fn create_openssl_acceptor(
        gs: Arc<GlobalState>,
        cert: &TlsPayload,
    ) -> Result<ssl::SslAcceptorBuilder, ssl::Error> {
        use openssl::pkey::PKey;
        use openssl::rsa::Rsa;
        use openssl::x509::X509;

        let mut builder = ssl::SslAcceptor::mozilla_intermediate_v5(ssl::SslMethod::tls_server())?;

        // push the full-chain certificate into the SslAcceptorBuilder
        let mut full_chain = X509::stack_from_pem(cert.certificate.as_bytes())?.into_iter();
        if let Some(x509) = full_chain.next() {
            builder.set_certificate(&x509)?;
        }
        for x509 in full_chain {
            builder.add_extra_chain_cert(x509)?;
        }

        // push the private key to the SslAcceptorBuilder
        let priv_key = Rsa::private_key_from_pem(cert.private_key.as_bytes())?;
        builder.set_private_key(PKey::from_rsa(priv_key)?.as_ref())?;
        builder.check_private_key()?;

        // manually revert to the mozilla_old TLS standard if we're not enforcing secure TLS
        // https://wiki.mozilla.org/Security/Server_Side_TLS
        if !gs.config.enforce_secure_tls {
            builder.set_cipher_list(
                "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:\
                ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:\
                ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:\
                DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:\
                ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:\
                ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:\
                ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:\
                DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:\
                AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA",
            )?;
            builder.clear_options(ssl::SslOptions::NO_TLSV1 | ssl::SslOptions::NO_TLSV1_1);
            builder.set_min_proto_version(Some(ssl::SslVersion::TLS1))?;
        }

        // always use the server preference for ciphersuites
        // this will use faster algos
        builder.set_options(ssl::SslOptions::CIPHER_SERVER_PREFERENCE);

        // attempted optimizations
        builder.set_session_cache_mode(ssl::SslSessionCacheMode::SERVER);
        builder.set_session_cache_size(1024 * 4); // 4096 sessions (instead of the default 20000)
        builder.set_verify(ssl::SslVerifyMode::NONE);

        // register SNI check to reject invalid connections (if enabled)
        if gs.config.reject_invalid_sni {
            builder.set_servername_callback(move |ssl, _| Self::check_sni(&gs, ssl));
        }

