rustls

Rustls is a TLS library written in Rust that implements TLS 1.2 and TLS 1.3 for both clients and servers. It is designed to provide a good level of cryptographic security by default, requiring no configuration to achieve that security, and it deliberately avoids unsafe code and obsolete cryptographic algorithms.

Since version 0.22, Rustls supports pluggable cryptography providers via the CryptoProvider abstraction, letting users choose between aws-lc-rs (full feature set, including post-quantum algorithms) or ring (broader platform support). It is widely used in production, underpinning projects like curl, AWS-LC, and numerous Rust web servers and clients.

What You Get

• Full TLS 1.2 and TLS 1.3 protocol implementations for both client and server roles
• Pluggable cryptography providers (aws-lc-rs, ring, or third-party) via the CryptoProvider abstraction
• Secure-by-default configuration with no support for obsolete or insecure cipher suites
• Experimental post-quantum key exchange support via the rustls-post-quantum crate
• QUIC transport support for building HTTP/3 and other QUIC-based protocols
• No unsafe code in the core crate, reducing the risk of memory-corruption vulnerabilities

Common Use Cases

• Adding TLS termination to a custom Rust network server (e.g. via mio or Tokio)
• Building an HTTPS client for a Rust application without linking OpenSSL
• Providing the TLS layer underneath async runtimes via integrations like tokio-rustls
• Implementing QUIC-based protocols such as HTTP/3 that need a pluggable TLS backend

Under The Hood

Architecture - Rustls is organized as a Cargo workspace with the core rustls crate providing protocol state machines (client, server, tls12, tls13 modules) decoupled from cryptography via the crypto::CryptoProvider trait, with rustls-aws-lc-rs and rustls-ring crates supplying concrete implementations; message parsing lives in msgs, connection state in conn/common_state.rs, and QUIC support is threaded through quic.rs. Tech Stack - Written in Rust (98% of the codebase, edition 2024), with optional feature flags for webpki certificate verification, zlib-based compression, brotli compression, and log integration; the workspace also includes rustls-post-quantum for experimental algorithms, bogo and connect-tests for protocol conformance, and ci-bench/rustls-bench for performance regression tracking. Code Quality - The project maintains an extensive test suite including BoGo (Google’s TLS conformance) tests, OpenSSL interop tests, and network-based connect tests, plus binary test-vector fixtures under src/testdata; the crate excludes test data and tests from the packaged crate (exclude in Cargo.toml) and enforces deny.toml for dependency auditing. API Design - The public API centers on ClientConfig/ServerConfig builders that require an explicit CryptoProvider since 0.24, favoring explicitness over implicit defaults; documentation is thorough via docs.rs and a dedicated manual module covering supported features, and example programs (tlsclient-mio, tlsserver-mio) demonstrate real I/O integration patterns.