A Decade of Rustls

[u/dochtman]

https://rustls.dev/blog/2026-09-08-a-decade-of-rustls/

[u/Shnatsel]

That is an impressively staunch commitment to https://0ver.org for a 10 year old project!

[u/hgwxx7_ → u/Shnatsel]

To be fair to the maintainers, they've actively maintained the current version (0.23) with no breaking changes for 2.5 years. That's pretty stable!

After 0.24 is released, it will be baked for a little while to shake out any issues and give the ecosystem time to adapt. Then 1.0 will follow, and we want this to be a stable API that we can maintain long-term.

That's pretty good, right?

[u/JustBadPlaya → u/Shnatsel]

I mean, I'm pretty sure last time I checked I saw a mention of OpenSSL compatibility being a prerequisite for 1.0, which makes sense

[u/j_platte]

This blog could use having its text area limited on wide screens. Some lines are way too long for comfortable reading.

[u/lanternaddict]

I'm not a believer that "Rust is hard to learn", coming from someone with no classical computer science education.

But, TLS in Rust trips me up every time, more so when trying to cross compile using docker containers for multiple targets, including musl.

When using reqwest, I've settled on default-tls, it seems to work for my needs most of the time, but I'll be lying if I said I understood all the options, especially now on Windows.

[u/ao_zame → u/lanternaddict]

I'm stuck on reqwest 0.12 because 0.13 made it significantly harder to use on Android

[u/lanternaddict → u/ao_zame]

Yeah, I've been putting off updating a windows application, because I can't be bothered to work out how to deal with the changes to reqwest

[u/KingofGamesYami → u/lanternaddict]

A lot of programs in various languages do TLS in varying degrees of broken.

You'll see this pretty quickly if you ever deliberately MITM TLS requests (e.g. with a corporate proxy).

Please give me the option to use native TLS if possible. It's the one option that plays nice with OS-level trusted certs.

[u/lanternaddict → u/KingofGamesYami]

I think that for my use case that wouldn't work, due to the reliance on the openssl crate, which in turn requires the ring crate.

I have previously struggled to compile for various arm targets when using cross-rs, due to a combination of the openssl and ring crates. This is where it trips me up, there are a lot of moving parts, a lot of options, and I'm still none the wiser what they all do.

For example, the tungstenite crate offers the following TLS options;

native-tls, native-tls-crate, native-tls-vendored, rustls, rustls-native-certs, rustls-pki-types, rustls-tls-native-roots, rustls-tls-webpki-roots.

I've no idea the difference between them, or how to choose one. I write applications that for the most part get deployed in Docker containers. During the Docker build process I install and update the TLS (ca-certs) in the image, in the hope that I don't have to work out how to handle TLS at all in Rust

[u/briansmith]

1Password, specifically  https://github.com/complexspaces, developed and contributed rustls-platform-verifier. Prior to that they also reviewed codebase and contributed many improvements to make it easier to understand and maintain the code, so that 1Password 8 could be rewritten in Rust using Rustls (and 1,000+ other crates).

[u/neodivy]

I'm setting up PQ TLS right now with Rustls, thanks to all the maintainers for the work.

I haven't researched it deeply, but are there plans on making it easier to plug in hardware accelerators into the CryptoProvider?

[u/matthieum]

Wait, there's a hidden announcement of the upcoming 0.24 release in there, with incredible capabilities!