rustls/rustls

★ 7,396RustAudience · developerComplexity · 3/5Setup · moderate

Mindmap

mindmap
  root((rustls))
    What it does
      TLS encryption
      Certificate validation
      Secure by default
    Crypto Providers
      aws-lc-rs
      ring backend
      OpenSSL backend
      SymCrypt
    Protocol Support
      TLS 1.2
      TLS 1.3
      Post-quantum
    Integrations
      Tokio async
      tokio-rustls crate
    Design
      Pluggable backends
      No weak ciphers
      Modern defaults

mindmap root((rustls)) What it does TLS encryption Certificate validation Secure by default Crypto Providers aws-lc-rs ring backend OpenSSL backend SymCrypt Protocol Support TLS 1.2 TLS 1.3 Post-quantum Integrations Tokio async tokio-rustls crate Design Pluggable backends No weak ciphers Modern defaults

Click or tap to explore — scroll the page freely

Things people build with this

USE CASE 1

Add secure HTTPS client connections to a Rust application without configuring cryptography settings manually

USE CASE 2

Build a TLS server in Rust that only accepts modern protocol versions and automatically rejects expired certificates

USE CASE 3

Integrate with the Tokio async runtime for non-blocking TLS in a Rust web service or API client

Tech stack

RustTLSTokio

Getting it running

Difficulty · moderate Time to first run · 30min

Requires choosing a crypto provider (rustls-aws-lc-rs or rustls-ring) and adding it as a dependency before the library can be used.

In plain English

Rustls is a library that handles TLS, which is the encryption and authentication protocol that makes HTTPS connections secure. When software connects to a server over the internet, TLS is what verifies the server's identity and encrypts the data in transit. Rustls provides that functionality for programs written in Rust, and it is used in production at a variety of organizations and open source projects. The library is designed to be secure without requiring the programmer to make the right configuration choices. It only supports modern protocol versions (TLS 1.2 and TLS 1.3), leaves out obsolete cipher options, and defaults to a strong security posture. The goal is that developers should not need to study cryptography to use it safely. One notable aspect of the design is that rustls separates the core TLS logic from the cryptography math itself. The actual encryption work is handled by a pluggable backend called a crypto provider. The two officially maintained providers are rustls-aws-lc-rs (using a library derived from Amazon's fork of BoringSSL, with support for newer post-quantum algorithms) and rustls-ring (simpler to build but with fewer features). Third-party providers also exist for OpenSSL, Microsoft SymCrypt, and other backends, which matters for organizations with compliance requirements or constrained hardware. The library works with Rust's async ecosystem. If you use Tokio (a popular async runtime for Rust), a companion crate called tokio-rustls makes integration straightforward. The README also points to example programs demonstrating a TLS client and TLS server, including how the library correctly rejects connections to servers with expired or invalid certificates. Rustls is actively maintained and has a published roadmap. Contributions are welcome, and the project follows the OpenSSF Best Practices guidelines for open source security.

Copy-paste prompts

Prompt 1

Show me how to create a simple TLS client in Rust using rustls that connects to an HTTPS server and validates the certificate.

Prompt 2

How do I add rustls to a Tokio-based async Rust server to handle incoming TLS connections using tokio-rustls?

Prompt 3

I need to use OpenSSL as the crypto backend with rustls for compliance reasons, walk me through switching providers.

Prompt 4

How do I configure rustls to act as a TLS server for local development, including how to handle self-signed certificates?

Prompt 5

What TLS cipher suites and protocol versions does rustls support, and which ones does it deliberately leave out?

Open on GitHub → Explain another repo

← rustls on gitmyhub — every repo by this author, as a profile.

Verify against the repo before relying on details.