cloudflare / cloudflare/pingora
Support loading TLS certificates from in-memory strings
- Dominant language
- Rust
- Stars
- 27.4k
- Forks
- 1.7k
- Avg merge
- 6h 22m
- Merged PRs (30d)
- 3
Description
## What is the problem your feature solves, or the need it fulfills?
Pingora currently requires TLS certificates to be loaded from file paths, which limits flexibility in environments where certificates are obtained dynamically (e.g., from a database, remote API, or secret manager). This restriction makes it difficult to run Pingora in containerized or ephemeral environments where filesystem access is limited or where certificates are short-lived and rotated frequently.
## Describe the solution you'd like
Allow `pingora::listeners::TlsListener` to accept in-memory certificate and key strings (e.g., PEM format), in addition to file paths. Ideally, this would involve exposing an API to construct `TlsConfig` directly from a `rustls::ServerConfig` or helper methods to load from `&str`. This would let developers securely and dynamically inject TLS configuration at runtime.
## Describe alternatives you've considered
Currently, the only workaround is to manually create a `TlsConfig` using `rustls` and pass it into `TlsListener`, but this is not documented and may break with future changes to Pingora’s internal APIs. Writing temporary files to disk to satisfy the path requirement is also possible, but introduces unnecessary complexity and security risks.
## Additional context
Many modern frameworks and reverse proxies (e.g., hyper, actix, warp) support in-memory TLS loading. Supporting this in Pingora would make it easier to integrate into cloud-native deployments and dynamic certificate management systems such as Let's Encrypt or SPIRE.
Contributor guide
Research direction
Start with pingora::listeners::TlsListener and TlsConfig, then inspect how the current file-path loading flow is exposed. Use the existing manual rustls::ServerConfig workaround as context and determine how an in-memory certificate and key API should fit without relying on internal interfaces. Done means callers can provide PEM strings or a rustls::ServerConfig through a supported public API.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- backend, networking, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100