TLS with rustls

Terminate and originate TLS in Rust with rustls - pure-Rust TLS using aws-lc-rs or ring crypto backends.

Recipe

Quick-reference recipe card - copy-paste ready.

[dependencies]
reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "json"] }
rustls = "0.23"
tokio-rustls = "0.26"

let client = reqwest::Client::builder()
    .use_rustls_tls()
    .build()?;

When to reach for this: HTTPS clients and servers without OpenSSL dependency - common in Rust microservices and static binaries.

Working Example

use rustls::pki_types::{CertificateDer, PrivateKeyDer};
use std::sync::Arc;
 
fn load_certs(pem: &str) -> Vec<CertificateDer<'static>> {
    rustls_pemfile::certs(&mut pem.as_bytes())
        .map(|r| r.unwrap())
        .collect()
}
 
fn load_key(pem: &str) -> PrivateKeyDer<'static> {
    rustls_pemfile::private_key(&mut pem.as_bytes())
        .next()
        .unwrap()
        .unwrap()
}
 
fn rustls_server_config(cert_pem: &str, key_pem: &str) -> Arc<rustls::ServerConfig> {
    let certs = load_certs(cert_pem);
    let key = load_key(key_pem);
    let config = rustls::ServerConfig::builder()
        .with_no_client_auth()
        .with_single_cert(certs, key)
        .unwrap();
    Arc::new(config)
}

What this demonstrates:

• PEM loading with rustls-pemfile.
• ServerConfig::builder() with certificate chain and private key.
• Arc config shared across connections.
• No OpenSSL system dependency.

Deep Dive

How It Works

• rustls implements TLS 1.2/1.3 without OpenSSL.
• reqwest/axum/hyper integrate via rustls connectors.
• WebPKI roots via webpki-roots or platform verifier crates.

Deployment Patterns

Rust Notes

// mTLS client trusts custom CA
let mut roots = rustls::RootCertStore::empty();
roots.add(ca_cert).unwrap();
let config = rustls::ClientConfig::builder()
    .with_root_certificates(roots)
    .with_client_auth_cert(client_certs, client_key)?;

Gotchas

• Certificate expiry - No auto-renew in app. Fix: cert-manager, Let's Encrypt, or load balancer managed certs.
• Disabled verification - danger_accept_invalid_certs in prod. Fix: Proper root store and hostname verification.
• TLS version mismatch - Old clients need TLS 1.2 enabled. Fix: Configure rustls policy for minimum version.
• Wrong SAN - Cert lacks service DNS name. Fix: Include all internal DNS names in CSR.
• Key in repo - Private key committed to git. Fix: Secrets manager mount at runtime.

Alternatives

FAQs

Related

• HTTP Clients (reqwest) - HTTPS client
• gRPC with tonic - mTLS services
• Secrets Management - Key storage
• Networking Best Practices - TLS rules
• Cryptography (ring / RustCrypto) - Crypto primitives

Stack versions: This page was written for Rust 1.97.0 (edition 2024), Tokio 1.x, Axum 0.8, serde 1.0, sqlx 0.8, clap 4, and Polars 0.46+.