net: Port from deprecated async-rustls to futures-rustls.

This is also a protocol-breaking change. We now have a bit looser
certificate verification that does not append the base32-encoded
public key into the altName.

Cargo.lock

@@ -576,7 +576,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ecfa55659849ace733f86ccd219da40abd8bc14124e40b312433e85a5a266e77"
 dependencies = [
  "futures-io",
- "rustls",
+ "rustls 0.21.10",
 ]
 
 [[package]]
@@ -1763,7 +1763,6 @@ version = "0.4.1"
 dependencies = [
  "arti-client",
  "async-recursion",
- "async-rustls",
  "async-trait",
  "blake3 1.5.0",
  "bs58",
@@ -1777,6 +1776,7 @@ dependencies = [
  "easy-parallel",
  "ed25519-compact",
  "futures",
+ "futures-rustls",
  "halo2_gadgets",
  "halo2_proofs",
  "lazy_static",
@@ -2033,7 +2033,6 @@ dependencies = [
 name = "darkirc"
 version = "0.4.2"
 dependencies = [
- "async-rustls",
  "async-trait",
  "blake3 1.5.0",
  "bs58",
@@ -2043,6 +2042,7 @@ dependencies = [
  "darkfi-serial",
  "easy-parallel",
  "futures",
+ "futures-rustls",
  "libc",
  "log",
  "rand 0.8.5",
@@ -3124,6 +3124,17 @@ dependencies = [
  "syn 2.0.48",
 ]
 
+[[package]]
+name = "futures-rustls"
+version = "0.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3afda89bce8f65072d24f8b99a2127e229462d8008182ca93f1d5d2e5df8f22f"
+dependencies = [
+ "futures-io",
+ "rustls 0.22.2",
+ "rustls-pki-types",
+]
+
 [[package]]
 name = "futures-sink"
 version = "0.3.30"
@@ -5378,10 +5389,24 @@ checksum = "f9d5a6813c0759e4609cd494e8e725babae6a2ca7b62a5536a13daaec6fcb7ba"
 dependencies = [
  "log",
  "ring 0.17.7",
- "rustls-webpki",
+ "rustls-webpki 0.101.7",
  "sct",
 ]
 
+[[package]]
+name = "rustls"
+version = "0.22.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e87c9956bd9807afa1f77e0f7594af32566e830e088a5576d27c5b6f30f49d41"
+dependencies = [
+ "log",
+ "ring 0.17.7",
+ "rustls-pki-types",
+ "rustls-webpki 0.102.1",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "rustls-pemfile"
 version = "2.0.0"
@@ -5408,6 +5433,17 @@ dependencies = [
  "untrusted 0.9.0",
 ]
 
+[[package]]
+name = "rustls-webpki"
+version = "0.102.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef4ca26037c909dedb327b48c3327d0ba91d3dd3c4e05dad328f210ffb68e95b"
+dependencies = [
+ "ring 0.17.7",
+ "rustls-pki-types",
+ "untrusted 0.9.0",
+]
+
 [[package]]
 name = "rustversion"
 version = "1.0.14"
@@ -7394,7 +7430,7 @@ dependencies = [
  "educe",
  "futures",
  "pin-project",
- "rustls",
+ "rustls 0.21.10",
  "thiserror",
  "x509-signature",
 ]

Cargo.toml

@@ -66,7 +66,7 @@ smol = {version = "1.3.0", optional = true}
 pin-project-lite = {version = "0.2.13", optional = true}
 
 # Networking
-async-rustls = {version = "0.4.2", features = ["dangerous_configuration"], optional = true}
+futures-rustls = {version = "0.25.0", optional = true}
 
 # Pluggable Transports
 socket2 = {version = "0.5.5", features = ["all"], optional = true}
@@ -222,10 +222,10 @@ p2p-tor = ["arti-client", "tor-hscrypto", "tor-error", "tor-rtcompat", "libsqlit
 p2p-nym = []
 
 net = [
-    "async-rustls",
     "async-trait",
     "ed25519-compact",
     "futures",
+    "futures-rustls",
     "rand",
     "rcgen",
     "rustls-pemfile",

bin/darkirc/Cargo.toml

@@ -27,9 +27,9 @@ libc = "0.2.152"
 sled = "0.34.7"
 
