Skip to content

Conversation

@badeend
Copy link
Member

@badeend badeend commented Dec 29, 2025

Wasmtime currently supports two wasi-tls providers: rustls & native-tls.

Having multiple backend implementations in a single place helps with being able to quickly iterate on the WIT interface and validate that we're not codifying some rustls-specific behavior/feature into the spec.

@rvolosatovs is looking at implementing wasi-tls for Python. But as predicted, native-tls is quickly showing its shortcomings. For example: it can't read the negotiated TLS version, which is needed to implement Python's SSLSocket.version().

This PR adds a third backend: OpenSSL. The openssl crate exposes a much larger API surface than native-tls does and will most likely be enough for wasi-tls' future needs.

Depending on how restrictive the wasmtime-wasi-tls-nativetls implementation ends up being, we might consider removing it altogether. For the time being it still works fine, so I've kept it.

What matters to me is that we can demonstrate having two distinct TLS implementations working on all the three major platforms. As long as that criteria is being satisfied, I don't think it really matters whether that's rustls+nativetls or rustls+openssl.

@badeend badeend requested review from a team as code owners December 29, 2025 14:11
@badeend badeend requested review from abrown and removed request for a team December 29, 2025 14:11
@badeend badeend force-pushed the openssl branch 13 times, most recently from 414f4e2 to 40ecfd1 Compare December 29, 2025 21:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant