rustls-channel-resolver

A simple channel-like resolver for live-reloading TLS certificates

Usage

Add the dependency to your project

cargo add rustls-channel-resolver

Configure live-reloading for your certificate file

usestd::time::Duration;useactix_web::{web,App,HttpServer};asyncfn index()-> &'static str {"Hewwo Mr Obama"}#[actix_web::main]asyncfn main()-> Result<(),Box<dynstd::error::Error>>{letinitial_key=read_key().await?.unwrap();let(tx,rx)=rustls_channel_resolver::channel::<32>(initial_key);lethandle=actix_web::rt::spawn(asyncmove{letmutinterval=actix_web::rt::time::interval(Duration::from_secs(30));interval.tick().await;loop{interval.tick().await;matchread_key().await{Ok(Some(key))=>tx.update(key),Ok(None)=>eprintln!("No key in keyfile"),Err(e)=>{eprintln!("Failed to read key from fs {e}");}}}});letserver_config=rustls::ServerConfig::builder().with_safe_defaults().with_no_client_auth().with_cert_resolver(rx);HttpServer::new(||App::new().route("/",web::get().to(index))).bind_rustls_0_22("0.0.0.0:8443",server_config)?.bind("0.0.0.0:8080")?.run().await?;handle.abort();let_=handle.await;Ok(())}asyncfn read_key()-> Result<Option<rustls::sign::CertifiedKey>,Box<dynstd::error::Error>>{letcert_bytes=tokio::fs::read("./out/example.crt").await?;letcerts=rustls_pemfile::certs(&mutcert_bytes.as_slice()).collect::<Result<Vec<_>,_>>()?;letkey_bytes=tokio::fs::read("./out/example.key").await?;letSome(private_key)=rustls_pemfile::private_key(&mutkey_bytes.as_slice())?else{returnOk(None);};letprivate_key=rustls::crypto::ring::sign::any_supported_type(&private_key)?;Ok(Some(rustls::sign::CertifiedKey::new(certs,private_key)))}

Contributing

Feel free to open issues for anything you find an issue with. Please note that any contributed code will be licensed under the AGPLv3.

License

Copyright © 2024 asonix

rustls-channel-resolver is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

rustls-channel-resolver is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details. This file is part of rustls-channel-resolver.

You should have received a copy of the GNU Affero General Public License along with rustls-channel-resolver. If not, see http://www.gnu.org/licenses/.