 # TLS
-async-rustls = "0.4.2"
 async-trait = "0.1.77"
 futures = "0.3.30"
+futures-rustls = "0.25.0"
 rustls-pemfile = "2.0.0"
 
 # Crypto

bin/darkirc/src/irc/server.rs

@@ -18,13 +18,16 @@
 
 use std::{collections::HashMap, fs::File, io::BufReader, path::PathBuf, sync::Arc};
 
-use async_rustls::{rustls, TlsAcceptor};
 use darkfi::{
     event_graph::Event,
     system::{StoppableTask, StoppableTaskPtr, Subscription},
     util::path::expand_path,
     Error, Result,
 };
+use futures_rustls::{
+    rustls::{self, pki_types::PrivateKeyDer},
+    TlsAcceptor,
+};
 use log::{debug, error, info};
 use smol::{
     fs,
@@ -97,19 +100,18 @@ impl IrcServer {
                 // openssl x509 -req -in example.com.csr -signkey example.com.key -out example.com.crt
                 let f = File::open(expand_path(tls_secret.as_ref().unwrap())?)?;
                 let mut reader = BufReader::new(f);
-                let secret =
-                    &rustls_pemfile::pkcs8_private_keys(&mut reader).next().unwrap().unwrap();
-                let secret = rustls::PrivateKey(secret.secret_pkcs8_der().to_vec());
+                let secret = PrivateKeyDer::Pkcs8(
+                    rustls_pemfile::pkcs8_private_keys(&mut reader).next().unwrap().unwrap(),
+                );
 
                 let f = File::open(expand_path(tls_cert.as_ref().unwrap())?)?;
                 let mut reader = BufReader::new(f);
-                let cert = &rustls_pemfile::certs(&mut reader).next().unwrap().unwrap();
-                let cert = rustls::Certificate(cert.to_vec());
+                let cert = rustls_pemfile::certs(&mut reader).next().unwrap().unwrap();
 
                 let config = rustls::ServerConfig::builder()
-                    .with_safe_defaults()
                     .with_no_client_auth()
-                    .with_single_cert(vec![cert], secret)?;
+                    .with_single_cert(vec![cert], secret)
+                    .unwrap();
 
                 let acceptor = TlsAcceptor::from(Arc::new(config));
                 Some(acceptor)

src/net/acceptor.rs

@@ -183,7 +183,7 @@ impl Acceptor {
                 // Handle ErrorKind::Other
                 Err(e) if e.kind() == ErrorKind::Other => {
                     if let Some(inner) = std::error::Error::source(&e) {
-                        if let Some(inner) = inner.downcast_ref::<async_rustls::rustls::Error>() {
+                        if let Some(inner) = inner.downcast_ref::<futures_rustls::rustls::Error>() {
                             error!(
                                 target: "net::acceptor::run_accept_loop()",
                                 "[P2P] rustls listener error: {:?}", inner,

