Refactor openssl code one more time before rustls integration

Co-authored-by: Harald Gutmann <[email protected]>

48 files changed, 1330 insertions, 1341 deletions

diff --git a/Cargo.toml b/Cargo.toml
index 2fdc570..f50a2f5 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -15,6 +15,7 @@ members = [
     "pingora-openssl",
     "pingora-boringssl",
     "pingora-runtime",
+    "pingora-rustls",
     "pingora-ketama",
     "pingora-load-balancing",
     "pingora-memory-cache",
diff --git a/pingora-cache/Cargo.toml b/pingora-cache/Cargo.toml
index 6ae6c12..235cd08 100644
--- a/pingora-cache/Cargo.toml
+++ b/pingora-cache/Cargo.toml
@@ -65,6 +65,7 @@ name = "lru_serde"
 harness = false
 
 [features]
-default = ["openssl"]
+default = []
 openssl = ["pingora-core/openssl"]
 boringssl = ["pingora-core/boringssl"]
+rustls = ["pingora-core/rustls"]
diff --git a/pingora-core/Cargo.toml b/pingora-core/Cargo.toml
index 5fa60ae..713bb75 100644
--- a/pingora-core/Cargo.toml
+++ b/pingora-core/Cargo.toml
@@ -26,6 +26,7 @@ pingora-pool = { version = "0.3.0", path = "../pingora-pool" }
 pingora-error = { version = "0.3.0", path = "../pingora-error" }
 pingora-timeout = { version = "0.3.0", path = "../pingora-timeout" }
 pingora-http = { version = "0.3.0", path = "../pingora-http" }
+pingora-rustls = { version = "0.3.0", path = "../pingora-rustls", optional = true }
 tokio = { workspace = true, features = ["net", "rt-multi-thread", "signal"] }
 futures = "0.3"
 async-trait = { workspace = true }
@@ -66,6 +67,7 @@ openssl-probe = "0.1"
 tokio-test = "0.4"
 zstd = "0"
 httpdate = "1"
+x509-parser = { version = "0.16.0", optional = true }
 
 [target.'cfg(unix)'.dependencies]
 daemonize = "0.5.0"
@@ -87,9 +89,11 @@ hyperlocal = "0.8"
 jemallocator = "0.5"
 
 [features]
-default = ["openssl"]
-openssl = ["pingora-openssl", "some_tls"]
-boringssl = ["pingora-boringssl", "some_tls"]
+default = []
+openssl = ["pingora-openssl", "openssl_derived",]
+boringssl = ["pingora-boringssl", "openssl_derived",]
+rustls = ["pingora-rustls", "any_tls", "dep:x509-parser"]
+patched_http1 = ["pingora-http/patched_http1"]
+openssl_derived = ["any_tls"]
+any_tls = []
 sentry = ["dep:sentry"]
-patched_http1 = []
-some_tls = []
diff --git a/pingora-core/src/connectors/http/mod.rs b/pingora-core/src/connectors/http/mod.rs
index 33c5e01..0133990 100644
--- a/pingora-core/src/connectors/http/mod.rs
+++ b/pingora-core/src/connectors/http/mod.rs
@@ -95,7 +95,7 @@ impl Connector {
 }
 
 #[cfg(test)]
-#[cfg(feature = "some_tls")]
+#[cfg(feature = "any_tls")]
 mod tests {
     use super::*;
     use crate::protocols::http::v1::client::HttpSession as Http1Session;
diff --git a/pingora-core/src/connectors/http/v1.rs b/pingora-core/src/connectors/http/v1.rs
index fb5dfd0..ffa6df2 100644
--- a/pingora-core/src/connectors/http/v1.rs
+++ b/pingora-core/src/connectors/http/v1.rs
@@ -103,7 +103,7 @@ mod tests {
     }
 
     #[tokio::test]
-    #[cfg(feature = "some_tls")]
+    #[cfg(feature = "any_tls")]
     async fn test_connect_tls() {
         let connector = Connector::new(None);
         let peer = HttpPeer::new(("1.1.1.1", 443), true, "one.one.one.one".into());
diff --git a/pingora-core/src/connectors/http/v2.rs b/pingora-core/src/connectors/http/v2.rs
index 60e26fb..a1f295a 100644
--- a/pingora-core/src/connectors/http/v2.rs
+++ b/pingora-core/src/connectors/http/v2.rs
@@ -460,7 +460,7 @@ mod tests {
     use crate::upstreams::peer::HttpPeer;
 
