Crate zeroclaw_tls 

Shared TLS and mutual TLS (mTLS) construction for ZeroClaw.

This crate sits below both zeroclaw-runtime and zeroclaw-gateway so the same rustls server-config / client-certificate-verifier / certificate-pinning logic can be reused without an upward dependency. It is parameterized by the neutral ServerConfigParams / ClientAuthParams types rather than any consumer crate’s configuration struct, keeping this crate free of upward dependencies on zeroclaw-config and friends.

Re-exports

pub use certgen::CaKeyProtection;

pub use certgen::IssuedLeaf;

pub use certgen::Pem;

pub use certgen::ServerMaterials;

pub use certgen::ensure_server_materials;

pub use certgen::ensure_server_materials_protected;

pub use certgen::generate_client_csr;

pub use certgen::issue_client_cert;

pub use certgen::load_ca_key_pem;

pub use certgen::sign_csr;

pub use csr::ClientCsr;

pub use csr::ClientKey;

pub use csr::CsrSigner;

pub use csr::SoftwareP256Signer;

Modules

certgen

Certificate generation for ZeroClaw’s mutual-TLS transport.

csr

Platform-abstracted client CSR generation.

Structs

ClientAuthParams

Client-certificate verification parameters (transport-neutral).

RelayPinVerifier

A rustls SERVER-certificate verifier that PINS the relay’s OUTER leaf cert by its SHA-256 fingerprint instead of chaining to a CA (threat A2: the outer TLS is a metadata boundary, not the RPC boundary; the inner mTLS is the real one).

ServerConfigParams

Server TLS parameters (transport-neutral).

Functions

build_client_verifier

Build a client certificate verifier from the client-auth parameters.

build_mtls_acceptor

Build a [TlsAcceptor] for a remote, mutually-authenticated transport plane.

build_mtls_server_config

Build a TLS 1.3-only [rustls::ServerConfig] that always requires and verifies a client certificate. See build_mtls_acceptor; this is the inner config builder. There is no no-client-auth branch here by design. crl_path, when non-empty, refuses a revoked client certificate (A5).

build_server_config

Build a [rustls::ServerConfig] from the given server parameters.

build_tls_acceptor

Build a [TlsAcceptor] from the given server parameters.

cert_sha256_fingerprint

Compute the SHA-256 fingerprint of a DER-encoded certificate.

client_cert_node_id

Read a relay node-id from an OUTER client certificate’s subject Common Name.

enrollment_sas

The enrollment short-auth-string binding a one-time pairing code to the daemon CA fingerprint (no blind TOFU at bootstrap; threats A1/A7).

load_certs

Load PEM-encoded certificates from a file.

load_private_key

Load a PEM-encoded private key from a file.

load_revoked_fingerprints

Read a revoked-fingerprint file (one SHA-256 hex per line; blank lines and # comments ignored) into a normalized set. Missing/unreadable files are errors: a configured revocation boundary must fail closed, not silently become an empty revocation set.

single_cert_pem_sha256_fingerprint

Compute the SHA-256 fingerprint of a PEM chain that must contain exactly one certificate. Enrollment SAS confirmation binds to one daemon CA, not a broader chain, so callers should fail closed on zero or multiple certs.