Skip to content

crypto: migrate client TLS to rustls (postgres-util, ccsr) - #36087

Draft
jasonhernandez wants to merge 2 commits into
mainfrom
jason/crypto-tls-3-pg-client
Draft

crypto: migrate client TLS to rustls (postgres-util, ccsr)#36087
jasonhernandez wants to merge 2 commits into
mainfrom
jason/crypto-tls-3-pg-client

Conversation

@jasonhernandez

@jasonhernandez jasonhernandez commented Apr 15, 2026 •
edited by def-
Loading

Copy link
Copy Markdown
Contributor

Summary

Split 3/6 of the TLS migration from OpenSSL to rustls.

Migrates client-side TLS connectors used for outbound Postgres and Schema Registry connections:

  • mz-postgres-util: Replace postgres-openssl::MakeTlsConnector with tokio-postgres-rustls::MakeRustlsConnect. Update tunnel.rs TLS config to build rustls::ClientConfig instead of openssl::SslConnector.
  • mz-postgres-client: Update re-export from postgres_openssl to tokio_postgres_rustls.
  • mz-ccsr: Switch tls.rs certificate loading from openssl::X509 to rustls_pki_types::CertificateDer.

Dependency chain

#35940 → split 1 (#36085) → this PR → split 6

Test plan

  • cargo check passes for mz-postgres-util, mz-postgres-client, mz-ccsr
  • Postgres source/sink connections with TLS still work

🤖 Generated with Claude Code

Part of SEC-192.

@github-actions

github-actions Bot commented Apr 15, 2026

Copy link
Copy Markdown
Contributor

Thanks for opening this PR! Here are a few tips to help make the review process smooth for everyone.

PR title guidelines

  • Use imperative mood: "Fix X" not "Fixed X" or "Fixes X"
  • Be specific: "Fix panic in catalog sync when controller restarts" not "Fix bug" or "Update catalog code"
  • Prefix with area if helpful: compute: , storage: , adapter: , sql:

Pre-merge checklist

  • The PR title is descriptive and will make sense in the git log.
  • This PR has adequate test coverage / QA involvement has been duly considered. (trigger-ci for additional test/nightly runs)
  • If this PR includes major user-facing behavior changes, I have pinged the relevant PM to schedule a changelog post.
  • This PR has an associated up-to-date design doc, is a design doc (template), or is sufficiently small to not require a design.
  • If this PR evolves an existing $T ⇔ Proto$T mapping (possibly in a backwards-incompatible way), then it is tagged with a T-proto label.
  • If this PR will require changes to cloud orchestration or tests, there is a companion cloud PR to account for those changes that is tagged with the release-blocker label (example).

jasonhernandez and others added 2 commits July 7, 2026 00:48
@jasonhernandez @claude
crypto: add core crypto infrastructure (mz-ore crypto module)
f55b710 
Add rustls, aws-lc-rs, hyper-rustls, rcgen, tokio-rustls workspace deps
and the mz-ore `crypto` feature with FIPS-aware CryptoProvider helpers.
Azure SDK forks patched to support reqwest-rustls-no-provider.
Removes the rustls ban from deny.toml.

Does NOT bump LaunchDarkly SDK (deferred to end of migration).

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
@jasonhernandez @claude
crypto: migrate client TLS to rustls (postgres-util, postgres-client,…
5bd7628 
… ccsr)

Switch postgres client TLS connectors and ccsr from openssl to rustls.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
@jasonhernandez
jasonhernandez force-pushed the jason/crypto-tls-3-pg-client branch from 5902a40 to 5bd7628 Compare July 7, 2026 08:07
@jasonhernandez jasonhernandez mentioned this pull request Jul 9, 2026
Closed

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jasonhernandez