{"record":{"id":"956a32562cb77567","repo":"stalwartlabs/stalwart","slug":"failed-to-build-the-tls-client-configuration","errorCode":null,"errorMessage":"Failed to build the TLS client configuration","messagePattern":"Failed to build the TLS client configuration","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"crates/utils/src/http.rs","lineNumber":77,"sourceCode":"        _dss: &DigitallySignedStruct,\n    ) -> Result<HandshakeSignatureValid, TlsError> {\n        Ok(HandshakeSignatureValid::assertion())\n    }\n\n    fn supported_verify_schemes(&self) -> Vec<SignatureScheme> {\n        self.0.signature_verification_algorithms.supported_schemes()\n    }\n}\n\nstatic SHARED_TLS_CONFIGS: LazyLock<SharedTlsConfigs> = LazyLock::new(|| {\n    let provider = Arc::new(aws_lc_rs::default_provider());\n\n    let verifier = rustls_platform_verifier::Verifier::new(provider.clone())\n        .expect(\"Failed to load the platform certificate verifier\");\n\n    let mut strict = ClientConfig::builder_with_provider(provider.clone())\n        .with_safe_default_protocol_versions()\n        .expect(\"Failed to build the TLS client configuration\")\n        .dangerous()\n        .with_custom_certificate_verifier(Arc::new(verifier))\n        .with_no_client_auth();\n    strict.alpn_protocols = vec![b\"h2\".to_vec(), b\"http/1.1\".to_vec()];\n\n    let mut insecure = ClientConfig::builder_with_provider(provider.clone())\n        .with_safe_default_protocol_versions()\n        .expect(\"Failed to build the TLS client configuration\")\n        .dangerous()\n        .with_custom_certificate_verifier(Arc::new(NoCertificateVerification(provider)))\n        .with_no_client_auth();\n    insecure.alpn_protocols = vec![b\"h2\".to_vec(), b\"http/1.1\".to_vec()];\n\n    let mut strict_http1 = strict.clone();\n    strict_http1.alpn_protocols = vec![b\"http/1.1\".to_vec()];\n\n    let mut insecure_http1 = insecure.clone();\n    insecure_http1.alpn_protocols = vec![b\"http/1.1\".to_vec()];","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/stalwartlabs/stalwart/blob/e96200385781a6a9995a8b839ac27d6c75a983ee/crates/utils/src/http.rs#L59-L95","documentation":"This .expect() fires when ClientConfig::builder_with_provider(...).with_safe_default_protocol_versions() returns an error while building the STRICT rustls client config in crates/utils/src/http.rs:75-77. With a functional aws_lc_rs provider this step is effectively infallible, so an Err means the crypto provider supports none of the default protocol versions. The panic occurs when the SHARED_TLS_CONFIGS LazyLock is first forced.","triggerScenarios":"First call to init_shared_tls_configs() or shared_tls_config() when the aws_lc_rs default provider reports no supported protocol versions for with_safe_default_protocol_versions() - typically a broken or version-mismatched aws-lc-rs build, or a substituted provider without TLS 1.2/1.3 support.","commonSituations":"Mixing incompatible rustls / rustls-pki-types / aws-lc-rs versions after cargo update; aws-lc-rs built without a working C compiler/cmake/bindgen; custom crypto providers registered without TLS 1.2/1.3 suites.","solutions":["Run cargo update / inspect Cargo.lock so rustls, rustls-pki-types and aws-lc-rs versions are mutually compatible (cargo tree -i rustls)","Ensure aws-lc-rs builds correctly (working cc, cmake, perl/bindgen/go toolchain as required) and the aws_lc_rs feature of rustls is enabled","If using a custom provider, make sure it registers TLS 1.2/1.3 support before builder_with_provider","Call init_shared_tls_configs() early in main so the panic surfaces at startup rather than on first network use"],"exampleFix":"// before (mismatched dependency graph)\n// rustls 0.23.x mixed with an old aws-lc-rs\n// after (Cargo.toml, keep in sync)\n// rustls = { version = \"0.23\", features = [\"aws_lc_rs\"] }\n// aws-lc-rs = \"1\"\n// then: cargo update -p aws-lc-rs && cargo build","handlingStrategy":"try-catch","validationCode":"fn provider_supports_defaults() -> bool {\n    !aws_lc_rs::default_provider().cipher_suites.is_empty()\n}\n// plus keep rustls/aws-lc-rs versions aligned: cargo tree -i rustls","typeGuard":null,"tryCatchPattern":"// the code uses .expect(), so guard by forcing init early and failing fast:\nfn main() {\n    crate::utils::http::init_shared_tls_configs(); // panics here with clear context if broken\n    // ... rest of app\n}","preventionTips":["Keep rustls, rustls-pki-types and aws-lc-rs on mutually compatible versions; commit Cargo.lock and audit with cargo tree -i rustls","Ensure CI build images have the toolchain aws-lc-rs needs (cc, cmake, perl, bindgen/go as applicable)","Run a startup smoke test that builds a TLS client config in CI for every target platform","Avoid swapping in custom crypto providers without registering TLS 1.2/1.3 support"],"tags":["rust","tls","rustls","crypto-provider","build-config","panic"],"backgroundTag":"tls-client-config-build-failed","analyzedSha":"e96200385781a6a9995a8b839ac27d6c75a983ee","analyzedAt":"2026-09-06T22:07:17.982Z","contentChangedAt":"2026-09-06T22:07:17.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}