     #[tokio::test]
-    #[cfg(feature = "some_tls")]
+    #[cfg(feature = "any_tls")]
     async fn test_connect_h2() {
         let connector = Connector::new(None);
         let mut peer = HttpPeer::new(("1.1.1.1", 443), true, "one.one.one.one".into());
@@ -473,7 +473,7 @@ mod tests {
     }
 
     #[tokio::test]
-    #[cfg(feature = "some_tls")]
+    #[cfg(feature = "any_tls")]
     async fn test_connect_h1() {
         let connector = Connector::new(None);
         let mut peer = HttpPeer::new(("1.1.1.1", 443), true, "one.one.one.one".into());
@@ -499,7 +499,7 @@ mod tests {
     }
 
     #[tokio::test]
-    #[cfg(feature = "some_tls")]
+    #[cfg(feature = "any_tls")]
     async fn test_h2_single_stream() {
         let connector = Connector::new(None);
         let mut peer = HttpPeer::new(("1.1.1.1", 443), true, "one.one.one.one".into());
@@ -531,7 +531,7 @@ mod tests {
     }
 
     #[tokio::test]
-    #[cfg(feature = "some_tls")]
+    #[cfg(feature = "any_tls")]
     async fn test_h2_multiple_stream() {
         let connector = Connector::new(None);
         let mut peer = HttpPeer::new(("1.1.1.1", 443), true, "one.one.one.one".into());
diff --git a/pingora-core/src/connectors/mod.rs b/pingora-core/src/connectors/mod.rs
index 57c16aa..5a126cc 100644
--- a/pingora-core/src/connectors/mod.rs
+++ b/pingora-core/src/connectors/mod.rs
@@ -17,11 +17,15 @@
 pub mod http;
 pub mod l4;
 mod offload;
+
+#[cfg(feature = "any_tls")]
 mod tls;
 
+#[cfg(not(feature = "any_tls"))]
+use crate::tls::connectors as tls;
+
 use crate::protocols::Stream;
 use crate::server::configuration::ServerConf;
-use crate::tls::ssl::SslConnector;
 use crate::upstreams::peer::{Peer, ALPN};
 
 pub use l4::Connect as L4Connect;
@@ -34,6 +38,7 @@ use pingora_pool::{ConnectionMeta, ConnectionPool};
 use std::collections::HashMap;
 use std::net::SocketAddr;
 use std::sync::Arc;
+use tls::TlsConnector;
 use tokio::sync::Mutex;
 
 /// The options to configure a [TransportConnector]
@@ -293,7 +298,7 @@ async fn do_connect<P: Peer + Send + Sync>(
     peer: &P,
     bind_to: Option<BindTo>,
     alpn_override: Option<ALPN>,
-    tls_ctx: &SslConnector,
+    tls_ctx: &TlsConnector,
 ) -> Result<Stream> {
     // Create the future that does the connections, but don't evaluate it until
     // we decide if we need a timeout or not
@@ -316,7 +321,7 @@ async fn do_connect_inner<P: Peer + Send + Sync>(
     peer: &P,
     bind_to: Option<BindTo>,
     alpn_override: Option<ALPN>,
-    tls_ctx: &SslConnector,
+    tls_ctx: &TlsConnector,
 ) -> Result<Stream> {
     let stream = l4_connect(peer, bind_to).await?;
     if peer.tls() {
@@ -383,12 +388,12 @@ fn test_reusable_stream(stream: &mut Stream) -> bool {
 }
 
 #[cfg(test)]
-#[cfg(feature = "some_tls")]
+#[cfg(feature = "any_tls")]
 mod tests {
     use pingora_error::ErrorType;
+    use tls::Connector;
 
     use super::*;
-    use crate::tls::ssl::SslMethod;
     use crate::upstreams::peer::BasicPeer;
     use tokio::io::AsyncWriteExt;
     #[cfg(unix)]
@@ -498,8 +503,8 @@ mod tests {
     /// This assumes that the connection will fail to on the peer and returns
     /// the decomposed error type and message
     async fn get_do_connect_failure_with_peer(peer: &BasicPeer) -> (ErrorType, String) {
-        let ssl_connector = SslConnector::builder(SslMethod::tls()).unwrap().build();
-        let stream = do_connect(peer, None, None, &ssl_connector).await;
+        let tls_connector = Connector::new(None);
+        let stream = do_connect(peer, None, None, &tls_connector.ctx).await;
         match stream {
             Ok(_) => panic!("should throw an error"),
             Err(e) => (
diff --git a/pingora-core/src/connectors/tls/boringssl_openssl/mod.rs b/pingora-core/src/connectors/tls/boringssl_openssl/mod.rs
index f8568e7..a57668f 100644
--- a/pingora-core/src/connectors/tls/boringssl_openssl/mod.rs
+++ b/pingora-core/src/connectors/tls/boringssl_openssl/mod.rs
@@ -16,6 +16,7 @@ use log::debug;
 use pingora_error::{Error, ErrorType::*, OrErr, Result};
 use std::sync::{Arc, Once};
 
