Secure Actix-Web Application With TLS

This post is about how to secure an Actix-web web application with TLS in Rust.

Requirements

These are items used for this post.

Windows 10 Professional
- Try not to install VirtualBox and use Microsoft Hyper-V instead if it is already installed, enabled and running
Ubuntu 18.04
- Running as a virtual machine in Microsoft Hyper-V. Please see
- See Install Ubuntu 18.04 LTS on Windows with Hyper-V
Rust 1.38.0
- Check out Install Rust on Ubuntu 18.04 LTS
OpenSSL
- Install this in Ubuntu 18.04
- Please see https://docs.rs/openssl/0.10.24/openssl/#automatic

New Actix-Web Application

First, create a new project in Ubuntu using the following command. We are using Ubuntu because it has build tools related to TLS. Then, copy the 2 pem files to the project directory – please do not use these files in real environments. Actix-Web application uses these files with TLS to secure its communications with the clients.

cargo new actix-web-ssl

1	cargo new actix-web-ssl

-----BEGIN CERTIFICATE-----

MIICljCCAX4CCQDztMNlxk6oeTANBgkqhkiG9w0BAQsFADANMQswCQYDVQQIDAJj

YTAeFw0xOTAzMDcwNzEyNThaFw0yMDAzMDYwNzEyNThaMA0xCzAJBgNVBAgMAmNh

MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0GMP3YzDVFWgNhRiHnfe

d192131Zi23p8WiutneD9I5WO42c79fOXsxLWn+2HSqPvCPHIBLoMX8o9lgCxt2P

/JUCAWbrE2EuvhkMrWk6/q7xB211XZYfnkqdt7mA0jMUC5o32AX3ew456TAq5P8Y

dq9H/qXdRtAvKD0QdkFfq8ePCiqOhcqacZ/NWva7R4HdgTnbL1DRQjGBXszI07P9

1yw8GOym46uxNHRujQp3lYEhc1V3JTF9kETpSBHyEAkQ8WHxGf8UBHDhh7hcc+KI

JHMlVYy5wDv4ZJeYsY1rD6/n4tyd3r0yzBM57UGf6qrVZEYmLB7Jad+8Df5vIoGh

WwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQB1DEu9NiShCfQuA17MG5O0Jr2/PS1z

