First off, thanks for writing this! It is the simplest framework I have used.
Description
I am using poem for a service that uses mTLS auth. Right now I am using the RustlsListener, but I am starting to need 2 more features.
The ability to use a rustls ServerConfig directly instead of the RustlsConfig provided by poem.
1.1 I need to be able to support CRLs
1.2 I have my CA cert in DER format, and I have to convert it to PEM to pass it into the poem RustlsConfig
Right now I have started implementing this in my own crate, but I think it would be good to have support in poem directly. I am more than happy to make a PR if you think this is a good idea.
Implementation
From taking a peek around the code here is how I think this could be implemented:
Add a AdvancedRustlsListener (not sure about the name) that accepts a stream of Arc<rustls::server::ServerConfig> instead of the poem RustlsConfig
Add a new optional method to the Acceptor trait and implement it for the TLS acceptors.
First off, thanks for writing this! It is the simplest framework I have used.
Description
I am using poem for a service that uses mTLS auth. Right now I am using the
RustlsListener
, but I am starting to need 2 more features.The ability to use a rustls
ServerConfig
directly instead of theRustlsConfig
provided by poem. 1.1 I need to be able to support CRLs 1.2 I have my CA cert in DER format, and I have to convert it to PEM to pass it into the poemRustlsConfig
The ability to extract the client cert from the request. Here is an example of how you can do this in rocket
Right now I have started implementing this in my own crate, but I think it would be good to have support in poem directly. I am more than happy to make a PR if you think this is a good idea.
Implementation
From taking a peek around the code here is how I think this could be implemented:
Add a
AdvancedRustlsListener
(not sure about the name) that accepts a stream ofArc<rustls::server::ServerConfig>
instead of the poemRustlsConfig
Add a new optional method to the
Acceptor
trait and implement it for the TLS acceptors.Add a new field in
Request
to store the cert chain.I am not sure what the best type would be to use for
Certificate
(maybe justVec<u8>
?)