Skip to content

crypto: migrate server TLS to rustls (server-core, pgwire) - #36086

Draft
jasonhernandez wants to merge 2 commits into
mainfrom
jason/crypto-tls-2-server
Draft

crypto: migrate server TLS to rustls (server-core, pgwire)#36086
jasonhernandez wants to merge 2 commits into
mainfrom
jason/crypto-tls-2-server

Conversation

@jasonhernandez

@jasonhernandez jasonhernandez commented Apr 15, 2026 •
edited by def-
Loading

Copy link
Copy Markdown
Contributor

Summary

Split 2/6 of the TLS migration from OpenSSL to rustls.

Migrates the server-side TLS acceptor used by pgwire and all services that accept inbound TLS connections:

  • mz-server-core: Replace openssl::SslAcceptor with ReloadingServerConfig from mz-tls-util. Update TlsCsrfProtection to extract SNI from rustls instead of openssl.
  • mz-pgwire: Switch pgwire server's TLS handshake from tokio-openssl to tokio-rustls. Drop openssl dependency.

Dependency chain

#35940 → split 1 (#36085) → this PR → splits 4, 5

Test plan

  • cargo check passes for mz-server-core, mz-pgwire
  • pgwire TLS connections work end-to-end (validated via environmentd auth tests in split 5)

🤖 Generated with Claude Code

Part of SEC-218.

@github-actions

github-actions Bot commented Apr 15, 2026

Copy link
Copy Markdown
Contributor

Thanks for opening this PR! Here are a few tips to help make the review process smooth for everyone.

PR title guidelines

  • Use imperative mood: "Fix X" not "Fixed X" or "Fixes X"
  • Be specific: "Fix panic in catalog sync when controller restarts" not "Fix bug" or "Update catalog code"
  • Prefix with area if helpful: compute: , storage: , adapter: , sql:

Pre-merge checklist

  • The PR title is descriptive and will make sense in the git log.
  • This PR has adequate test coverage / QA involvement has been duly considered. (trigger-ci for additional test/nightly runs)
  • If this PR includes major user-facing behavior changes, I have pinged the relevant PM to schedule a changelog post.
  • This PR has an associated up-to-date design doc, is a design doc (template), or is sufficiently small to not require a design.
  • If this PR evolves an existing $T ⇔ Proto$T mapping (possibly in a backwards-incompatible way), then it is tagged with a T-proto label.
  • If this PR will require changes to cloud orchestration or tests, there is a companion cloud PR to account for those changes that is tagged with the release-blocker label (example).

jasonhernandez and others added 2 commits July 7, 2026 00:48
@jasonhernandez @claude
crypto: add core crypto infrastructure (mz-ore crypto module)
f55b710 
Add rustls, aws-lc-rs, hyper-rustls, rcgen, tokio-rustls workspace deps
and the mz-ore `crypto` feature with FIPS-aware CryptoProvider helpers.
Azure SDK forks patched to support reqwest-rustls-no-provider.
Removes the rustls ban from deny.toml.

Does NOT bump LaunchDarkly SDK (deferred to end of migration).

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
@jasonhernandez @claude
crypto: migrate server TLS to rustls (server-core, pgwire)
fa32ae3 
Switch the TLS acceptor in server-core and pgwire from openssl to rustls.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
@jasonhernandez
jasonhernandez force-pushed the jason/crypto-tls-2-server branch from e4e901a to fa32ae3 Compare July 7, 2026 08:12
@jasonhernandez jasonhernandez mentioned this pull request Jul 9, 2026
Closed
@jasonhernandez jasonhernandez mentioned this pull request Sep 30, 2026
Open

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jasonhernandez