pub struct SslConnectorBuilder(/* private fields */);
Expand description
A builder for SslConnector
s.
Implementations§
Source§impl SslConnectorBuilder
impl SslConnectorBuilder
Sourcepub fn build(self) -> SslConnector
pub fn build(self) -> SslConnector
Consumes the builder, returning an SslConnector
.
Methods from Deref<Target = SslContextBuilder>§
Sourcepub fn set_async_select_certificate_callback<F>(&mut self, callback: F)where
F: Fn(&mut ClientHello<'_>) -> Result<Pin<Box<dyn Future<Output = Result<Box<dyn FnOnce(ClientHello<'_>) -> Result<(), AsyncSelectCertError>>, AsyncSelectCertError>> + Send>>, AsyncSelectCertError> + Send + Sync + 'static,
pub fn set_async_select_certificate_callback<F>(&mut self, callback: F)where
F: Fn(&mut ClientHello<'_>) -> Result<Pin<Box<dyn Future<Output = Result<Box<dyn FnOnce(ClientHello<'_>) -> Result<(), AsyncSelectCertError>>, AsyncSelectCertError>> + Send>>, AsyncSelectCertError> + Send + Sync + 'static,
Sets a callback that is called before most ClientHello
processing
and before the decision whether to resume a session is made. The
callback may inspect the ClientHello
and configure the connection.
This method uses a function that returns a future whose output is
itself a closure that will be passed ClientHello
to configure
the connection based on the computations done in the future.
A task waker must be set on Ssl
values associated with the resulting
SslContext
with SslRef::set_task_waker
.
See SslContextBuilder::set_select_certificate_callback
for the sync
setter of this callback.
Sourcepub fn set_async_private_key_method(
&mut self,
method: impl AsyncPrivateKeyMethod,
)
pub fn set_async_private_key_method( &mut self, method: impl AsyncPrivateKeyMethod, )
Configures a custom private key method on the context.
A task waker must be set on Ssl
values associated with the resulting
SslContext
with SslRef::set_task_waker
.
See AsyncPrivateKeyMethod
for more details.
Sourcepub unsafe fn set_async_get_session_callback<F>(&mut self, callback: F)
pub unsafe fn set_async_get_session_callback<F>(&mut self, callback: F)
Sets a callback that is called when a client proposed to resume a session but it was not found in the internal cache.
The callback is passed a reference to the session ID provided by the client. It should return the session corresponding to that ID if available. This is only used for servers, not clients.
A task waker must be set on Ssl
values associated with the resulting
SslContext
with SslRef::set_task_waker
.
See SslContextBuilder::set_get_session_callback
for the sync setter
of this callback.
§Safety
The returned SslSession
must not be associated with a different [SslContext
].
Sourcepub fn set_async_custom_verify_callback<F>(
&mut self,
mode: SslVerifyMode,
callback: F,
)
pub fn set_async_custom_verify_callback<F>( &mut self, mode: SslVerifyMode, callback: F, )
Configures certificate verification.
The callback should return Ok(())
if the certificate is valid.
If the certificate is invalid, the callback should return SslVerifyError::Invalid(alert)
.
Some useful alerts include SslAlert::CERTIFICATE_EXPIRED
, SslAlert::CERTIFICATE_REVOKED
,
SslAlert::UNKNOWN_CA
, SslAlert::BAD_CERTIFICATE
, SslAlert::CERTIFICATE_UNKNOWN
,
and SslAlert::INTERNAL_ERROR
. See RFC 5246 section 7.2.2 for their precise meanings.
A task waker must be set on Ssl
values associated with the resulting
SslContext
with SslRef::set_task_waker
.
See SslContextBuilder::set_custom_verify_callback
for the sync version of this method.
§Panics
This method panics if this Ssl
is associated with a RPK context.
Sourcepub fn as_ptr(&self) -> *mut ssl_ctx_st
pub fn as_ptr(&self) -> *mut ssl_ctx_st
Returns a pointer to the raw OpenSSL value.
Sourcepub fn set_verify(&mut self, mode: SslVerifyMode)
pub fn set_verify(&mut self, mode: SslVerifyMode)
Configures the certificate verification method for new connections.
