{"slug": "rustls", "name": "rustls", "category": "dev-libs", "category_name": "Libraries and frameworks", "description": "", "recommenders": 3, "commenters": 4, "warners": 0, "score": 2.982, "rising": 0.35, "first": "2025-12-13", "latest": "2026-10-20", "why": "I replaced it with rust tls to remove the dynamic linked library.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 1, "compare": 0, "warn": 0}, "spark": [0, 1, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "I replaced it with rust tls to remove the dynamic linked library.", "icon": true, "domain": null, "github_repo": "github.com/rustls/webpki", "official_url": "https://github.com/rustls/rustls", "pricing": "", "aliases": ["rustls"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 790108162, "item_id": 49381760, "url": "https://news.ycombinator.com/item?id=49381760", "by": "maria7676", "date": "2026-08-20", "stance": "recommend", "quote": "instead uses rustls", "excerpt": "Fast and modern web application firewall made in Rust, uses vectorscan for match rules, have geolocation for IP addrnin logs, automatons, have reDoS protection, and dont uses OpenSSL to prevent Future cves like heartBleed, instead uses rustls... Have frontend with 2fa,auth,plots,acl log view, rules management... https://github.com/Orangewarrior/KrakenWaf", "context": "", "use_case": "TLS", "switched_from": "", "story": "KrakenWAF"}, {"id": 775506064, "item_id": 48469129, "url": "https://news.ycombinator.com/item?id=48469129", "by": "ianm218", "date": "2026-06-09", "stance": "recommend", "quote": "rustls (modern memory safe OpenSSL)", "excerpt": "I have been working on the same problem in other areas. My ultimate goal is to rewrite nginx in Rust passing as much as the upstream tests as possible while leveraging the strongest aspects of Ruts ecosystem - i.e. rustls (modern memory safe OpenSSL), Tokio (async runtime), h2 (http 2 impl) rather than implementing from scratch like the upstream. I started with Lua, then porting over Valkey, and now working on nginx.", "context": "", "use_case": "TLS in nginx port", "switched_from": "", "story": "Grit: Rewriting Git in Rust with Agents"}, {"id": 740050864, "item_id": 46253179, "url": "https://news.ycombinator.com/item?id=46253179", "by": "larusso", "date": "2025-12-13", "stance": "recommend", "quote": "I replaced it with rust tls to remove the dynamic linked library.", "excerpt": "I think this is true for nearly all compiled languages. I had the same fun with rust and openSSL and glibC. OP didn\u2019t mentioned the fun with glib-c when compiling on a fairly recent distro and trying it to run on an older one. There is the \u201cmany Linux\u201d project which provides docker images with a minimum glib c version installed so it\u2019s compatible with newer ones. The switch to a newer open ssl version on Debian/Ubunt", "context": "", "use_case": "static TLS in Rust tool", "switched_from": "OpenSSL", "story": "Go is portable, until it isn't"}]}], "caveats": [], "who": [], "tags": [], "use_cases": ["certificate verification", "tls", "tls in nginx port", "static tls in rust tool"], "compared": [{"slug": "openssl", "name": "OpenSSL", "co": 4, "switched_from": 1, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=50160877", "title": "Go will reject certificate chains containing eight distrusted SPKIs", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49381759", "title": "KrakenWAF", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48466812", "title": "Grit: Rewriting Git in Rust with Agents", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46180911", "title": "Go is portable, until it isn't", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {"recommend": 1}, "2026-01": {}, "2026-02": {}, "2026-03": {}, "2026-04": {}, "2026-05": {}, "2026-06": {"recommend": 1}, "2026-07": {}, "2026-08": {"recommend": 1}, "2026-09": {}, "2026-10": {"neutral": 1}}, "quotes": [{"id": 802648033, "item_id": 50165502, "url": "https://news.ycombinator.com/item?id=50165502", "by": "agwa", "date": "2026-10-20", "stance": "neutral", "quote": "rustls/webpki: https://github.com/rustls/webpki/pull/546", "excerpt": "Other certificate verifiers are doing the same: Node: https://github.com/nodejs/node/pull/66871 rustls/webpki: https://github.com/rustls/webpki/pull/546 Electron: https://github.com/electron/electron/pull/55126 This is very serious and you should definitely upgrade. Hopefully OpenSSL will have a patch soon as well.", "context": "", "use_case": "certificate verification", "switched_from": "", "story": "Go will reject certificate chains containing eight distrusted SPKIs"}, {"id": 790108162, "item_id": 49381760, "url": "https://news.ycombinator.com/item?id=49381760", "by": "maria7676", "date": "2026-08-20", "stance": "recommend", "quote": "instead uses rustls", "excerpt": "Fast and modern web application firewall made in Rust, uses vectorscan for match rules, have geolocation for IP addrnin logs, automatons, have reDoS protection, and dont uses OpenSSL to prevent Future cves like heartBleed, instead uses rustls... Have frontend with 2fa,auth,plots,acl log view, rules management... https://github.com/Orangewarrior/KrakenWaf", "context": "", "use_case": "TLS", "switched_from": "", "story": "KrakenWAF"}, {"id": 775506064, "item_id": 48469129, "url": "https://news.ycombinator.com/item?id=48469129", "by": "ianm218", "date": "2026-06-09", "stance": "recommend", "quote": "rustls (modern memory safe OpenSSL)", "excerpt": "I have been working on the same problem in other areas. My ultimate goal is to rewrite nginx in Rust passing as much as the upstream tests as possible while leveraging the strongest aspects of Ruts ecosystem - i.e. rustls (modern memory safe OpenSSL), Tokio (async runtime), h2 (http 2 impl) rather than implementing from scratch like the upstream. I started with Lua, then porting over Valkey, and now working on nginx.", "context": "", "use_case": "TLS in nginx port", "switched_from": "", "story": "Grit: Rewriting Git in Rust with Agents"}, {"id": 740050864, "item_id": 46253179, "url": "https://news.ycombinator.com/item?id=46253179", "by": "larusso", "date": "2025-12-13", "stance": "recommend", "quote": "I replaced it with rust tls to remove the dynamic linked library.", "excerpt": "I think this is true for nearly all compiled languages. I had the same fun with rust and openSSL and glibC. OP didn\u2019t mentioned the fun with glib-c when compiling on a fairly recent distro and trying it to run on an older one. There is the \u201cmany Linux\u201d project which provides docker images with a minimum glib c version installed so it\u2019s compatible with newer ones. The switch to a newer open ssl version on Debian/Ubunt", "context": "", "use_case": "static TLS in Rust tool", "switched_from": "OpenSSL", "story": "Go is portable, until it isn't"}]}