/+HW7oW15WXpqDKOEJalid31/Bzwvwq0bE12xKE4ZLdbqJHmJTdSUoGfOfBZKka6

R2thOjqH7hFvxjfgS7kBy5BrRZewM9xKIJ6zU6+6mxR64x9vmkOmppV0fx5clZjH

c7qn5kSNWTMsFbjPnb5BeJJwZdqpMLs99jgoMvGtCUmkyVYODGhh65g6tR9kIPvM

zu/Cw122/y7tFfkuknMSYwGEYF3XcZpXt54a6Lu5hk6PuOTsK+7lC+HX7CSF1dpv

u1szL5fDgiCBFCnyKeOqF61mxTCUht3U++37VDFvhzN1t6HIVTYm2JJ7

-----END CERTIFICATE-----

-----BEGIN PRIVATE KEY-----

MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDQYw/djMNUVaA2

FGIed953X3bXfVmLbenxaK62d4P0jlY7jZzv185ezEtaf7YdKo+8I8cgEugxfyj2

WALG3Y/8lQIBZusTYS6+GQytaTr+rvEHbXVdlh+eSp23uYDSMxQLmjfYBfd7Djnp

MCrk/xh2r0f+pd1G0C8oPRB2QV+rx48KKo6Fyppxn81a9rtHgd2BOdsvUNFCMYFe

zMjTs/3XLDwY7Kbjq7E0dG6NCneVgSFzVXclMX2QROlIEfIQCRDxYfEZ/xQEcOGH

uFxz4ogkcyVVjLnAO/hkl5ixjWsPr+fi3J3evTLMEzntQZ/qqtVkRiYsHslp37wN

/m8igaFbAgMBAAECggEAJI278rkGany6pcHdlEqik34DcrliQ7r8FoSuYQOF+hgd

uESXCttoL+jWLwHICEW3AOGlxFKMuGH95Xh6xDeJUl0xBN3wzm11rZLnTmPvHU3C

qfLha5Ex6qpcECZSGo0rLv3WXeZuCv/r2KPCYnj86ZTFpD2kGw/Ztc1AXf4Jsi/1

478Mf23QmAvCAPimGCyjLQx2c9/vg/6K7WnDevY4tDuDKLeSJxKZBSHUn3cM1Bwj

2QzaHfSFA5XljOF5PLeR3cY5ncrrVLWChT9XuGt9YMdLAcSQxgE6kWV1RSCq+lbj

e6OOe879IrrqwBvMQfKQqnm1kl8OrfPMT5CNWKvEgQKBgQD8q5E4x9taDS9RmhRO

07ptsr/I795tX8CaJd/jc4xGuCGBqpNw/hVebyNNYQvpiYzDNBSEhtd59957VyET

hcrGyxD0ByKm8F/lPgFw5y6wi3RUnucCV/jxkMHmxVzYMbFUEGCQ0pIU9/GFS7RZ

9VjqRDeE86U3yHO+WCFoHtd8aQKBgQDTIhi0uq0oY87bUGnWbrrkR0UVRNPDG1BT

cuXACYlv/DV/XpxPC8iPK1UwG4XaOVxodtIRjdBqvb8fUM6HSY6qll64N/4/1jre

Ho+d4clE4tK6a9WU96CKxwHn2BrWUZJPtoldaCZJFJ7SfiHuLlqW7TtYFrOfPIjN

ADiqK+bHIwKBgQCpfIiAVwebo0Z/bWR77+iZFxMwvT4tjdJLVGaXUvXgpjjLmtkm

LTm2S8SZbiSodfz3H+M3dp/pj8wsXiiwyMlZifOITZT/+DPLOUmMK3cVM6ZH8QMy

fkJd/+UhYHhECSlTI10zKByXdi4LZNnIkhwfoLzBMRI9lfeV0dYu2qlfKQKBgEVI

kRbtk1kHt5/ceX62g3nZsV/TYDJMSkW4FJC6EHHBL8UGRQDjewMQUzogLgJ4hEx7

gV/lS5lbftZF7CAVEU4FXjvRlAtav6KYIMTMjQGf9UrbjBEAWZxwxb1Q+y2NQxgJ

bHZMcRPWQnAMmBHTAEM6whicCoGcmb+77Nxa37ZFAoGBALBuUNeD3fKvQR8v6GoA

spv+RYL9TB4wz2Oe9EYSp9z5EiWlTmuvFz3zk8pHDSpntxYH5O5HJ/3OzwhHz9ym

+DNE9AP9LW9hAzMuu7Gob1h8ShGwJVYwrQN3q/83ooUL7WSAuVOLpzJ7BFFlcCjp

MhFvd9iOt/R0N30/3AbQXkOp

-----END PRIVATE KEY-----

Then, we update Cargo.toml to add some dependencies. We need to ssl feature of the Actix-Web crate.

[package]
name = "actix-web-ssl"
version = "0.1.0"
authors = ["karl San Gabriel"]
edition = "2018"

[dependencies]
actix-web = { version="1.0.7", features=["ssl"] }
serde = { version = "1.0.101", features = ["derive"] }
openssl = "0.10.24"

[package]

name = "actix-web-ssl"

version = "0.1.0"

authors = ["karl San Gabriel"]

edition = "2018"

[dependencies]

actix-web = { version="1.0.7", features=["ssl"] }

serde = { version = "1.0.101", features = ["derive"] }

openssl = "0.10.24"

Next, we update main.rs as follows. The application simply returns a list of country codes when users request for the /countries URI. However, the key lines related to TLS are lines 18-21.

use actix_web::{web, App, HttpServer, Responder};
use serde::Serialize;
use openssl::ssl::{SslAcceptor, SslFiletype, SslMethod};

#[derive(Serialize)]
struct Country {
    country_code: String,
    country_name: String
}

fn get_country_list() -> impl Responder {
    let mut vec:Vec<Country> = Vec::new();
    vec.push(Country { country_code: "PH".to_string(), country_name: "Philippines".to_string()});
    return web::Json(vec);
}

fn main() {
    // load ssl keys
    let mut builder = SslAcceptor::mozilla_intermediate(SslMethod::tls()).unwrap();
    builder.set_private_key_file("key.pem", SslFiletype::PEM).unwrap();
    builder.set_certificate_chain_file("cert.pem").unwrap();

    HttpServer::new(|| {
        App::new()
            .service(web::resource("/countries")
                .route(web::get().to(get_country_list)))
    })
        .bind_ssl("127.0.0.1:8088", builder)
        .unwrap()
        .run()
        .unwrap();
}

// load ssl keys

let mut builder = SslAcceptor::mozilla_intermediate(SslMethod::tls()).unwrap();

builder.set_private_key_file("key.pem", SslFiletype::PEM).unwrap();

builder.set_certificate_chain_file("cert.pem").unwrap();

Test Secure Actix-Web Application

For testing, we use Mozilla Firefox because it allows for accessing URLs with self-signed SSL certificates. First, build the application using cargo build command. Then, run it using cargo run command.