

This defaults to false. This means the first application data sent by the server comes after receiving and validating the client’s handshake up to the Finished message. This is the safest option.

send_tls13_tickets: usize

How many TLS1.3 tickets to send immediately after a successful handshake.

Because TLS1.3 tickets are single-use, this allows a client to perform multiple resumptions.

The default is 2.

If this is 0, no tickets are sent and clients will not be able to do any resumption.

time_provider: Arc<dyn TimeProvider>

Provides the current system time

cert_compressors: Vec<&'static dyn CertCompressor>

How to compress the server’s certificate chain.

If a client supports this extension, and advertises support for one of the compression algorithms included here, the server certificate will be compressed according to RFC8779.

This only applies to TLS1.3 connections. It is ignored for TLS1.2 connections.

cert_compression_cache: Arc<CompressionCache>

Caching for compressed certificates.

This is optional: [compress::CompressionCache::Disabled] gives a cache that does no caching.

cert_decompressors: Vec<&'static dyn CertDecompressor>

How to decompress the clients’s certificate chain.

If this is non-empty, the RFC8779 certificate compression extension is offered when requesting client authentication, and any compressed certificates are transparently decompressed during the handshake.

This only applies to TLS1.3 connections. It is ignored for TLS1.2 connections.