This corresponds to SSL_CTX_set_verify
.
Sourcepub fn set_verify_callback<F>(&mut self, mode: SslVerifyMode, callback: F)
pub fn set_verify_callback<F>(&mut self, mode: SslVerifyMode, callback: F)
Configures the certificate verification method for new connections and registers a verification callback.
Warning: This callback does not replace the default certificate verification process and is, instead, called multiple times in the course of that process. It is very difficult to implement this callback correctly, without inadvertently relying on implementation details or making incorrect assumptions about when the callback is called.
Instead, use SslContextBuilder::set_custom_verify_callback
to customize certificate verification.
Those callbacks can inspect the peer-sent chain, call X509StoreContextRef::verify_cert
and inspect the result, or perform other operations more straightforwardly.
§Panics
This method panics if this Ssl
is associated with a RPK context.
This corresponds to SSL_CTX_set_verify
.
Sourcepub fn set_custom_verify_callback<F>(
&mut self,
mode: SslVerifyMode,
callback: F,
)
pub fn set_custom_verify_callback<F>( &mut self, mode: SslVerifyMode, callback: F, )
Configures certificate verification.
The callback should return Ok(())
if the certificate is valid.
If the certificate is invalid, the callback should return SslVerifyError::Invalid(alert)
.
Some useful alerts include SslAlert::CERTIFICATE_EXPIRED
, SslAlert::CERTIFICATE_REVOKED
,
SslAlert::UNKNOWN_CA
, SslAlert::BAD_CERTIFICATE
, SslAlert::CERTIFICATE_UNKNOWN
,
and SslAlert::INTERNAL_ERROR
. See RFC 5246 section 7.2.2 for their precise meanings.
To verify a certificate asynchronously, the callback may return Err(SslVerifyError::Retry)
.
The handshake will then pause with an error with code ErrorCode::WANT_CERTIFICATE_VERIFY
.
§Panics
This method panics if this Ssl
is associated with a RPK context.
This corresponds to SSL_CTX_set_custom_verify
.
Sourcepub fn set_servername_callback<F>(&mut self, callback: F)
pub fn set_servername_callback<F>(&mut self, callback: F)
Configures the server name indication (SNI) callback for new connections.
SNI is used to allow a single server to handle requests for multiple domains, each of which has its own certificate chain and configuration.
Obtain the server name with the servername
method and then set the corresponding context
with set_ssl_context
This corresponds to SSL_CTX_set_tlsext_servername_callback
.
Sourcepub fn set_verify_depth(&mut self, depth: u32)
pub fn set_verify_depth(&mut self, depth: u32)
Sets the certificate verification depth.
If the peer’s certificate chain is longer than this value, verification will fail.
This corresponds to SSL_CTX_set_verify_depth
.
Sourcepub fn set_verify_cert_store(
&mut self,
cert_store: X509Store,
) -> Result<(), ErrorStack>
pub fn set_verify_cert_store( &mut self, cert_store: X509Store, ) -> Result<(), ErrorStack>
Sets a custom certificate store for verifying peer certificates.
This corresponds to SSL_CTX_set0_verify_cert_store
.
Sourcepub fn set_cert_store(&mut self, cert_store: X509Store)
pub fn set_cert_store(&mut self, cert_store: X509Store)
Replaces the context’s certificate store.
This corresponds to SSL_CTX_set_cert_store
.
Sourcepub fn set_read_ahead(&mut self, read_ahead: bool)
pub fn set_read_ahead(&mut self, read_ahead: bool)
Controls read ahead behavior.
If enabled, OpenSSL will read as much data as is available from the underlying stream, instead of a single record at a time.
It has no effect when used with DTLS.
This corresponds to SSL_CTX_set_read_ahead
.
Sourcepub fn set_mode(&mut self, mode: SslMode) -> SslMode
pub fn set_mode(&mut self, mode: SslMode) -> SslMode
Sets the mode used by the context, returning the new bit-mask after adding mode.
This corresponds to SSL_CTX_set_mode
.
