# bext-tls

**TLS termination and automatic ACME certificate issuance for bext.**

Part of the [bext](https://github.com/bext-stack/bext) stack.

```toml
[dependencies]
bext-tls = "0.2"
```

## What this crate is

`bext-tls` is bext's TLS layer. It handles TLS termination with rustls,
automatic certificate issuance via ACME (Let's Encrypt, ZeroSSL), SNI
routing, OCSP stapling, and on-demand certificate management for multi-tenant
deployments.

It can be used standalone in any Rust server that needs a 'it just works'
TLS story — configure ACME, point it at your cert store, and let it handle
renewals.

## Features

- **rustls** under the hood — no OpenSSL, pure Rust.
- **ACME (RFC 8555)** — automatic certificate issuance and renewal.
- **SNI routing** — serve different certs per hostname.
- **OCSP stapling (RFC 6960)** — automatic, zero-config.
- **On-demand TLS** — issue certs for hostnames the first time they're requested.
- **SQLite-backed cert store** — certificates survive restarts.
- **Self-signed fallback** — for dev and local environments.

## License

**Business Source License 1.1** — see [LICENSE.md](LICENSE.md) in this crate
for the full text.

In plain English: production use on your own infrastructure is fully
permitted. You may NOT offer this crate to third parties as a hosted or
managed service that provides access to a substantial set of its features.

**Change Date: 2030-04-11.** On that date this crate automatically converts
to the MIT License with no further restrictions.

Questions about commercial licensing? Open an issue at
[github.com/bext-stack/bext](https://github.com/bext-stack/bext/issues) with
the `licensing` label.

## See also

- [github.com/bext-stack/bext](https://github.com/bext-stack/bext) — the bext meta repo
- [Full ecosystem](https://github.com/bext-stack/bext#ecosystem-at-a-glance) — all bext crates at a glance