+use crate::connectors::tls::replace_leftmost_underscore;
 use crate::connectors::ConnectorOptions;
 use crate::protocols::tls::client::handshake;
 use crate::protocols::tls::SslStream;
@@ -31,6 +32,8 @@ use crate::tls::ssl::{SslConnector, SslFiletype, SslMethod, SslVerifyMode, SslVe
 use crate::tls::x509::store::X509StoreBuilder;
 use crate::upstreams::peer::{Peer, ALPN};
 
+pub type TlsConnector = SslConnector;
+
 const CIPHER_LIST: &str = "AES-128-GCM-SHA256\
     :AES-256-GCM-SHA384\
     :CHACHA20-POLY1305-SHA256\
@@ -147,33 +150,6 @@ impl Connector {
     }
 }
 
-/*
-    OpenSSL considers underscores in hostnames non-compliant.
-    We replace the underscore in the leftmost label as we must support these
-    hostnames for wildcard matches and we have not patched OpenSSL.
-
-    https://github.com/openssl/openssl/issues/12566
-
-    > The labels must follow the rules for ARPANET host names.  They must
-    > start with a letter, end with a letter or digit, and have as interior
-    > characters only letters, digits, and hyphen.  There are also some
-    > restrictions on the length.  Labels must be 63 characters or less.
-    - https://datatracker.ietf.org/doc/html/rfc1034#section-3.5
-*/
-fn replace_leftmost_underscore(sni: &str) -> Option<String> {
-    // wildcard is only leftmost label
-    if let Some((leftmost, rest)) = sni.split_once('.') {
-        // if not a subdomain or leftmost does not contain underscore return
-        if !rest.contains('.') || !leftmost.contains('_') {
-            return None;
-        }
-        // we have a subdomain, replace underscores
-        let leftmost = leftmost.replace('_', "-");
-        return Some(format!("{leftmost}.{rest}"));
-    }
-    None
-}
-
 pub(crate) async fn connect<T, P>(
     stream: T,
     peer: &P,
@@ -283,41 +259,3 @@ where
         None => connect_future.await,
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn test_replace_leftmost_underscore() {
-        let none_cases = [
-            "",
-            "some",
-            "some.com",
-            "1.1.1.1:5050",
-            "dog.dot.com",
-            "dog.d_t.com",
-            "dog.dot.c_m",
-            "d_g.com",
-            "_",
-            "dog.c_m",
-        ];
-
-        for case in none_cases {
-            assert!(replace_leftmost_underscore(case).is_none(), "{}", case);
-        }
-
-        assert_eq!(
-            Some("bb-b.some.com".to_string()),
-            replace_leftmost_underscore("bb_b.some.com")
-        );
-        assert_eq!(
-            Some("a-a-a.some.com".to_string()),
-            replace_leftmost_underscore("a_a_a.some.com")
-        );
-        assert_eq!(
-            Some("-.some.com".to_string()),
-            replace_leftmost_underscore("_.some.com")
-        );
-    }
-}
diff --git a/pingora-core/src/connectors/tls/mod.rs b/pingora-core/src/connectors/tls/mod.rs
index 2a4d469..e250418 100644
--- a/pingora-core/src/connectors/tls/mod.rs
+++ b/pingora-core/src/connectors/tls/mod.rs
@@ -1,5 +1,84 @@
-#[cfg(feature = "some_tls")]
+// Copyright 2024 Cloudflare, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#[cfg(feature = "openssl_derived")]
 mod boringssl_openssl;
 