Sourcepub fn set_tmp_dh(&mut self, dh: &DhRef<Params>) -> Result<(), ErrorStack>
pub fn set_tmp_dh(&mut self, dh: &DhRef<Params>) -> Result<(), ErrorStack>
Sets the parameters to be used during ephemeral Diffie-Hellman key exchange.
This corresponds to SSL_CTX_set_tmp_dh
.
Sourcepub fn set_tmp_ecdh(&mut self, key: &EcKeyRef<Params>) -> Result<(), ErrorStack>
pub fn set_tmp_ecdh(&mut self, key: &EcKeyRef<Params>) -> Result<(), ErrorStack>
Sets the parameters to be used during ephemeral elliptic curve Diffie-Hellman key exchange.
This corresponds to SSL_CTX_set_tmp_ecdh
.
Sourcepub fn set_default_verify_paths(&mut self) -> Result<(), ErrorStack>
pub fn set_default_verify_paths(&mut self) -> Result<(), ErrorStack>
Use the default locations of trusted certificates for verification.
These locations are read from the SSL_CERT_FILE
and SSL_CERT_DIR
environment variables
if present, or defaults specified at OpenSSL build time otherwise.
This corresponds to SSL_CTX_set_default_verify_paths
.
Sourcepub fn set_ca_file<P>(&mut self, file: P) -> Result<(), ErrorStack>
pub fn set_ca_file<P>(&mut self, file: P) -> Result<(), ErrorStack>
Loads trusted root certificates from a file.
The file should contain a sequence of PEM-formatted CA certificates.
This corresponds to SSL_CTX_load_verify_locations
.
Sourcepub fn set_client_ca_list(&mut self, list: Stack<X509Name>)
pub fn set_client_ca_list(&mut self, list: Stack<X509Name>)
Sets the list of CA names sent to the client.
The CA certificates must still be added to the trust root - they are not automatically set as trusted by this method.
This corresponds to SSL_CTX_set_client_CA_list
.
Sourcepub fn add_client_ca(&mut self, cacert: &X509Ref) -> Result<(), ErrorStack>
pub fn add_client_ca(&mut self, cacert: &X509Ref) -> Result<(), ErrorStack>
Add the provided CA certificate to the list sent by the server to the client when requesting client-side TLS authentication.
This corresponds to SSL_CTX_add_client_CA
.
Sourcepub fn set_session_id_context(
&mut self,
sid_ctx: &[u8],
) -> Result<(), ErrorStack>
pub fn set_session_id_context( &mut self, sid_ctx: &[u8], ) -> Result<(), ErrorStack>
Set the context identifier for sessions.
This value identifies the server’s session cache to clients, telling them when they’re able to reuse sessions. It should be set to a unique value per server, unless multiple servers share a session cache.
This value should be set when using client certificates, or each request will fail its handshake and need to be restarted.
This corresponds to SSL_CTX_set_session_id_context
.
Sourcepub fn set_certificate_file<P>(
&mut self,
file: P,
file_type: SslFiletype,
) -> Result<(), ErrorStack>
pub fn set_certificate_file<P>( &mut self, file: P, file_type: SslFiletype, ) -> Result<(), ErrorStack>
Loads a leaf certificate from a file.
Only a single certificate will be loaded - use add_extra_chain_cert
to add the remainder
of the certificate chain, or set_certificate_chain_file
to load the entire chain from a
single file.
This corresponds to SSL_CTX_use_certificate_file
.
Sourcepub fn set_certificate_chain_file<P>(
&mut self,
file: P,
) -> Result<(), ErrorStack>
pub fn set_certificate_chain_file<P>( &mut self, file: P, ) -> Result<(), ErrorStack>
Loads a certificate chain from a file.
The file should contain a sequence of PEM-formatted certificates, the first being the leaf certificate, and the remainder forming the chain of certificates up to and including the trusted root certificate.
This corresponds to SSL_CTX_use_certificate_chain_file
.
Sourcepub fn set_certificate(&mut self, cert: &X509Ref) -> Result<(), ErrorStack>
pub fn set_certificate(&mut self, cert: &X509Ref) -> Result<(), ErrorStack>
Sets the leaf certificate.
Use add_extra_chain_cert
to add the remainder of the certificate chain.
