Day 15: rustls ServerConfig with a Custom CA

Phase 2 · July 1, 2026

Agenda (2–3 hours)

• Read (30 min): rustls ServerConfig::builder, RootCertStore, CertificateDer docs
• Build (90 min): Implement tls::server_config() in tls.rs
• Verify (30 min): Connect to the server with openssl s_client -CAfile root/ca.crt

rustls ServerConfig: What You Need

use rustls::{ServerConfig, RootCertStore};
use rustls_pki_types::{CertificateDer, PrivateKeyDer};
use tokio_rustls::TlsAcceptor;

pub fn server_config(
    cert_chain_pems: &[&str],  // leaf, intermediate (in order)
    private_key_pem: &str,
    require_client_cert: bool,
    trusted_client_ca_pem: Option<&str>,
) -> anyhow::Result<ServerConfig> {
    let certs: Vec<CertificateDer> = cert_chain_pems
        .iter()
        .map(|pem| parse_cert_pem(pem))
        .collect::<anyhow::Result<Vec<_>>>()?;

    let key = parse_private_key_pem(private_key_pem)?;

    let builder = ServerConfig::builder();
    // ... auth config + with_single_cert(certs, key)
}

Client Auth: Optional vs Required

let server_cfg = if require_client_cert {
    let mut roots = RootCertStore::empty();
    if let Some(ca_pem) = trusted_client_ca_pem {
        roots.add(parse_cert_pem(ca_pem)?)?;
    }
    let verifier = WebPkiClientVerifier::builder(Arc::new(roots)).build()?;
    ServerConfig::builder()
        .with_client_cert_verifier(verifier)
        .with_single_cert(certs, key)?
} else {
    ServerConfig::builder()
        .with_no_client_auth()
        .with_single_cert(certs, key)?
};

PEM Parsing Helpers

use rustls_pemfile::{certs, private_key};
use std::io::BufReader;

fn parse_cert_pem(pem: &str) -> anyhow::Result<CertificateDer<'static>> {
    let mut reader = BufReader::new(pem.as_bytes());
    certs(&mut reader)
        .next()
        .ok_or_else(|| anyhow::anyhow!("no cert in PEM"))?
        .map_err(Into::into)
}

fn parse_private_key_pem(pem: &str) -> anyhow::Result<PrivateKeyDer<'static>> {
    let mut reader = BufReader::new(pem.as_bytes());
    private_key(&mut reader)?
        .ok_or_else(|| anyhow::anyhow!("no private key in PEM"))
}

Testing the Server

// Start an echo server
let acceptor = TlsAcceptor::from(Arc::new(server_cfg));
let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await?;
let port = listener.local_addr()?.port();

tokio::spawn(async move {
    let (stream, _) = listener.accept().await.unwrap();
    let mut tls = acceptor.accept(stream).await.unwrap();
    // echo loop...
});

# Connect from shell (trust your root CA)
openssl s_client -connect localhost:<port> -CAfile root/ca.crt

Challenge Assignment

Implement tls::server_config() in tls.rs.

Write a test test_tls_server_accepts_valid_client that:

1. Starts a TLS server (no client auth) using a toy-pki server cert
2. Connects using openssl s_client via std::process::Command
3. Asserts the connection succeeds and the correct cert CN is shown
4. Starts a second server (mTLS required) and verify it rejects a connection without a client cert

Resources

• rustls ServerConfig::builder(): docs.rs/rustls
• rustls-pemfile: certs(), private_key()
• tokio-rustls TlsAcceptor
• rustls_pki_types: CertificateDer, PrivateKeyDer