src/net/transport/mod.rs

@@ -212,7 +212,7 @@ impl Dialer {
             DialerVariant::TcpTls(dialer) => {
                 let sockaddr = self.endpoint.socket_addrs(|| None)?;
                 let stream = dialer.do_dial(sockaddr[0], timeout).await?;
-                let tlsupgrade = tls::TlsUpgrade::new();
+                let tlsupgrade = tls::TlsUpgrade::new().await;
                 let stream = tlsupgrade.upgrade_dialer_tls(stream).await?;
                 Ok(Box::new(stream))
             }
@@ -252,7 +252,7 @@ impl Dialer {
                     }
                 };
                 let stream = result?;
-                let tlsupgrade = tls::TlsUpgrade::new();
+                let tlsupgrade = tls::TlsUpgrade::new().await;
                 let stream = tlsupgrade.upgrade_dialer_tls(stream).await?;
                 Ok(Box::new(stream))
             }
@@ -348,7 +348,7 @@ impl Listener {
             ListenerVariant::TcpTls(listener) => {
                 let sockaddr = self.endpoint.socket_addrs(|| None)?;
                 let l = listener.do_listen(sockaddr[0]).await?;
-                let tlsupgrade = tls::TlsUpgrade::new();
+                let tlsupgrade = tls::TlsUpgrade::new().await;
                 let l = tlsupgrade.upgrade_listener_tcp_tls(l).await?;
                 Ok(Box::new(l))
             }
@@ -377,13 +377,13 @@ pub trait PtStream: AsyncRead + AsyncWrite + Unpin + Send {}
 impl PtStream for smol::net::TcpStream {}
 
 #[cfg(feature = "p2p-tcp")]
-impl PtStream for async_rustls::TlsStream<smol::net::TcpStream> {}
+impl PtStream for futures_rustls::TlsStream<smol::net::TcpStream> {}
 
 #[cfg(feature = "p2p-tor")]
 impl PtStream for arti_client::DataStream {}
 
 #[cfg(feature = "p2p-tor")]
-impl PtStream for async_rustls::TlsStream<arti_client::DataStream> {}
+impl PtStream for futures_rustls::TlsStream<arti_client::DataStream> {}
 
 #[cfg(feature = "p2p-unix")]
 impl PtStream for smol::net::unix::UnixStream {}

src/net/transport/tcp.rs

@@ -18,8 +18,8 @@
 
 use std::{io, time::Duration};
 
-use async_rustls::{TlsAcceptor, TlsStream};
 use async_trait::async_trait;
+use futures_rustls::{TlsAcceptor, TlsStream};
 use log::debug;
 use smol::net::{SocketAddr, TcpListener as SmolTcpListener, TcpStream};
 use socket2::{Domain, Socket, TcpKeepalive, Type};

src/net/transport/tls.rs

@@ -16,171 +16,235 @@
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
 
-use std::{sync::Arc, time::SystemTime};
+use std::sync::Arc;
 
-use async_rustls::{
-    rustls,
+use futures_rustls::{
     rustls::{
-        client::{ServerCertVerified, ServerCertVerifier},
-        kx_group::X25519,
-        server::{ClientCertVerified, ClientCertVerifier},
+        self,
+        client::danger::{HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier},
+        pki_types::{CertificateDer, PrivateKeyDer, ServerName, UnixTime},
+        server::danger::{ClientCertVerified, ClientCertVerifier},
         version::TLS13,
-        Certificate, ClientConfig, DistinguishedName, ServerConfig, ServerName,
+        ClientConfig, DigitallySignedStruct, DistinguishedName, ServerConfig, SignatureScheme,
     },
     TlsAcceptor, TlsConnector, TlsStream,
 };
 use log::error;
 use rustls_pemfile::pkcs8_private_keys;
 use x509_parser::{
-    extensions::{GeneralName, ParsedExtension},
     parse_x509_certificate,
-    prelude::{FromDer, X509Certificate},
-    x509::SubjectPublicKeyInfo,
+    prelude::{GeneralName, ParsedExtension, X509Certificate},
 };
 
-use crate::{util::encoding::base32, Result};
-
-const CIPHER_SUITE: &str = "TLS13_CHACHA20_POLY1305_SHA256";
-
-fn cipher_suite() -> rustls::SupportedCipherSuite {
-    for suite in rustls::ALL_CIPHER_SUITES {
-        let sname = format!("{:?}", suite.suite()).to_lowercase();
-
-        if sname == CIPHER_SUITE.to_string().to_lowercase() {
-            return *suite
-        }
-    }
+use crate::Result;
 