This corresponds to SSL_CTX_use_certificate
.
Sourcepub fn add_extra_chain_cert(&mut self, cert: X509) -> Result<(), ErrorStack>
pub fn add_extra_chain_cert(&mut self, cert: X509) -> Result<(), ErrorStack>
Appends a certificate to the certificate chain.
This chain should contain all certificates necessary to go from the certificate specified by
set_certificate
to a trusted root.
This corresponds to SSL_CTX_add_extra_chain_cert
.
Sourcepub fn set_private_key_file<P>(
&mut self,
file: P,
file_type: SslFiletype,
) -> Result<(), ErrorStack>
pub fn set_private_key_file<P>( &mut self, file: P, file_type: SslFiletype, ) -> Result<(), ErrorStack>
Loads the private key from a file.
This corresponds to SSL_CTX_use_PrivateKey_file
.
Sourcepub fn set_private_key<T>(&mut self, key: &PKeyRef<T>) -> Result<(), ErrorStack>where
T: HasPrivate,
pub fn set_private_key<T>(&mut self, key: &PKeyRef<T>) -> Result<(), ErrorStack>where
T: HasPrivate,
Sets the private key.
This corresponds to SSL_CTX_use_PrivateKey
.
Sourcepub fn set_cipher_list(&mut self, cipher_list: &str) -> Result<(), ErrorStack>
pub fn set_cipher_list(&mut self, cipher_list: &str) -> Result<(), ErrorStack>
Sets the list of supported ciphers for protocols before TLSv1.3.
The set_ciphersuites
method controls the cipher suites for TLSv1.3 in OpenSSL.
BoringSSL doesn’t implement set_ciphersuites
.
See https://github.com/google/boringssl/blob/master/include/openssl/ssl.h#L1542-L1544
See ciphers
for details on the format.
This corresponds to SSL_CTX_set_cipher_list
.
Sourcepub fn ciphers(&self) -> Option<&StackRef<SslCipher>>
pub fn ciphers(&self) -> Option<&StackRef<SslCipher>>
Gets the list of supported ciphers for protocols before TLSv1.3.
See ciphers
for details on the format
This corresponds to SSL_CTX_get_ciphers
.
Sourcepub fn set_options(&mut self, option: SslOptions) -> SslOptions
pub fn set_options(&mut self, option: SslOptions) -> SslOptions
Sets the options used by the context, returning the old set.
§Note
This enables the specified options, but does not disable unspecified options. Use
clear_options
for that.
This corresponds to SSL_CTX_set_options
.
Sourcepub fn options(&self) -> SslOptions
pub fn options(&self) -> SslOptions
Returns the options used by the context.
This corresponds to SSL_CTX_get_options
.
Sourcepub fn clear_options(&mut self, option: SslOptions) -> SslOptions
pub fn clear_options(&mut self, option: SslOptions) -> SslOptions
Clears the options used by the context, returning the old set.
This corresponds to SSL_CTX_clear_options
.
Sourcepub fn set_min_proto_version(
&mut self,
version: Option<SslVersion>,
) -> Result<(), ErrorStack>
pub fn set_min_proto_version( &mut self, version: Option<SslVersion>, ) -> Result<(), ErrorStack>
Sets the minimum supported protocol version.
If version is None
, the default minimum version is used. For BoringSSL this defaults to
TLS 1.0.
This corresponds to SSL_CTX_set_min_proto_version
.
Sourcepub fn set_max_proto_version(
&mut self,
version: Option<SslVersion>,
) -> Result<(), ErrorStack>
pub fn set_max_proto_version( &mut self, version: Option<SslVersion>, ) -> Result<(), ErrorStack>
Sets the maximum supported protocol version.
If version is None
, the default maximum version is used. For BoringSSL this is TLS 1.3.
This corresponds to SSL_CTX_set_max_proto_version
.
Sourcepub fn min_proto_version(&mut self) -> Option<SslVersion>
pub fn min_proto_version(&mut self) -> Option<SslVersion>
Gets the minimum supported protocol version.
This corresponds to SSL_CTX_get_min_proto_version
.
