Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support Raw Public Key TLS with Rustls. #2569

Open
Nuhvi opened this issue Feb 24, 2025 · 1 comment
Open

Support Raw Public Key TLS with Rustls. #2569

Nuhvi opened this issue Feb 24, 2025 · 1 comment

Comments

@Nuhvi
Copy link
Contributor

Nuhvi commented Feb 24, 2025

I am working on a PR for this, but I want to check first if you are open for this, before opening a PR.

Rustls does not allow for a mix between Raw Public Key certificates and X.509 (for reference), so if I want to use Reqwest with RPK, I need a trait that returns a rustls::ClientConfig based on the dst: http::Uri.

This would require an extra method in the builder, but existing users won't need to change anything, except that internally there is going to be a slight overhead of pointers and implementing that new trait to the Arc<rustls::ClientConfig> to return a clone of itself regardless of the http::Uri input.

The main benefit of this is that if you know the public key of a server, you can skip CAs and talk to the server directly.

This might not be the ideal way to solve for this use case, the general solution might be customizing connection based on the Uri and possibly the HTTPS records in their DNS etc. But that is much harder for me than adding a trait for a dynamic rustls client configuration.

Note: this doesn't seem to be doable in http3 unless the same concept is added to quinn.

@seanmonstar
Copy link
Owner

I wouldn't want to expose anything publicly that depends on rustls. That would make us tied to version, so we couldn't upgrade rustls without it being a breaking change.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants