Add ability to use rustls instead of openssl

[svenstaro]

Is it possible to use rustls instead of OpenSSL for certainly? I think it'd make sense to have a rust-only native package which would make it easier to ship the tool to other platform without having to provide OpenSSL.

[passcod]

"rust-only" sounds like a good idea.

However, neither rustls nor webpki (what rustls uses for cert validation) can be used, as rustls is uniquely focused on TLS connections and webpki is uniquely focused on verifying certificates, and as such neither can be used to create certificates.

Thus we would have to use either something else, or to use ring directly, which I'm gonna call as "out of scope for this project" due to the complexity. If there's a crate that can do openssl-like generation of certificates based on ring, I'll happily go with it, but otherwise, er, sorry.

[svenstaro]

So there is https://github.com/est31/rcgen which only needs OpenSSL for development. I just created a certificate with that and without OpenSSL. Might wanna take a look. :D

[passcod]

Oh, good. We'd still need to use build extensions directly, but it's probably doable then.

[est31]

rcgen maintainer here. I support any efforts of adopting rcgen. If some feature is missing in rcgen, please file a bug!

[passcod]

Certainly supports, and therefore needs:

• other types of SANs, not just dns names
• the client and server auth extension flag things
• the pathlen or maxpathlen basic constraint

I think this can all be done just by writing raw extensions and ignoring rcgen's SANs support, though.

[est31]

@passcod which SAN types do you need in specific? There is a list here: https://tools.ietf.org/html/rfc5280#section-4.2.1.6 (preceeded by "GeneralName ::= CHOICE {").

[passcod]

dns and ip. Possibly email, just because I could see that come up later, but certainly not any of the others as I don't think there's a common use for those at all.

[est31]

@passcod the 0.6.0 release of rcgen should contain all the things you listed in your comment above.

[passcod]

Thanks! I'll go rewrite openssl out... this weekend or so.

[passcod]

Almost done, I just want to add RSA support without OpenSSL now.

[passcod]

Depends on rustls/rcgen#25

[passcod]

Done in 1.7.0

[svenstaro]

Super nice!