Sourcepub fn max_proto_version(&mut self) -> Option<SslVersion>
pub fn max_proto_version(&mut self) -> Option<SslVersion>
Gets the maximum supported protocol version.
This corresponds to SSL_CTX_get_max_proto_version
.
Sourcepub fn set_alpn_protos(&mut self, protocols: &[u8]) -> Result<(), ErrorStack>
pub fn set_alpn_protos(&mut self, protocols: &[u8]) -> Result<(), ErrorStack>
Sets the protocols to sent to the server for Application Layer Protocol Negotiation (ALPN).
The input must be in ALPN “wire format”. It consists of a sequence of supported protocol
names prefixed by their byte length. For example, the protocol list consisting of spdy/1
and http/1.1
is encoded as b"\x06spdy/1\x08http/1.1"
. The protocols are ordered by
preference.
This corresponds to SSL_CTX_set_alpn_protos
.
Sourcepub fn set_tlsext_use_srtp(&mut self, protocols: &str) -> Result<(), ErrorStack>
pub fn set_tlsext_use_srtp(&mut self, protocols: &str) -> Result<(), ErrorStack>
Enables the DTLS extension “use_srtp” as defined in RFC5764.
This corresponds to SSL_CTX_set_tlsext_use_srtp
.
Sourcepub fn set_alpn_select_callback<F>(&mut self, callback: F)
pub fn set_alpn_select_callback<F>(&mut self, callback: F)
Sets the callback used by a server to select a protocol for Application Layer Protocol Negotiation (ALPN).
The callback is provided with the client’s protocol list in ALPN wire format. See the
documentation for SslContextBuilder::set_alpn_protos
for details. It should return one
of those protocols on success. The select_next_proto
function implements the standard
protocol selection algorithm.
This corresponds to SSL_CTX_set_alpn_select_cb
.
Sourcepub fn set_select_certificate_callback<F>(&mut self, callback: F)
pub fn set_select_certificate_callback<F>(&mut self, callback: F)
Sets a callback that is called before most ClientHello processing and before the decision whether to resume a session is made. The callback may inspect the ClientHello and configure the connection.
This corresponds to SSL_CTX_set_select_certificate_cb
.
Sourcepub fn set_private_key_method<M>(&mut self, method: M)where
M: PrivateKeyMethod,
pub fn set_private_key_method<M>(&mut self, method: M)where
M: PrivateKeyMethod,
Configures a custom private key method on the context.
See PrivateKeyMethod
for more details.
This corresponds to SSL_CTX_set_private_key_method
.
Sourcepub fn check_private_key(&self) -> Result<(), ErrorStack>
pub fn check_private_key(&self) -> Result<(), ErrorStack>
Checks for consistency between the private key and certificate.
This corresponds to SSL_CTX_check_private_key
.
Sourcepub fn cert_store(&self) -> &X509StoreBuilderRef
pub fn cert_store(&self) -> &X509StoreBuilderRef
Returns a shared reference to the context’s certificate store.
This corresponds to SSL_CTX_get_cert_store
.
Sourcepub fn cert_store_mut(&mut self) -> &mut X509StoreBuilderRef
pub fn cert_store_mut(&mut self) -> &mut X509StoreBuilderRef
Returns a mutable reference to the context’s certificate store.
This corresponds to SSL_CTX_get_cert_store
.
Sourcepub fn set_status_callback<F>(&mut self, callback: F) -> Result<(), ErrorStack>
pub fn set_status_callback<F>(&mut self, callback: F) -> Result<(), ErrorStack>
Sets the callback dealing with OCSP stapling.
On the client side, this callback is responsible for validating the OCSP status response
returned by the server. The status may be retrieved with the SslRef::ocsp_status
method.
A response of Ok(true)
indicates that the OCSP status is valid, and a response of
Ok(false)
indicates that the OCSP status is invalid and the handshake should be
terminated.
On the server side, this callback is resopnsible for setting the OCSP status response to be
returned to clients. The status may be set with the SslRef::set_ocsp_status
method. A
response of Ok(true)
indicates that the OCSP status should be returned to the client, and
Ok(false)
indicates that the status should not be returned to the client.
