#tls-certificate #tls #rustls #actix-web #resolver #live-reloading #ruslts


A simple single-cert channel-ish rustls resolver for live-reloading certificate files

2 unstable releases

0.2.0 Feb 4, 2024
0.1.0 Jan 31, 2024

#1452 in Cryptography

Download history 174/week @ 2024-01-29 192/week @ 2024-02-05 21/week @ 2024-02-12 21/week @ 2024-02-19 51/week @ 2024-02-26 94/week @ 2024-03-04 54/week @ 2024-03-11 25/week @ 2024-03-18 13/week @ 2024-03-25 79/week @ 2024-04-01

176 downloads per month
Used in 5 crates


111 lines


A simple channel-like resolver for live-reloading TLS certificates


Add the dependency to your project

cargo add rustls-channel-resolver

Configure live-reloading for your certificate file

use std::time::Duration;

use actix_web::{web, App, HttpServer};

async fn index() -> &'static str {
    "Hewwo Mr Obama"

async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let initial_key = read_key().await?.unwrap();

    let (tx, rx) = rustls_channel_resolver::channel::<32>(initial_key);

    let handle = actix_web::rt::spawn(async move {
        let mut interval = actix_web::rt::time::interval(Duration::from_secs(30));

        loop {
            match read_key().await {
                Ok(Some(key)) => tx.update(key),
                Ok(None) => eprintln!("No key in keyfile"),
                Err(e) => {
                    eprintln!("Failed to read key from fs {e}");

    let server_config = rustls::ServerConfig::builder()

    HttpServer::new(|| App::new().route("/", web::get().to(index)))
        .bind_rustls_0_22("", server_config)?

    let _ = handle.await;

async fn read_key() -> Result<Option<rustls::sign::CertifiedKey>, Box<dyn std::error::Error>> {
    let cert_bytes = tokio::fs::read("./out/example.crt").await?;
    let certs = rustls_pemfile::certs(&mut cert_bytes.as_slice())
        .collect::<Result<Vec<_>, _>>()?;

    let key_bytes = tokio::fs::read("./out/example.key").await?;
    let Some(private_key) = rustls_pemfile::private_key(&mut key_bytes.as_slice())? else {
        return Ok(None);

    let private_key =

    Ok(Some(rustls::sign::CertifiedKey::new(certs, private_key)))


Feel free to open issues for anything you find an issue with. Please note that any contributed code will be licensed under the AGPLv3.


Copyright © 2024 asonix

rustls-channel-resolver is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

rustls-channel-resolver is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details. This file is part of rustls-channel-resolver.

You should have received a copy of the GNU Affero General Public License along with rustls-channel-resolver. If not, see http://www.gnu.org/licenses/.


~274K SLoC