Skip to content

feat: consolidate TLS options with rustls-platform-verifier - #2891

Merged
seanmonstar merged 1 commit into
masterfrom
sean/rustls-consolidate-platform-verifier
Dec 23, 2025
Merged

feat: consolidate TLS options with rustls-platform-verifier#2891
seanmonstar merged 1 commit into
masterfrom
sean/rustls-consolidate-platform-verifier

Conversation

@seanmonstar

@seanmonstar seanmonstar commented Dec 15, 2025 •
edited
Loading

Copy link
Copy Markdown
Owner

This includes two logical change groups, done together because the intermediate step is not really useful.

  1. This makes rustls-platform-verifier the default verifier, and removes the ability to use rustls with webpki or native roots directly.
  2. This soft-deprecates many of the TLS-related builder methods, providing better names that are clearer and autocomplete better.

This greatly simplifies the configuration matrix of what could be enabled, but also means the removal of some parts that some people may have been using. The consolidated API should still allow users to do these things.

For example, instead of adding webpki-roots with a feature flag, you should use the webpki-roots crate yourself, and pass them into tls_certs_only(certs).

Closes #2885

@seanmonstar
seanmonstar changed the base branch from rustls-default to master December 15, 2025 20:43
@seanmonstar
seanmonstar force-pushed the sean/rustls-consolidate-platform-verifier branch 2 times, most recently from 8ab4e3a to 530e5a9 Compare December 15, 2025 20:56
@seanmonstar
seanmonstar changed the base branch from master to rustls-default December 15, 2025 20:57
@seanmonstar
seanmonstar force-pushed the sean/rustls-consolidate-platform-verifier branch 13 times, most recently from 1ee5846 to caacb84 Compare December 16, 2025 14:57
@ofek

ofek commented Dec 16, 2025

Copy link
Copy Markdown

Thanks! Heads up that the final sentence of the first step in the PR description appears to have been cut off.

jlizen
jlizen approved these changes Dec 17, 2025
View reviewed changes

@jlizen jlizen left a comment •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall changes LGTM, very reasonable to simplify config, and have it be "bring your own certs"if you want non-platform-verifier.

Though, it would be nice to have a bit more docs on these options outside of config doc comments, for instance in the tls module docs. In particular, an example showing "bring your own webpki roots" would be really nice since the turnkey functionality is being deprecated.

It also probably is worth clearly stating what the default is (platform verifier) and what that means (system certs).

Comment thread src/async_impl/client.rs
@seanmonstar
seanmonstar force-pushed the sean/rustls-consolidate-platform-verifier branch from caacb84 to 57cfa07 Compare December 23, 2025 14:05
@seanmonstar
seanmonstar force-pushed the rustls-default branch 4 times, most recently from fa76283 to 0d0dffc Compare December 23, 2025 15:09
Base automatically changed from rustls-default to master December 23, 2025 15:40
@seanmonstar
seanmonstar force-pushed the sean/rustls-consolidate-platform-verifier branch from 57cfa07 to d5564d1 Compare December 23, 2025 15:41
@seanmonstar
feat: consolidate TLS options with rustls-platform-verifier
a59cdeb 
This includes two logical change groups, done together because the intermediate
step is not really useful.

1. This makes rustls-platform-verifier the default verifier, and removes the
   ability to use rustls with webpki or native roots directly. That includes
2. This soft-deprecates many of the TLS-related builder methods, providing
   better names that are clearer and autocomplete better.

This greatly simplifies the configuration matrix of what could be enabled, but
also means the removal of some parts that some people may have been using. The
consolidated API should still _allow_ users to do these things.

For example, instead of adding webpki-roots with a feature flag, you should use
the webpki-roots crate yourself, and pass them into `tls_certs_only(certs)`.
@seanmonstar
seanmonstar force-pushed the sean/rustls-consolidate-platform-verifier branch from d5564d1 to a59cdeb Compare December 23, 2025 15:57
@seanmonstar
seanmonstar merged commit d506978 into master Dec 23, 2025
38 checks passed
@seanmonstar
seanmonstar deleted the sean/rustls-consolidate-platform-verifier branch December 23, 2025 16:23
@ofek ofek mentioned this pull request Dec 23, 2025
Closed
kodiakhq Bot pushed a commit to pdylanross/fatigue that referenced this pull request Dec 31, 2025
@dependabot
chore: Bump reqwest from 0.12.28 to 0.13.1 (#461)
cfe63ff 
Bumps reqwest from 0.12.28 to 0.13.1.