This corresponds to SSL_CTX_set_tlsext_status_cb
.
Sourcepub fn set_psk_client_callback<F>(&mut self, callback: F)
pub fn set_psk_client_callback<F>(&mut self, callback: F)
Sets the callback for providing an identity and pre-shared key for a TLS-PSK client.
The callback will be called with the SSL context, an identity hint if one was provided by the server, a mutable slice for each of the identity and pre-shared key bytes. The identity must be written as a null-terminated C string.
This corresponds to SSL_CTX_set_psk_client_callback
.
pub fn set_psk_callback<F>(&mut self, callback: F)
set_psk_client_callback
Sourcepub fn set_psk_server_callback<F>(&mut self, callback: F)
pub fn set_psk_server_callback<F>(&mut self, callback: F)
Sets the callback for providing an identity and pre-shared key for a TLS-PSK server.
The callback will be called with the SSL context, an identity provided by the client, and, a mutable slice for the pre-shared key bytes. The callback returns the number of bytes in the pre-shared key.
This corresponds to SSL_CTX_set_psk_server_callback
.
Sourcepub fn set_new_session_callback<F>(&mut self, callback: F)
pub fn set_new_session_callback<F>(&mut self, callback: F)
Sets the callback which is called when new sessions are negotiated.
This can be used by clients to implement session caching. While in TLSv1.2 the session is
available to access via SslRef::session
immediately after the handshake completes, this
is not the case for TLSv1.3. There, a session is not generally available immediately, and
the server may provide multiple session tokens to the client over a single session. The new
session callback is a portable way to deal with both cases.
Note that session caching must be enabled for the callback to be invoked, and it defaults
off for clients. set_session_cache_mode
controls that behavior.
This corresponds to SSL_CTX_sess_set_new_cb
.
Sourcepub fn set_remove_session_callback<F>(&mut self, callback: F)
pub fn set_remove_session_callback<F>(&mut self, callback: F)
Sets the callback which is called when sessions are removed from the context.
Sessions can be removed because they have timed out or because they are considered faulty.
This corresponds to SSL_CTX_sess_set_remove_cb
.
Sourcepub unsafe fn set_get_session_callback<F>(&mut self, callback: F)where
F: Fn(&mut SslRef, &[u8]) -> Result<Option<SslSession>, GetSessionPendingError> + 'static + Sync + Send,
pub unsafe fn set_get_session_callback<F>(&mut self, callback: F)where
F: Fn(&mut SslRef, &[u8]) -> Result<Option<SslSession>, GetSessionPendingError> + 'static + Sync + Send,
Sets the callback which is called when a client proposed to resume a session but it was not found in the internal cache.
The callback is passed a reference to the session ID provided by the client. It should return the session corresponding to that ID if available. This is only used for servers, not clients.
§Safety
The returned SslSession
must not be associated with a different SslContext
.
This corresponds to SSL_CTX_sess_set_get_cb
.
Sourcepub fn set_keylog_callback<F>(&mut self, callback: F)
pub fn set_keylog_callback<F>(&mut self, callback: F)
Sets the TLS key logging callback.
The callback is invoked whenever TLS key material is generated, and is passed a line of NSS SSLKEYLOGFILE-formatted text. This can be used by tools like Wireshark to decrypt message traffic. The line does not contain a trailing newline.
This corresponds to SSL_CTX_set_keylog_callback
.
Sourcepub fn set_session_cache_mode(
&mut self,
mode: SslSessionCacheMode,
) -> SslSessionCacheMode
pub fn set_session_cache_mode( &mut self, mode: SslSessionCacheMode, ) -> SslSessionCacheMode
Sets the session caching mode use for connections made with the context.
Returns the previous session caching mode.
This corresponds to SSL_CTX_set_session_cache_mode
.
Sourcepub fn set_ex_data<T>(&mut self, index: Index<SslContext, T>, data: T)
pub fn set_ex_data<T>(&mut self, index: Index<SslContext, T>, data: T)
Sets the extra data at the specified index.
This can be used to provide data to callbacks registered with the context. Use the
SslContext::new_ex_index
method to create an Index
.