-    unreachable!()
-}
-
-/// Validate that the altName pubkey is the same as the certificate's pubkey.
-/// Returns `ed25519_compact::PublicKey` on success.
-fn validate_pubkey(
-    cert: &X509Certificate,
-) -> std::result::Result<ed25519_compact::PublicKey, rustls::Error> {
-    // We keep a public key in the altName, so we need to grab it.
-    // We compare that the actual public key of the certificate is
-    // the same as that one, and then we return it.
-    // The actual verification functions handle signature verification.
+/// Validate certificate DNSName.
+fn validate_dnsname(cert: &X509Certificate) -> std::result::Result<(), rustls::Error> {
     #[rustfmt::skip]
-    let oid = x509_parser::oid_registry::asn1_rs::oid!(2.5.29.17);
+        let oid = x509_parser::oid_registry::asn1_rs::oid!(2.5.29.17);
     let Ok(Some(extension)) = cert.get_extension_unique(&oid) else {
         return Err(rustls::CertificateError::BadEncoding.into())
     };
 
-    // Crufty AF
-    // (ノಠ益ಠ)ノ彡┻━┻
-    let pubkey_bytes = match extension.parsed_extension() {
+    let dns_name = match extension.parsed_extension() {
         ParsedExtension::SubjectAlternativeName(altname) => {
             if altname.general_names.len() != 1 {
                 return Err(rustls::CertificateError::BadEncoding.into())
             }
 
             match altname.general_names[0] {
-                GeneralName::DNSName(a) => base32::decode(a),
+                GeneralName::DNSName(dns_name) => dns_name,
                 _ => return Err(rustls::CertificateError::BadEncoding.into()),
             }
         }
-        _ => return Err(rustls::CertificateError::BadEncoding.into()),
-    };
 
-    let Some(pubkey_bytes) = pubkey_bytes else {
-        return Err(rustls::CertificateError::BadEncoding.into())
-    };
-
-    if pubkey_bytes.len() != 32 {
-        return Err(rustls::CertificateError::BadEncoding.into())
-    }
-
-    let pubkey = ed25519_compact::PublicKey::new(pubkey_bytes.try_into().unwrap());
-    let pubkey_der = pubkey.to_der();
-
-    let Ok((_, parsed_pubkey)) = SubjectPublicKeyInfo::from_der(&pubkey_der) else {
-        return Err(rustls::CertificateError::BadEncoding.into())
-    };
-
-    let Ok(parsed_name_pubkey) = parsed_pubkey.parsed() else {
-        return Err(rustls::CertificateError::BadEncoding.into())
+        _ => return Err(rustls::CertificateError::BadEncoding.into()),
     };
 
-    let Ok(parsed_cert_pubkey) = cert.public_key().parsed() else {
+    if dns_name != "dark.fi" {
         return Err(rustls::CertificateError::BadEncoding.into())
-    };
-
-    if parsed_name_pubkey != parsed_cert_pubkey {
-        return Err(rustls::CertificateError::BadSignature.into())
     }
 
-    Ok(pubkey)
+    Ok(())
 }
 
+#[derive(Debug)]
 struct ServerCertificateVerifier;
 impl ServerCertVerifier for ServerCertificateVerifier {
+    fn supported_verify_schemes(&self) -> Vec<SignatureScheme> {
+        vec![SignatureScheme::ED25519]
+    }
+
     fn verify_server_cert(
         &self,
-        end_entity: &Certificate,
-        _intermediates: &[Certificate],
+        end_entity: &CertificateDer,
+        _intermediates: &[CertificateDer],
         _server_name: &ServerName,
-        _scrs: &mut dyn Iterator<Item = &[u8]>,
         _ocsp_response: &[u8],
-        _now: SystemTime,
+        _now: UnixTime,
     ) -> std::result::Result<ServerCertVerified, rustls::Error> {
-        // Parse the actual end_entity certificate
-        let Ok((_, cert)) = parse_x509_certificate(&end_entity.0) else {
-            error!(target: "net::tls", "[net::tls] Failed parsing server TLS certificate");
+        // Read the DER-encoded certificate into a buffer
+        let mut buf = Vec::with_capacity(end_entity.len());
+        for byte in end_entity.iter() {
+            buf.push(*byte);
+        }
+
+        // Parse the certificate
+        let Ok((_, cert)) = parse_x509_certificate(&buf) else {
+            error!(target: "net::tls::verify_server_cert", "[net::tls] Failed parsing server TLS certificate");
             return Err(rustls::CertificateError::BadEncoding.into())
         };
 
