TLS

feature: tls

Enable

churust = { version = "0.3", features = ["tls"] }

# churust.toml
[tls]
cert = "cert.pem"
key  = "key.pem"

#![allow(unused)]
fn main() {
Churust::from_config()
    .routing(|r| { /* ... */ })
    .start()
    .await
}

Use the core helper to build a rustls acceptor from PEM files (see acceptor_from_pem on docs.rs) and the builder’s TLS setters for your version.

Setting	Meaning
`max_tls_handshakes`	Concurrent handshakes (asymmetric work)
`tls_handshake_timeout_ms`	Bounds queueing and the handshake itself

HTTP/2 over TLS is negotiated via ALPN. Plaintext h2c uses prior knowledge.

Prefer a reverse proxy (Caddy, nginx, Traefik) for cert automation when that fits your deploy model — or terminate TLS in-process with rustls when you need end-to-end in one binary.
Never enable HTTP Basic auth without TLS.