hyper-rustls

hyper-rustls wires the Rustls TLS implementation into hyper’s connector interface, giving hyper-based HTTP clients (and servers) HTTPS support without depending on OpenSSL or any other native TLS library. It ships a HttpsConnector that wraps hyper-util’s HTTP connector and negotiates TLS via Rustls, so a Rust HTTP client only has to swap its connector type to gain HTTPS.

The crate is maintained under the official rustls GitHub organization alongside the Rustls project itself, and is a common dependency of higher-level HTTP clients in the Rust ecosystem that want a pure-Rust TLS stack (avoiding OpenSSL’s build/linking complexity) while keeping hyper’s low-level connection pooling and HTTP/1-and-2 support.

What You Get

• HttpsConnector implementing hyper’s Service connector trait for transparent HTTPS
• Feature-gated crypto backends: aws-lc-rs (default) and ring
• Certificate store options: native OS store, bundled Mozilla roots (webpki-roots), or OS-native verifier (rustls-platform-verifier)
• HTTP/1 and optional HTTP/2 support via hyper-util
• Builder API (HttpsConnectorBuilder) for composing TLS config, connector, and protocol settings
• Optional FIPS-140-3 compliant mode via the AWS-LC backend

Common Use Cases

• Building a pure-Rust HTTP client that needs HTTPS without linking OpenSSL
• Swapping an existing hyper HTTP connector for an HTTPS-capable one with minimal code change
• Services that must run in FIPS-constrained environments using the fips feature
• CLI tools and SDKs distributed as static binaries where avoiding a native TLS dependency simplifies cross-compilation

Under The Hood

Architecture: The crate is a thin connector layer: src/connector.rs and src/connector/ implement HttpsConnector<T>, a tower_service::Service that wraps an inner hyper-util connector and, on call(), performs the TCP connect followed by a Rustls TLS handshake (src/stream.rs models the resulting stream as either plain or TLS). src/config.rs centralizes HttpsConnectorBuilder, which composes the chosen ClientConfig (crypto provider, cert store, ALPN protocols) before handing off to the connector. Tech Stack: Pure Rust (100%), targeting the 2021 edition; core dependencies are rustls (TLS 1.2/1.3 protocol implementation), tokio-rustls (async adapter), hyper + hyper-util (connection/service plumbing), and optional rustls-native-certs/webpki-roots/rustls-platform-verifier for certificate sourcing, with aws-lc-rs or ring as swappable crypto providers. Code Quality: A compact ~1,100-line src/ tree with tests both inline (src/tests.rs) and in tests/tests.rs, CI-gated builds (build.yml badge in the README), and 434 commits from 58 contributors show sustained real-world hardening; the crate carries a triple Apache-2.0/MIT/ISC license, unusual care that reflects its role as security-sensitive infrastructure. API Design: The builder pattern (HttpsConnectorBuilder::new().with_native_roots()?.https_only().enable_http1().build()) keeps common configurations to a few chained calls while still surfacing every knob (crypto backend, cert source, HTTP version, FIPS mode) as an explicit, discoverable feature flag rather than hidden defaults.