Release notes
Sourced from reqwest's releases.

v0.13.1
What's Changed

http3: depend on quinn/rustls-aws-lc-rs to avoid ring dependency by @​djc in seanmonstar/reqwest#2917
fix rustls on android by @​seanmonstar in seanmonstar/reqwest#2918

Full Changelog: seanmonstar/reqwest@v0.13.0...v0.13.1
v0.13.0
Breaking changes

rustls is now the default TLS backend, instead of native-tls.
rustls crypto provider defaults to aws-lc instead of ring. (rustls-no-provider exists if you want a different crypto provider)
rustls-tls has been renamed to rustls.
rustls roots features removed, rustls-platform-verifier is used by default.

To use different roots, call tls_certs_only(your_roots).


native-tls now includes ALPN. To disable, use native-tls-no-alpn.
query and form are now crate features, disabled by default.
Long-deprecated methods and crate features have been removed (such as trust-dns, which was renamed hickory-dns a while ago).
Many TLS-related methods renamed to improve autocompletion and discovery, but previous name left in place with a "soft" deprecation. (just documented, no warnings)

For example, prefer tls_backend_rustls() over use_rustls_tls().



Pull Requests in General

start 0.13 dev by @​seanmonstar in seanmonstar/reqwest#2894
Make serde optional by introducing query, form features, and re-working WASM header parsing by @​CathalMullan in seanmonstar/reqwest#2858
replace ClientBuilder::dns_resolver with dns_resolver2 by @​seanmonstar in seanmonstar/reqwest#2898
feat: make Rustls the default TLS provider by @​calavera in seanmonstar/reqwest#2897
feat: consolidate TLS options with rustls-platform-verifier by @​seanmonstar in seanmonstar/reqwest#2891
remove long-deprecated methods: trust-dns and non-wasm-cors by @​seanmonstar in seanmonstar/reqwest#2899
rename rustls-tls feature to just rustls by @​seanmonstar in seanmonstar/reqwest#2900
remove deprecated features trust-dns and macos-system-configuration by @​seanmonstar in seanmonstar/reqwest#2901
chore: separate rustls and rustls-no-provider features by @​seanmonstar in seanmonstar/reqwest#2903
rustls: allow windows to use extra roots by @​seanmonstar in seanmonstar/reqwest#2904
v0.13.0-rc.1 by @​seanmonstar in seanmonstar/reqwest#2905
Enable ALPN by default in native-tls by @​ducaale in seanmonstar/reqwest#2907
v0.13.0 by @​seanmonstar in seanmonstar/reqwest#2915

New Contributors

@​CathalMullan made their first contribution in seanmonstar/reqwest#2858

Full Changelog: seanmonstar/reqwest@v0.12.28...v0.13.0
v0.13.0-rc.1
👀 Discussion here if you give it try, thanks!
Main breaking changes

rustls is now default instead of native-tls
rustls provider defaults to aws-lc instead of ring (rustls-no-provider exists if you want to enable a different one)
rustls-tls renamed to rustls
rustls roots features removed, platform-verifier is used instead



... (truncated)


Changelog
Sourced from reqwest's changelog.

v0.13.1

Fixes compiling with rustls on Android targets.

v0.13.0

Breaking changes:

rustls is now the default TLS backend, instead of native-tls.
rustls crypto provider defaults to aws-lc instead of ring. (rustls-no-provider exists if you want a different crypto provider)
rustls-tls has been renamed to rustls.
rustls roots features removed, rustls-platform-verifier is used by default.

To use different roots, call tls_certs_only(your_roots).


native-tls now includes ALPN. To disable, use native-tls-no-alpn.
query and form are now crate features, disabled by default.
Long-deprecated methods and crate features have been removed (such as trust-dns, which was renamed hickory-dns a while ago).


