[package]
name = "openfut-tls"
version = "0.1.0"
edition = "2021"
license = "MIT"
description = "Shared legacy-TLS listener for OpenFUT transport hosts"
publish = false

[dependencies]
# Direct openssl, NOT native-tls and NOT rustls.
#
# The clients OpenFUT serves are legacy game clients. FIFA 17's ProtoSSL offers
# only static-RSA suites, so rustls cannot serve it at all, and native-tls
# deliberately hides the knobs that matter here: cipher list, protocol floor and
# ceiling, security level.
#
# VENDORED, so a distro libssl update cannot silently change whether a client
# can connect. The linked version is reported by `openssl_version()`, printed at
# host startup, and recorded in gate evidence — a TLS implementation change is
# not a routine dependency bump.
#
# This crate exists so that every host presents TLS built by the SAME code. Two
# hosts configuring OpenSSL separately is how the certificate mismatch of
# 2026-08-11 happened: the redirector served one certificate and the rest of the
# stack another, FIFA's ProtoSSL cached the first, and every later service
# failed its handshake with no error logged anywhere.
openssl = { version = "0.10", features = ["vendored"] }