Switch from native-tls to rustls

[Demi-Marie]

No description provided.

[agalakhov]

This has to be feature-gated.

[Demi-Marie]

@agalakhov Feature gating it is fine.

[Demi-Marie]

@agalakhov Do you plan to implement this or should I make a PR?

[agalakhov]

I don't plan to work on that in nearest future, so if you have a readily made implementation, feel free to send pull request.

[juchiast]

rusttls has some limitation like not being able to connect to an IP address rustls/rustls#281, so I would suggest adding two features "native-tls" and "rusttls" for users to choose.

[Darkspirit]

That's not a blocker as it's common and wise to use TLS certificates with domain names for compatibility (dualstack IP) and security reasons (ACME DNS challenge), but yes, support for IPAddress SANs should/will be added: briansmith/webpki#54

[lucacasonato]

This has to be feature-gated.

So a full replacement of native-tls would not be accepted I assume?

[Dushistov]

So a full replacement of native-tls would not be accepted I assume?

Please don't make full replacement. For Rust program that used on Linux system from maintainer point of view native-tls is better,
because of native-tls = openssl on Linux, and this shared library and can be easily updated if there are security issues,
while with rustls you need update program. The same for Windows and MacOS where TLS library part of system, and updated via system updates, so you don't need publish new version of program.

[Darkspirit]

Translated: Please keep the higher risk for security problems to make it easier to update them. :-/
This could apply to other dependencies, but not to the minimalistic, audited and state of the start Rustls:
rustls (Read the Cure53 audit), webpki certificate validation and webpki-roots are written in safe Rust, ring is mostly assembly files for fast AES/etc. from Google's fork of OpenSSL (BoringSSL is used across Google and Chrome). Rustls is used by Cloudflare and Google as well.

[najamelan]

Good thing you don't have to choose and you don't even have to agree, because with features everyone can have it their way.

[babymotte]

I would also very much appreciate a way to opt out of native-tls, since it breaks compatibility with wasm.

[strohel]

Kudos go to @dnaka91 for submitting and perfecting a PR to implement this.