Rustls is a modern TLS library written in Rust.
Rustls is used in production at many organizations and projects. We aim to maintain reasonable API surface stability but the API may evolve as we make changes to accommodate new features or performance improvements.
We have a roadmap for our future plans. We also have benchmarks to prevent performance regressions and to let you evaluate rustls on your target hardware.
If you'd like to help out, please see CONTRIBUTING.md.
The detailed list of changes in each release can be found at https://github.com/rustls/rustls/releases.
Rustls is a TLS library that aims to provide a good level of cryptographic security, requires no configuration to achieve that security, and provides no unsafe features or obsolete cryptography by default.
Rustls implements TLS1.2 and TLS1.3 for both clients and servers. See the full list of protocol features.
While Rustls itself is platform independent, by default it uses aws-lc-rs
for implementing
the cryptography in TLS. See the aws-lc-rs FAQ for more details of the
platform/architecture support constraints in aws-lc-rs.
ring
is also available via the ring
crate feature: see
the supported ring
target platforms.
By providing a custom instance of the crypto::CryptoProvider
struct, you
can replace all cryptography dependencies of rustls. This is a route to being portable
to a wider set of architectures and environments, or compliance requirements. See the
crypto::CryptoProvider
documentation for more details.
Specifying default-features = false
when depending on rustls will remove the
dependency on aws-lc-rs.
Rustls requires Rust 1.63 or later. It has an optional dependency on zlib-rs which requires 1.75 or later.
Since Rustls 0.22 it has been possible to choose the provider of the cryptographic primitives
that Rustls uses. This may be appealing if you have specific platform, compliance or feature
requirements that aren't met by the default provider, aws-lc-rs
.
Users that wish to customize the provider in use can do so when constructing ClientConfig
and ServerConfig
instances using the with_crypto_provider
method on the respective config
builder types. See the crypto::CryptoProvider
documentation for more details.
Rustls ships with two built-in providers controlled with associated feature flags:
aws-lc-rs
- enabled by default, available with theaws_lc_rs
feature flag enabled.ring
- available with thering
feature flag enabled.
See the documentation for crypto::CryptoProvider
for details on how providers are
selected.
The community has also started developing third-party providers for Rustls:
rustls-mbedtls-provider
- a provider that usesmbedtls
for cryptography.rustls-openssl
- a provider that uses OpenSSL for cryptography.rustls-post-quantum
: an experimental provider that adds support for post-quantum key exchange to the default aws-lc-rs provider.boring-rustls-provider
- a work-in-progress provider that usesboringssl
for cryptography.rustls-rustcrypto
- an experimental provider that uses the crypto primitives fromRustCrypto
for cryptography.rustls-symcrypt
- a provider that uses Microsoft's SymCrypt library.rustls-wolfcrypt-provider
- a work-in-progress provider that useswolfCrypt
for cryptography.
We also provide a simple example of writing your own provider in the custom-provider
example. This example implements a minimal provider using parts of the RustCrypto
ecosystem.
See the Making a custom CryptoProvider section of the documentation for more information on this topic.
Our examples directory contains demos that show how to handle I/O using the
stream::Stream
helper, as well as more complex asynchronous I/O using mio
.
If you're already using Tokio for an async runtime you may prefer to use
tokio-rustls
instead of interacting with rustls directly.
The mio
based examples are the most complete, and discussed below. Users
new to Rustls may prefer to look at the simple client/server examples before
diving in to the more complex MIO examples.
The MIO client example program is named tlsclient-mio
.
Some sample runs:
$ cargo run --bin tlsclient-mio -- --http mozilla-modern.badssl.com
HTTP/1.1 200 OK
Server: nginx/1.6.2 (Ubuntu)
Date: Wed, 01 Jun 2016 18:44:00 GMT
Content-Type: text/html
Content-Length: 644
(...)
or
$ cargo run --bin tlsclient-mio -- --http expired.badssl.com
TLS error: InvalidCertificate(Expired)
Connection closed
Run cargo run --bin tlsclient-mio -- --help
for more options.
The MIO server example program is named tlsserver-mio
.
Here's a sample run; we start a TLS echo server, then connect to it with
openssl
and tlsclient-mio
:
$ cargo run --bin tlsserver-mio -- --certs test-ca/rsa-2048/end.fullchain --key test-ca/rsa-2048/end.key -p 8443 echo &
$ echo hello world | openssl s_client -ign_eof -quiet -connect localhost:8443
depth=2 CN = ponytown RSA CA
verify error:num=19:self signed certificate in certificate chain
hello world
^C
$ echo hello world | cargo run --bin tlsclient-mio -- --cafile test-ca/rsa-2048/ca.cert -p 8443 localhost
hello world
^C
Run cargo run --bin tlsserver-mio -- --help
for more options.
Rustls is distributed under the following three licenses:
- Apache License version 2.0.
- MIT license.
- ISC license.
These are included as LICENSE-APACHE, LICENSE-MIT and LICENSE-ISC respectively. You may use this software under the terms of any of these licenses, at your option.
- Joe Birr-Pixton (@ctz, Project Founder - full-time funded by Prossimo)
- Dirkjan Ochtman (@djc, Co-maintainer)
- Daniel McCarney (@cpu, Co-maintainer - half-time funded by Prossimo)
- Josh Aas (@bdaehlie, Project Management)
This project adopts the Rust Code of Conduct. Please email rustls-mod@googlegroups.com to report any instance of misconduct, or if you have any comments or questions on the Code of Conduct.