Module tls

Self-signed certificates for TLS tests.

Generated fresh per test run rather than checked into the repository: nothing expires, and no key material — not even a throwaway one — lives in a public repo’s git history.

Structs

• TestCa
  A certificate authority for issuing certificates in mutual-TLS tests — self_signed’s single cert/key pair can’t produce this, since mTLS tests need a CA distinct from the leaf certificates it issues.
• TestCerts
  A self-signed certificate and its key, in memory.

Functions

• client_tls
  A [ClientTls] that trusts certs and checks the peer’s certificate against server_name.
• client_tls_with_client_cert
  A [ClientTls] that trusts certs and presents a certificate issued by client_ca — for a peer requiring mutual TLS.
• issue
  Issues a certificate for names, signed by ca — for a peer that must present a certificate ca (or a server_tls_with_client_ca built from it) will accept.
• self_signed
  Generates a self-signed certificate valid for names (hostnames or IP addresses).
• server_tls
  A [ServerTls] presenting certs.
• server_tls_with_client_ca
  As server_tls, but also requires and verifies a client certificate issued by client_ca.
• test_ca
  Generates a self-signed CA for issuing certificates via issue.
• untrusted_client_tls
  A [ClientTls] that trusts a different self-signed authority than whatever the server under test presents — for a test asserting that an untrusted certificate is rejected.