feat(tls): honor a process-installed rustls CryptoProvider; harden the rustls backend - #446
Open
MattJackson wants to merge 2 commits into
Open
feat(tls): honor a process-installed rustls CryptoProvider; harden the rustls backend#446MattJackson wants to merge 2 commits into
MattJackson wants to merge 2 commits into
Conversation
MattJackson
force-pushed
the
stack/s7
branch
2 times, most recently
from
September 2, 2026 20:24
a0836ca to
607ddba
Compare
MattJackson
force-pushed
the
stack/s7
branch
from
September 2, 2026 21:17
607ddba to
47a7055
Compare
MattJackson
force-pushed
the
stack/s7
branch
2 times, most recently
from
September 2, 2026 23:06
5bda77d to
c9b2719
Compare
MattJackson
force-pushed
the
stack/s7
branch
from
September 2, 2026 23:54
c9b2719 to
b8bd1b8
Compare
MattJackson
force-pushed
the
stack/s7
branch
from
September 3, 2026 00:01
b8bd1b8 to
1687f19
Compare
MattJackson
force-pushed
the
stack/s7
branch
from
September 3, 2026 00:50
1687f19 to
bd9167c
Compare
Use CryptoProvider::get_default() when the application has installed a process-wide provider (via install_default), falling back to aws-lc-rs otherwise. Lets callers choose their own backend (ring, a FIPS provider, ...) instead of being forced onto aws-lc-rs. Suggested by @SimSmith while reviewing the rustls 0.23 migration (#439).
Review-driven follow-ups found while adding CryptoProvider support: - fix(HIGH): trust_cert_ca now trusts the supplied CA *in addition to* the system trust store (best-effort), matching its documented contract and the native-tls backend. Previously the rustls path built RootCertStore::empty() with only the custom CA, so connections to public-CA servers failed. The native-root load is best-effort (an empty/unreadable OS store no longer breaks an explicit-CA-only deployment). - fix: CA-cert read failures now preserve the underlying io::Error in the message (missing vs permission vs parse) instead of a generic string. - refactor: extract read_cert_chain (shared by the CA and client-cert paths, removing duplicated pem/der extension parsing) and resolve_crypto_provider (pure, unit-testable; logs which provider was selected). - docs: explain the TLS 1.2 pin (a macOS-CI workaround, tracked for removal in the macOS-parity follow-up), the NoCertVerifier scheme list, and the TrustAll placeholder SNI. - test: add unit coverage for provider selection, get_server_name, cert-chain reading, the additive CA store, and client-auth loading (previously zero unit tests in this file). No behavior change to TrustAll/Default paths. Gate: fmt + clippy --features=all -D warnings + new unit tests all green.
MattJackson
force-pushed
the
stack/s7
branch
from
September 3, 2026 01:10
bd9167c to
9591085
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of the sync stack — slice s7, based on #444 (
stack/s6).What
CryptoProvider. The rustls backend now usesCryptoProvider::get_default()when an application has installed one, falling back toaws-lc-rsotherwise (previously it always constructedaws-lc-rs). Raised by @SimSmith in review of fix(security): upgrade rustls stack to 0.23 — clear RUSTSEC-2026-0098/-0099/-0104 #439.rustls_tls_stream.rs(boy-scout, while adding the above):trust_cert_cais now additive — a custom CA is added alongside the system roots instead of replacing them (previously a custom CA silently dropped all other trust anchors).resolve_crypto_provider,read_cert_chain,read_private_key,load_native_roots_into,build_ca_trust_store.Validation
cargo fmt --checkclean;cargo clippygreen on both--features=alland the rustls feature set; unit tests pass (including the new rustls tests).Please rebase-merge (not squash) to preserve commit attribution.