Many TLS-related methods renamed to improve autocompletion and discovery, but previous name left in place with a "soft" deprecation. (just documented, no warnings)

For example, prefer tls_backend_rustls() over use_rustls_tls().






Commits

10fb98c v0.13.1
438098a chore: refer to h2 as dep:h2 (#2919)
43aac91 chore(ci): bump actions/checkout from 5 to 6 (#2864)
175f5b2 fix rustls on android (#2918)
1afe88e Depend on quinn/rustls-aws-lc-rs to avoid ring dependency (#2917)
62a80af v0.13.0
e8d89f4 enable ALPN by default in native-tls (#2907)
9a9daa7 v0.13.0-rc.1
d518e45 rustls: allow windows to use extra roots (#2904)
934bc84 chore: separate rustls and rustls-no-provider features (#2903)
Additional commits viewable in compare view




Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@csett86 csett86 mentioned this pull request Dec 31, 2025
Closed
@ducaale ducaale mentioned this pull request Jan 1, 2026
Merged
@milliams milliams mentioned this pull request Jan 8, 2026
Open
@yuvald-sweet-security

yuvald-sweet-security commented Jan 26, 2026

Copy link
Copy Markdown

Hey,
Regarding the following line:

For example, instead of adding webpki-roots with a feature flag, you should use the webpki-roots crate yourself, and pass them into tls_certs_only(certs).

How is this expected to work? to the best of my understanding, webpki_roots::TLS_SERVER_ROOTS are TrustAnchor objects, which are not full certificates (per the object's documentation). However, tls_certs_only requires reqwest::tls::Certificate objects, which can only be built from pem or der encoded certificates.

@seanmonstar what is the recommended way to build a reqwest client with the roots from webpki-roots now?

@cpu

cpu commented Jan 26, 2026

Copy link
Copy Markdown
Contributor

webpki_roots::TLS_SERVER_ROOTS are TrustAnchor objects, which are not full certificates (per the object's documentation).

If you need the DER encoded certificates there is a companion crate webpki-root-certs where TLS_SERVER_ROOT_CERTS holds the full CertificateDer instead of a more minimal TrustAnchor representation.

@seanmonstar

seanmonstar commented Jan 26, 2026

Copy link
Copy Markdown
Owner Author

Indeed, like that. But it's been asked a couple times, I figured I'd open up a related discussion: #2951

konstin added a commit to konstin/axoasset that referenced this pull request Feb 11, 2026
@konstin
Update reqwest to 0.13
5a77357 
reqwest 0.13 switched from native-tls by default to rustls by default, and also switched to rustls-platform-verifier (seanmonstar/reqwest#2891). This means that two features that axoasset currently uses or exposes, rustls-tls-native-roots and rustls-tls-webpki-roots, don't exist anymore. While axoasset is technically compatible with reqwest 0.13, cargo blocks the update due to the missing features:

```
error: failed to select a version for `reqwest`.
    ... required by package `axoasset v1.5.0 (/home/konsti/projects/axoasset)`
versions that meet the requirements `>=0.13.0` are: 0.13.2, 0.13.1, 0.13.0

package `axoasset` depends on `reqwest` with feature `rustls-tls-webpki-roots` but `reqwest` does not have that feature.

failed to select a version for `reqwest` which could resolve this conflict
```

I'm not aware of a way to expose feature conditionally depending on the package version with Cargo. This PR proposes to bump reqwest to a minimum of 0.13.

I'm not sure if to consider that a breaking change, as we do update inside a compatible range, but if you have `axoasset::AxoClient::with_reqwest(reqwest::Client::new())` in your code and use reqwest 0.12, it will cause an error. Cargo doesn't see that reqwest as a dependency is part of the public API and needs to match the caller's version.
@konstin konstin mentioned this pull request Feb 11, 2026
Merged
konstin added a commit to konstin/axoasset that referenced this pull request Feb 12, 2026
@konstin
Update reqwest to 0.13
ba0b591 
reqwest 0.13 switched from native-tls by default to rustls by default, and also switched to rustls-platform-verifier (seanmonstar/reqwest#2891). This means that two features that axoasset currently uses or exposes, rustls-tls-native-roots and rustls-tls-webpki-roots, don't exist anymore. While axoasset is technically compatible with reqwest 0.13, cargo blocks the update due to the missing features:

```
error: failed to select a version for `reqwest`.
    ... required by package `axoasset v1.5.0 (/home/konsti/projects/axoasset)`
versions that meet the requirements `>=0.13.0` are: 0.13.2, 0.13.1, 0.13.0

package `axoasset` depends on `reqwest` with feature `rustls-tls-webpki-roots` but `reqwest` does not have that feature.

failed to select a version for `reqwest` which could resolve this conflict
```

