# TLS stack

The TLS stack in `src/tls.rs` configures rustls for both server (listener) and client (connector) roles with mutual TLS.

## Purpose

Provide safe, fail-closed TLS configuration builders that load certificates and keys, validate certificate identities, and support both secure and insecure (lab-only) modes.

## Key abstractions

| Type/Function | File | Description |
| ------------- | ---- | ----------- |
| `build_server_config` | `src/tls.rs` | Build a rustls `ServerConfig` with client certificate verification |
| `build_client_config` | `src/tls.rs` | Build a rustls `ClientConfig` with server certificate verification |
| `build_server_config_insecure` | `src/tls.rs` | Build a server config that skips client cert verification |
| `build_client_config_insecure` | `src/tls.rs` | Build a client config that skips server cert verification |
| `load_certs` | `src/tls.rs` | Load PEM-encoded certificates from a file |
| `load_key` | `src/tls.rs` | Load a PEM-encoded private key from a file |
| `validate_cert_identity` | `src/tls.rs` | Check SANs and CN against an expected hostname |
| `check_cert_not_expired` | `src/tls.rs` | Verify certificate validity period |
| `cert_fingerprint_sha256` | `src/tls.rs` | Compute SHA-256 fingerprint of a certificate |
| `InsecureServerCertVerifier` | `src/tls.rs` | Dangerous verifier that accepts any certificate |

## How it works

Server config building:

1. Load the server certificate chain and private key.
2. Load the CA certificate into a `RootCertStore`.
3. Build a `WebPkiClientVerifier` from the root store.
4. Use `ServerConfig::builder().with_client_cert_verifier(...).with_single_cert(...)`.

Client config building:

1. Load the client certificate chain and private key.
2. Load the CA certificate into a `RootCertStore`.
3. Use `ClientConfig::builder().with_root_certificates(...).with_client_auth_cert(...)`.

Identity validation uses `x509-parser` to extract Subject Alternative Names and the subject CN, matching against the expected hostname or IP address.

## Key source files

| File | Purpose |
| ---- | ------- |
| `src/tls.rs` | TLS configuration, certificate loading, identity validation |