cloudflare / cloudflare/pingora

Support loading TLS certificates from in-memory strings

Open
#611 1 comment 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
Rust
Stars
27.4k
Forks
1.7k
Avg merge
6h 22m
Merged PRs (30d)
3

Description

## What is the problem your feature solves, or the need it fulfills?

Pingora currently requires TLS certificates to be loaded from file paths, which limits flexibility in environments where certificates are obtained dynamically (e.g., from a database, remote API, or secret manager). This restriction makes it difficult to run Pingora in containerized or ephemeral environments where filesystem access is limited or where certificates are short-lived and rotated frequently.

## Describe the solution you'd like

Allow `pingora::listeners::TlsListener` to accept in-memory certificate and key strings (e.g., PEM format), in addition to file paths. Ideally, this would involve exposing an API to construct `TlsConfig` directly from a `rustls::ServerConfig` or helper methods to load from `&str`. This would let developers securely and dynamically inject TLS configuration at runtime.

## Describe alternatives you've considered

Currently, the only workaround is to manually create a `TlsConfig` using `rustls` and pass it into `TlsListener`, but this is not documented and may break with future changes to Pingora’s internal APIs. Writing temporary files to disk to satisfy the path requirement is also possible, but introduces unnecessary complexity and security risks.

## Additional context

Many modern frameworks and reverse proxies (e.g., hyper, actix, warp) support in-memory TLS loading. Supporting this in Pingora would make it easier to integrate into cloud-native deployments and dynamic certificate management systems such as Let's Encrypt or SPIRE.

Contributor guide

Open the contributing guide

Research direction

Start with pingora::listeners::TlsListener and TlsConfig, then inspect how the current file-path loading flow is exposed. Use the existing manual rustls::ServerConfig workaround as context and determine how an in-memory certificate and key API should fit without relying on internal interfaces. Done means callers can provide PEM strings or a rustls::ServerConfig through a supported public API.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
backend, networking, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.