I'm not aware of a way to expose feature conditionally depending on the package version with Cargo. This PR proposes to bump reqwest to a minimum of 0.13.

I'm not sure if to consider that a breaking change, as we do update inside a compatible range, but if you have `axoasset::AxoClient::with_reqwest(reqwest::Client::new())` in your code and use reqwest 0.12, it will cause an error. Cargo doesn't see that reqwest as a dependency is part of the public API and needs to match the caller's version.
konstin added a commit to konstin/axoasset that referenced this pull request Feb 12, 2026
@konstin
Update reqwest to 0.13
a26e773 
reqwest 0.13 switched from native-tls by default to rustls by default, and also switched to rustls-platform-verifier (seanmonstar/reqwest#2891). This means that two features that axoasset currently uses or exposes, rustls-tls-native-roots and rustls-tls-webpki-roots, don't exist anymore. While axoasset is technically compatible with reqwest 0.13, cargo blocks the update due to the missing features:

```
error: failed to select a version for `reqwest`.
    ... required by package `axoasset v1.5.0 (/home/konsti/projects/axoasset)`
versions that meet the requirements `>=0.13.0` are: 0.13.2, 0.13.1, 0.13.0

package `axoasset` depends on `reqwest` with feature `rustls-tls-webpki-roots` but `reqwest` does not have that feature.

failed to select a version for `reqwest` which could resolve this conflict
```

I'm not aware of a way to expose feature conditionally depending on the package version with Cargo. This PR proposes to bump reqwest to a minimum of 0.13.

I'm not sure if to consider that a breaking change, as we do update inside a compatible range, but if you have `axoasset::AxoClient::with_reqwest(reqwest::Client::new())` in your code and use reqwest 0.12, it will cause an error. Cargo doesn't see that reqwest as a dependency is part of the public API and needs to match the caller's version.
@poljar poljar mentioned this pull request Mar 19, 2026
Closed
@chris-olszewski chris-olszewski mentioned this pull request Mar 27, 2026
Merged
@flip1995 flip1995 mentioned this pull request May 20, 2026
Merged
@coderabbitai coderabbitai Bot mentioned this pull request Jun 27, 2026
Merged
@torokati44 torokati44 mentioned this pull request Jul 15, 2026
Merged
5 tasks
mkatychev added a commit to bytecodealliance/wasm-pkg-tools that referenced this pull request Jul 27, 2026
@mkatychev
chore(cargo): bump all cargo dependencies to breaking latest (#242)
dfa2e17 
Ran [`cargo upgrade
--incompatible`](https://github.com/killercup/cargo-edit) on repo.

* `sha2@0.11`: hex encoding moved to `base16ct` crate
* `reqwest@0.13.4`
  * `rusttls-tls` renamed to `rustls`
* `macos-system-configuration` removed in reqwest/2901[^1] after
reqwest/2891[^2] ""

[^1]: [remove deprecated features trust-dns and
macos-system-configuration](seanmonstar/reqwest#2901)
[^2]: [feat: consolidate TLS options with
rustls-platform-verifier](seanmonstar/reqwest#2891)
@codspeed-hq codspeed-hq Bot mentioned this pull request Aug 6, 2026
Closed
@coderabbitai coderabbitai Bot mentioned this pull request Aug 19, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

2 more reviewers
@ofek ofek ofek left review comments
@jlizen jlizen jlizen approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Consolidate TLS options with rustls-platform-verifier

5 participants

@seanmonstar @ofek @yuvald-sweet-security @cpu @jlizen