-        // Validate that the pubkey in altNames matches the certificate pubkey.
-        if let Err(e) = validate_pubkey(&cert) {
-            error!(target: "net::tls", "[net::tls] Failed verifying server certificate signature: {}", e);
-            return Err(e)
+        // Validate DNSName
+        validate_dnsname(&cert)?;
+
+        Ok(ServerCertVerified::assertion())
+    }
+
+    fn verify_tls12_signature(
+        &self,
+        _message: &[u8],
+        _cert: &CertificateDer,
+        _dss: &DigitallySignedStruct,
+    ) -> std::result::Result<HandshakeSignatureValid, rustls::Error> {
+        unreachable!()
+    }
+
+    fn verify_tls13_signature(
+        &self,
+        message: &[u8],
+        cert: &CertificateDer,
+        dss: &DigitallySignedStruct,
+    ) -> std::result::Result<HandshakeSignatureValid, rustls::Error> {
+        // Verify we're using the correct signature scheme
+        if dss.scheme != SignatureScheme::ED25519 {
+            return Err(rustls::CertificateError::BadSignature.into())
+        }
+
+        // Read the DER-encoded certificate into a buffer
+        let mut buf = Vec::with_capacity(cert.len());
+        for byte in cert.iter() {
+            buf.push(*byte);
         }
 
-        // Verify the signature. By passing `None` it should use the certificate
-        // pubkey, but we also verified that it matches the one in altNames above.
-        if let Err(e) = cert.verify_signature(None) {
-            error!(target: "net::tls", "[net::tls] Failed verifying server certificate signature: {}", e);
+        // Parse the certificate and extract the public key
+        let Ok((_, cert)) = parse_x509_certificate(&buf) else {
+            error!(target: "net::tls::verify_tls13_signature", "[net::tls] Failed parsing server TLS certificate");
+            return Err(rustls::CertificateError::BadEncoding.into())
+        };
+
+        let Ok(public_key) = ed25519_compact::PublicKey::from_der(cert.public_key().raw) else {
+            error!(target: "net::tls::verify_tls13_signature", "[net::tls] Failed parsing server public key");
+            return Err(rustls::CertificateError::BadEncoding.into())
+        };
+
+        // Verify the signature
+        let Ok(signature) = ed25519_compact::Signature::from_slice(dss.signature()) else {
+            error!(target: "net::tls::verify_tls13_signature", "[net::tls] Failed verifying server signature");
+            return Err(rustls::CertificateError::BadSignature.into())
+        };
+
+        if let Err(e) = public_key.verify(message, &signature) {
+            error!(target: "net::tls::verify_tls13_signature", "[net::tls] Failed verifying server signature: {}", e);
             return Err(rustls::CertificateError::BadSignature.into())
         }
 
-        Ok(ServerCertVerified::assertion())
+        Ok(HandshakeSignatureValid::assertion())
     }
 }
 
+#[derive(Debug)]
 struct ClientCertificateVerifier;
 impl ClientCertVerifier for ClientCertificateVerifier {
-    fn client_auth_root_subjects(&self) -> &[DistinguishedName] {
+    fn supported_verify_schemes(&self) -> Vec<SignatureScheme> {
+        vec![SignatureScheme::ED25519]
+    }
+
+    fn client_auth_mandatory(&self) -> bool {
+        true
+    }
+
+    fn offer_client_auth(&self) -> bool {
+        true
+    }
+
+    fn root_hint_subjects(&self) -> &[DistinguishedName] {
         &[]
     }
 