Note that if this method is called multiple times with the same index, any previous
value stored in the SslContextBuilder
will be leaked.
This corresponds to SSL_CTX_set_ex_data
.
Sourcepub fn replace_ex_data<T>(
&mut self,
index: Index<SslContext, T>,
data: T,
) -> Option<T>
pub fn replace_ex_data<T>( &mut self, index: Index<SslContext, T>, data: T, ) -> Option<T>
Sets or overwrites the extra data at the specified index.
This can be used to provide data to callbacks registered with the context. Use the
Ssl::new_ex_index
method to create an Index
.
Any previous value will be returned and replaced by the new one.
This corresponds to SSL_CTX_set_ex_data
.
Sourcepub fn set_session_cache_size(&mut self, size: u32) -> u64
pub fn set_session_cache_size(&mut self, size: u32) -> u64
Sets the context’s session cache size limit, returning the previous limit.
A value of 0 means that the cache size is unbounded.
This corresponds to SSL_CTX_sess_set_cache_size
.
Sourcepub fn set_sigalgs_list(&mut self, sigalgs: &str) -> Result<(), ErrorStack>
pub fn set_sigalgs_list(&mut self, sigalgs: &str) -> Result<(), ErrorStack>
Sets the context’s supported signature algorithms.
This corresponds to SSL_CTX_set1_sigalgs_list
.
Sourcepub fn set_grease_enabled(&mut self, enabled: bool)
pub fn set_grease_enabled(&mut self, enabled: bool)
Set’s whether the context should enable GREASE.
This corresponds to SSL_CTX_set_grease_enabled
.
Sourcepub fn set_permute_extensions(&mut self, enabled: bool)
pub fn set_permute_extensions(&mut self, enabled: bool)
Configures whether ClientHello extensions should be permuted.
Note: This is gated to non-fips because the fips feature builds with a separate version of BoringSSL which doesn’t yet include these APIs. Once the submoduled fips commit is upgraded, these gates can be removed.
This corresponds to SSL_CTX_set_permute_extensions
.
Sourcepub fn set_verify_algorithm_prefs(
&mut self,
prefs: &[SslSignatureAlgorithm],
) -> Result<(), ErrorStack>
pub fn set_verify_algorithm_prefs( &mut self, prefs: &[SslSignatureAlgorithm], ) -> Result<(), ErrorStack>
Sets the context’s supported signature verification algorithms.
This corresponds to SSL_CTX_set_verify_algorithm_prefs
.
Sourcepub fn enable_signed_cert_timestamps(&mut self)
pub fn enable_signed_cert_timestamps(&mut self)
Enables SCT requests on all client SSL handshakes.
This corresponds to SSL_CTX_enable_signed_cert_timestamps
.
Sourcepub fn enable_ocsp_stapling(&mut self)
pub fn enable_ocsp_stapling(&mut self)
Enables OCSP stapling on all client SSL handshakes.
This corresponds to SSL_CTX_enable_ocsp_stapling
.
Sourcepub fn set_curves_list(&mut self, curves: &str) -> Result<(), ErrorStack>
pub fn set_curves_list(&mut self, curves: &str) -> Result<(), ErrorStack>
Sets the context’s supported curves.
This corresponds to SSL_CTX_set1_curves_list
.
Sourcepub fn set_curves(&mut self, curves: &[SslCurve]) -> Result<(), ErrorStack>
pub fn set_curves(&mut self, curves: &[SslCurve]) -> Result<(), ErrorStack>
Sets the context’s supported curves.
This corresponds to SSL_CTX_set1_curves
.
Sourcepub fn set_compliance_policy(
&mut self,
policy: CompliancePolicy,
) -> Result<(), ErrorStack>
pub fn set_compliance_policy( &mut self, policy: CompliancePolicy, ) -> Result<(), ErrorStack>
Sets the context’s compliance policy.
This feature isn’t available in the certified version of BoringSSL.
This corresponds to SSL_CTX_set_compliance_policy
.
Sourcepub fn set_info_callback<F>(&mut self, callback: F)
pub fn set_info_callback<F>(&mut self, callback: F)
Sets the context’s info callback.
This corresponds to SSL_CTX_set_info_callback
.