bext-tls

TLS termination and automatic ACME certificate issuance for bext.

Part of the bext stack.

[dependencies]
bext-tls = "0.2"

What this crate is

bext-tls is bext's TLS layer. It handles TLS termination with rustls, automatic certificate issuance via ACME (Let's Encrypt, ZeroSSL), SNI routing, OCSP stapling, and on-demand certificate management for multi-tenant deployments.

It can be used standalone in any Rust server that needs a 'it just works' TLS story — configure ACME, point it at your cert store, and let it handle renewals.

Features

• rustls under the hood — no OpenSSL, pure Rust.
• ACME (RFC 8555) — automatic certificate issuance and renewal.
• SNI routing — serve different certs per hostname.
• OCSP stapling (RFC 6960) — automatic, zero-config.
• On-demand TLS — issue certs for hostnames the first time they're requested.
• SQLite-backed cert store — certificates survive restarts.
• Self-signed fallback — for dev and local environments.

License

Business Source License 1.1 — see LICENSE.md in this crate for the full text.

In plain English: production use on your own infrastructure is fully permitted. You may NOT offer this crate to third parties as a hosted or managed service that provides access to a substantial set of its features.

Change Date: 2030-04-11. On that date this crate automatically converts to the MIT License with no further restrictions.

Questions about commercial licensing? Open an issue at github.com/bext-stack/bext with the licensing label.

See also

• github.com/bext-stack/bext — the bext meta repo
• Full ecosystem — all bext crates at a glance