     fn verify_client_cert(
         &self,
-        end_entity: &Certificate,
-        _intermediates: &[Certificate],
-        _now: SystemTime,
+        end_entity: &CertificateDer,
+        _intermediates: &[CertificateDer],
+        _now: UnixTime,
     ) -> std::result::Result<ClientCertVerified, rustls::Error> {
-        // Parse the actual end_entity certificate
-        let Ok((_, cert)) = parse_x509_certificate(&end_entity.0) else {
-            error!(target: "net::tls", "[net::tls] Failed parsing client TLS certificate");
+        // Read the DER-encoded certificate into a buffer
+        let mut cert = Vec::with_capacity(end_entity.len());
+        for byte in end_entity.iter() {
+            cert.push(*byte);
+        }
+
+        // Parse the certificate
+        let Ok((_, cert)) = parse_x509_certificate(&cert) else {
+            error!(target: "net::tls::verify_server_cert", "[net::tls] Failed parsing server TLS certificate");
             return Err(rustls::CertificateError::BadEncoding.into())
         };
 
-        // Validate that the pubkey in altNames matches the certificate pubkey.
-        if let Err(e) = validate_pubkey(&cert) {
-            error!(target: "net::tls", "[net::tls] Failed verifying client certificate signature: {}", e);
-            return Err(e)
+        // Validate DNSName
+        validate_dnsname(&cert)?;
+
+        Ok(ClientCertVerified::assertion())
+    }
+
+    fn verify_tls12_signature(
+        &self,
+        _message: &[u8],
+        _cert: &CertificateDer,
+        _dss: &DigitallySignedStruct,
+    ) -> std::result::Result<HandshakeSignatureValid, rustls::Error> {
+        unreachable!()
+    }
+
+    fn verify_tls13_signature(
+        &self,
+        message: &[u8],
+        cert: &CertificateDer,
+        dss: &DigitallySignedStruct,
+    ) -> std::result::Result<HandshakeSignatureValid, rustls::Error> {
+        // Verify we're using the correct signature scheme
+        if dss.scheme != SignatureScheme::ED25519 {
+            return Err(rustls::CertificateError::BadSignature.into())
+        }
+
+        // Read the DER-encoded certificate into a buffer
+        let mut buf = Vec::with_capacity(cert.len());
+        for byte in cert.iter() {
+            buf.push(*byte);
         }
 
-        // Verify the signature. By passing `None` it should use the certificate
-        // pubkey, but we also verified that it matches the one in altNames above.
-        if let Err(e) = cert.verify_signature(None) {
-            error!(target: "net::tls", "[net::tls] Failed verifying client certificate signature: {}", e);
+        // Parse the certificate and extract the public key
+        let Ok((_, cert)) = parse_x509_certificate(&buf) else {
+            error!(target: "net::tls::verify_tls13_signature", "[net::tls] Failed parsing server TLS certificate");
+            return Err(rustls::CertificateError::BadEncoding.into())
+        };
+
+        let Ok(public_key) = ed25519_compact::PublicKey::from_der(cert.public_key().raw) else {
+            error!(target: "net::tls::verify_tls13_signature", "[net::tls] Failed parsing server public key");
+            return Err(rustls::CertificateError::BadEncoding.into())
+        };
+
+        // Verify the signature
+        let Ok(signature) = ed25519_compact::Signature::from_slice(dss.signature()) else {
+            error!(target: "net::tls::verify_tls13_signature", "[net::tls] Failed verifying server signature");
+            return Err(rustls::CertificateError::BadSignature.into())
+        };
+
+        if let Err(e) = public_key.verify(message, &signature) {
+            error!(target: "net::tls::verify_tls13_signature", "[net::tls] Failed verifying server signature: {}", e);
             return Err(rustls::CertificateError::BadSignature.into())
         }
 
-        Ok(ClientCertVerified::assertion())
+        Ok(HandshakeSignatureValid::assertion())
     }
 }
 