        log::debug!("ssl options: {:?}", builder.options());
        Ok(builder)
    }
/// Converts a [`TLSPayload`] into an Ssl Builder that ActixWeb will use for TLS
Converts a [`TLSPayload`] into an Ssl Builder that ActixWeb will use for TLS
Converts a [ ` TLSPayload ` ] into an Ssl Builder that ActixWeb will use for TLS
fn create_openssl_acceptor(
        gs: Arc<GlobalState>,
        cert: &TlsPayload,
    ) -> Result<ssl::SslAcceptorBuilder, ssl::Error> {
        use openssl::pkey::PKey;
        use openssl::rsa::Rsa;
        use openssl::x509::X509;
        let mut builder = ssl::SslAcceptor::mozilla_intermediate_v5(ssl::SslMethod::tls_server())?;
        // push the full-chain certificate into the SslAcceptorBuilder
        let mut full_chain = X509::stack_from_pem(cert.certificate.as_bytes())?.into_iter();
        if let Some(x509) = full_chain.next() {
            builder.set_certificate(&x509)?;
        }
        for x509 in full_chain {
            builder.add_extra_chain_cert(x509)?;
        }
        // push the private key to the SslAcceptorBuilder
        let priv_key = Rsa::private_key_from_pem(cert.private_key.as_bytes())?;
        builder.set_private_key(PKey::from_rsa(priv_key)?.as_ref())?;
        builder.check_private_key()?;
        // manually revert to the mozilla_old TLS standard if we're not enforcing secure TLS
        // https://wiki.mozilla.org/Security/Server_Side_TLS
        if !gs.config.enforce_secure_tls {
            builder.set_cipher_list(
                "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:\
                ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:\
                ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:\
                DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:\
                ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:\
                ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:\
                ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:\
                DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:\
                AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA",
            )?;
            builder.clear_options(ssl::SslOptions::NO_TLSV1 | ssl::SslOptions::NO_TLSV1_1);
            builder.set_min_proto_version(Some(ssl::SslVersion::TLS1))?;
        }
        // always use the server preference for ciphersuites
        // this will use faster algos
        builder.set_options(ssl::SslOptions::CIPHER_SERVER_PREFERENCE);
        // attempted optimizations
        builder.set_session_cache_mode(ssl::SslSessionCacheMode::SERVER);
        builder.set_session_cache_size(1024 * 4); // 4096 sessions (instead of the default 20000)
        builder.set_verify(ssl::SslVerifyMode::NONE);
        // register SNI check to reject invalid connections (if enabled)
        if gs.config.reject_invalid_sni {
            builder.set_servername_callback(move |ssl, _| Self::check_sni(&gs, ssl));
        }
        log::debug!("ssl options: {:?}", builder.options());
        Ok(builder)
    }
fn create_openssl_acceptor ( gs : Arc < GlobalState > , cert : & TlsPayload , ) -> Result < ssl :: SslAcceptorBuilder , ssl :: Error > { use openssl :: pkey :: PKey ; use openssl :: rsa :: Rsa ; use openssl :: x509 :: X509 ; let mut builder = ssl :: SslAcceptor :: mozilla_intermediate_v5 ( ssl :: SslMethod :: tls_server ( ) ) ? ; // push the full-chain certificate into the SslAcceptorBuilder let mut full_chain = X509 :: stack_from_pem ( cert . certificate . as_bytes ( ) ) ? . into_iter ( ) ; if let Some ( x509 ) = full_chain . next ( ) { builder . set_certificate ( & x509 ) ? ; } for x509 in full_chain { builder . add_extra_chain_cert ( x509 ) ? ; } // push the private key to the SslAcceptorBuilder let priv_key = Rsa :: private_key_from_pem ( cert . private_key . as_bytes ( ) ) ? ; builder . set_private_key ( PKey :: from_rsa ( priv_key ) ? . as_ref ( ) ) ? ; builder . check_private_key ( ) ? ; // manually revert to the mozilla_old TLS standard if we're not enforcing secure TLS // https://wiki.mozilla.org/Security/Server_Side_TLS if ! gs . config . enforce_secure_tls { builder . set_cipher_list ( " \
 \
 \
 \
 \
 \
 \
 \
 " , ) ? ; builder . clear_options ( ssl :: SslOptions :: NO_TLSV1 | ssl :: SslOptions :: NO_TLSV1_1 ) ; builder . set_min_proto_version ( Some ( ssl :: SslVersion :: TLS1 ) ) ? ; } // always use the server preference for ciphersuites // this will use faster algos builder . set_options ( ssl :: SslOptions :: CIPHER_SERVER_PREFERENCE ) ; // attempted optimizations builder . set_session_cache_mode ( ssl :: SslSessionCacheMode :: SERVER ) ; builder . set_session_cache_size ( 1024 * 4 ) ; // 4096 sessions (instead of the default 20000) builder . set_verify ( ssl :: SslVerifyMode :: NONE ) ; // register SNI check to reject invalid connections (if enabled) if gs . config . reject_invalid_sni { builder . set_servername_callback ( move | ssl , _ | Self :: check_sni ( & gs , ssl ) ) ; } log :: debug ! ( " " builder options ( ) ) ; Ok ( builder ) }
Converts a [`TLSPayload`] into an Ssl Builder that ActixWeb will use for TLS
Converts a [ ` TLSPayload ` ] into an Ssl Builder that ActixWeb will use for TLS
gs
Arc<GlobalState>
cert
&TlsPayload