Module Neodriver_eio.Tls_client

TLS client settings: the trust anchors (System, Trust_all or custom certificates) used to validate server certificates.

TLS client wrapper for the bolt+s / bolt+ssc URI schemes.

type trust =
  1. | System
  2. | Trust_all
  3. | Custom of X509.Certificate.t list
    (*

    How the server certificate is validated:

    • System: against the operating system's trust store (bolt+s).
    • Trust_all: accept any certificate (bolt+ssc).
    • Custom certs: only the given trust anchors (the explicit trusted_certificates configuration). The host is still checked against the leaf certificate.
    *)
type client_certificate = {
  1. chain : X509.Certificate.t list;
    (*

    The certificate chain, leaf first.

    *)
  2. key : X509.Private_key.t;
    (*

    The private key matching the leaf certificate.

    *)
}

A client certificate (mTLS) presented to the server.

type config = {
  1. trust : trust;
  2. host : string;
  3. client_certificate : (unit -> client_certificate) option;
    (*

    Supplies the client certificate for the handshake. A provider (rather than a value) so a rotating certificate is re-read on every connection.

    *)
}

host is used for SNI and hostname verification (ignored for Trust_all).

val wrap : config -> [ Eio.Flow.two_way_ty | Eio.Resource.close_ty ] Eio.Resource.t -> ([ Eio.Flow.two_way_ty | Eio.Resource.close_ty ] Eio.Resource.t, Neodriver_core.Errors.t) Stdlib.result

Wrap socket in TLS, completing the TLS handshake.

  • returns

    Error (Certificate_configuration_error _) if the trust store or TLS configuration cannot be set up, or Error (Service_unavailable _) if the handshake fails.