@@ -192,19 +256,16 @@ pub struct TlsUpgrade {
 }
 
 impl TlsUpgrade {
-    pub fn new() -> Self {
-        // On each instantiation, generate a new keypair and certificate.
-        let keypair = ed25519_compact::KeyPair::generate();
-        let keypair_pem = keypair.to_pem();
-        let mut binding = keypair_pem.as_bytes();
-        let secret_key = pkcs8_private_keys(&mut binding).next().unwrap().unwrap();
-        let secret_key = rustls::PrivateKey(secret_key.secret_pkcs8_der().to_vec());
-
-        let altnames = vec![base32::encode(false, keypair.pk.as_slice())];
+    pub async fn new() -> Self {
+        // On each instantiation, generate a new keypair and certificate
+        let keypair_pem = ed25519_compact::KeyPair::generate().to_pem();
+        let secret_key = pkcs8_private_keys(&mut keypair_pem.as_bytes()).next().unwrap().unwrap();
+        let secret_key = PrivateKeyDer::Pkcs8(secret_key);
 
-        let mut cert_params = rcgen::CertificateParams::new(altnames);
+        let mut cert_params = rcgen::CertificateParams::new(&[]);
         cert_params.alg = &rcgen::PKCS_ED25519;
         cert_params.key_pair = Some(rcgen::KeyPair::from_pem(&keypair_pem).unwrap());
+        cert_params.subject_alt_names = vec![rcgen::SanType::DnsName("dark.fi".to_string())];
         cert_params.extended_key_usages = vec![
             rcgen::ExtendedKeyUsagePurpose::ClientAuth,
             rcgen::ExtendedKeyUsagePurpose::ServerAuth,
@@ -212,29 +273,23 @@ impl TlsUpgrade {
 
         let certificate = rcgen::Certificate::from_params(cert_params).unwrap();
         let certificate = certificate.serialize_der().unwrap();
-        let certificate = rustls::Certificate(certificate);
 
+        // Server-side config
         let client_cert_verifier = Arc::new(ClientCertificateVerifier {});
         let server_config = Arc::new(
-            ServerConfig::builder()
-                .with_cipher_suites(&[cipher_suite()])
-                .with_kx_groups(&[&X25519])
-                .with_protocol_versions(&[&TLS13])
-                .unwrap()
+            ServerConfig::builder_with_protocol_versions(&[&TLS13])
                 .with_client_cert_verifier(client_cert_verifier)
-                .with_single_cert(vec![certificate.clone()], secret_key.clone())
+                .with_single_cert(vec![certificate.clone().into()], secret_key.clone_key())
                 .unwrap(),
         );
 
+        // Client-side config
         let server_cert_verifier = Arc::new(ServerCertificateVerifier {});
         let client_config = Arc::new(
-            ClientConfig::builder()
-                .with_cipher_suites(&[cipher_suite()])
-                .with_kx_groups(&[&X25519])
-                .with_protocol_versions(&[&TLS13])
-                .unwrap()
+            ClientConfig::builder_with_protocol_versions(&[&TLS13])
+                .dangerous()
                 .with_custom_certificate_verifier(server_cert_verifier)
-                .with_client_auth_cert(vec![certificate], secret_key)
+                .with_client_auth_cert(vec![certificate.into()], secret_key)
                 .unwrap(),
         );
 
@@ -251,7 +306,8 @@ impl TlsUpgrade {
         Ok(TlsStream::Client(stream))
     }
 
-    // FIXME: Try to find a transparent way for this instead of implementing separately for all
+    // TODO: Try to find a transparent way for this instead of implementing
+    // the function separately for every transport type.
     #[cfg(feature = "p2p-tcp")]
     pub async fn upgrade_listener_tcp_tls(
         self,
@@ -260,9 +316,3 @@ impl TlsUpgrade {
         Ok((TlsAcceptor::from(self.server_config), listener))
     }
 }
-
-impl Default for TlsUpgrade {
-    fn default() -> Self {
-        Self::new()
-    }
-}