feat(rust-examples): add mutual TLS example - #5995
Open
abidedavana wants to merge 2 commits into
Open
Conversation
Add a mutual TLS (client authentication) example to the rust examples, modeled on the tokio-server-client example. The server requires client certificates (ClientAuthType::Required), validates them against the example CA only, and pins the expected client identity with a VerifyHostNameCallback. The README demonstrates a successful mTLS handshake plus two rejection cases: a client with no certificate and a client with a trusted-CA certificate for the wrong identity.
jmayclin
reviewed
Jul 22, 2026
|
|
||
| // Split the stream. | ||
| // This allows us to call read and write from different tasks. | ||
| let (mut reader, mut writer) = tokio::io::split(tls); |
Contributor
There was a problem hiding this comment.
I totally appreciate that you're just following the earlier example, but I honestly find the tokio::io::split to be kind confusing for the example. Could you instead
- client: send
b"hello from the client" - server: receive client message
- server: send
b"good byte from the server" - server: shutdown the write side
- client: receive the server message
- client: receive the shutdown
- client: shutdown the write side
- server: receive the client shutdown
- Finished!
This way it would also show the shutdown dance required to gracefully shutdown the TLS/TCP streams.
Author
There was a problem hiding this comment.
Good call, that flow is much easier to follow, i swapped it in, Client sends its greeting, server replies with good byte from the server and closes its write side, client reads to EOF then closes its side, and the server does one last read to catch the client's shutdown. Updated the README outputs too.
Bonus: the rejected clients actually error out now instead of quietly exiting 0.
…change and graceful shutdown
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Goal
Add a mutual TLS (client auth) example to the rust examples.
Why
Resolves #5584 — the examples cover basic TLS but none show mTLS, which is a
pretty common setup.
How
New
mutual-tlsmember inbindings/rust-examples, based on the existingtokio-server-clientexample. The server requires a client cert, trusts onlythe example CA, and pins the client identity with a host name callback (the
docs note this is required, or the default rejects all client certs). The
client presents the existing wombat cert. README shows a good handshake plus
two rejections — no cert, and a valid-CA cert for the wrong identity.
Callouts
since
certs/generate.shdrops the CA key after signing and a new cert wouldmean regenerating every pem. Can add a dedicated client cert if you'd rather.
the point here, and it's otherwise invisible — with TLS1.3 the client still
sees a successful handshake and the error only shows after the blinding delay.
README explains both.
Testing
cargo build/testinbindings/rust-examplespass, fmt + clippy clean, andI ran all three scenarios (the README outputs are real).
Related
resolves #5584
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.