Consider supporting Rustls

[birkmose]

Hi!
Thank you for a great modern Redis crate!
I was wondering if you had considered supporting rustls for TLS support?

[aembke]

Hi @birkmose

Yes, it is on my TODO list, but i'm not actively working on it now. For what it's worth - I'd prefer to use rustls, but this library came about from an internal library at work, and we're required to use FIPS-compliant crypto libraries in some cases, which is why I targeted openssl at first.

I haven't done any real investigation on how invasive this would be, but I'll do some digging and get back to you. If it's not a big lift I can probably do it in the next few weeks.

[birkmose]

Sounds great! Out of curiosity, at work how do you ensure FIPS-compliance? Using openssl::fips::enable(true) or?

[aembke]

If only it were that easy...

That is part of it, but in our case it was a whole can of worms. We run on kubernetes+docker on scratch images, which means no glibc, and practically speaking means we have to statically link pretty much everything. This is tricky because the FIPS guide for openssl recommends dynamically linking to your openssl libs, which wouldn't work in our case. This issue covers it in a bit more detail.

I wasn't the one that implemented that so I'm speaking a bit off the cuff here, but I do remember it being quite a hassle.

[aembke]

This is supported in 6.0.0-beta.* and soon 6.0.0. If you have any feedback on the interface let me know.