-#[cfg(feature = "some_tls")]
+#[cfg(feature = "openssl_derived")]
 pub use boringssl_openssl::*;
+
+///    OpenSSL considers underscores in hostnames non-compliant.
+///    We replace the underscore in the leftmost label as we must support these
+///    hostnames for wildcard matches and we have not patched OpenSSL.
+///
+///    https://github.com/openssl/openssl/issues/12566
+///
+///    > The labels must follow the rules for ARPANET host names. They must
+///    > start with a letter, end with a letter or digit, and have as interior
+///    > characters only letters, digits, and hyphen.  There are also some
+///    > restrictions on the length.  Labels must be 63 characters or less.
+///    - https://datatracker.ietf.org/doc/html/rfc1034#section-3.5
+#[cfg(feature = "any_tls")]
+pub fn replace_leftmost_underscore(sni: &str) -> Option<String> {
+    // wildcard is only leftmost label
+    if let Some((leftmost, rest)) = sni.split_once('.') {
+        // if not a subdomain or leftmost does not contain underscore return
+        if !rest.contains('.') || !leftmost.contains('_') {
+            return None;
+        }
+        // we have a subdomain, replace underscores
+        let leftmost = leftmost.replace('_', "-");
+        return Some(format!("{leftmost}.{rest}"));
+    }
+    None
+}
+
+#[cfg(feature = "any_tls")]
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_replace_leftmost_underscore() {
+        let none_cases = [
+            "",
+            "some",
+            "some.com",
+            "1.1.1.1:5050",
+            "dog.dot.com",
+            "dog.d_t.com",
+            "dog.dot.c_m",
+            "d_g.com",
+            "_",
+            "dog.c_m",
+        ];
+
+        for case in none_cases {
+            assert!(replace_leftmost_underscore(case).is_none(), "{}", case);
+        }
+
+        assert_eq!(
+            Some("bb-b.some.com".to_string()),
+            replace_leftmost_underscore("bb_b.some.com")
+        );
+        assert_eq!(
+            Some("a-a-a.some.com".to_string()),
+            replace_leftmost_underscore("a_a_a.some.com")
+        );
+        assert_eq!(
+            Some("-.some.com".to_string()),
+            replace_leftmost_underscore("_.some.com")
+        );
+    }
+}
diff --git a/pingora-core/src/lib.rs b/pingora-core/src/lib.rs
index fbc3394..f4b5106 100644
--- a/pingora-core/src/lib.rs
+++ b/pingora-core/src/lib.rs
@@ -55,11 +55,14 @@ pub use pingora_error::{ErrorType::*, *};
 #[cfg(feature = "boringssl")]
 pub use pingora_boringssl as tls;
 
-#[cfg(all(not(feature = "boringssl"), feature = "openssl"))]
+#[cfg(feature = "openssl")]
 pub use pingora_openssl as tls;
 
-#[cfg(not(feature = "some_tls"))]
-pub use protocols::tls::dummy_tls as tls;
+#[cfg(feature = "rustls")]
+pub use pingora_rustls as tls;
+
+#[cfg(not(feature = "any_tls"))]
+pub use protocols::tls::noop_tls as tls;
 
 pub mod prelude {
     pub use crate::server::configuration::Opt;
diff --git a/pingora-core/src/listeners/mod.rs b/pingora-core/src/listeners/mod.rs
index 35e30d5..4a21632 100644
--- a/pingora-core/src/listeners/mod.rs
+++ b/pingora-core/src/listeners/mod.rs
@@ -15,21 +15,40 @@
 //! The listening endpoints (TCP and TLS) and their configurations.
 
 mod l4;
-mod tls;
 
-use crate::protocols::Stream;
+#[cfg(feature = "any_tls")]
+pub mod tls;
+
+#[cfg(not(feature = "any_tls"))]
+pub use crate::tls::listeners as tls;
+
+use crate::protocols::{tls::TlsRef, Stream};
+
 #[cfg(unix)]
 use crate::server::ListenFds;
 
+use async_trait::async_trait;
 use pingora_error::Result;
 use std::{fs::Permissions, sync::Arc};
 
 use l4::{ListenerEndpoint, Stream as L4Stream};
-use tls::Acceptor;
+use tls::{Acceptor, TlsSettings};
 
-pub use crate::protocols::tls::server::TlsAccept;
+pub use crate::protocols::tls::ALPN;
 pub use l4::{ServerAddress, TcpSocketOptions};
-pub use tls::{TlsSettings, ALPN};
+
+/// The APIs to customize things like certificate during TLS server side handshake
+#[async_trait]
+pub trait TlsAccept {
+    // TODO: return error?
+    /// This function is called in the middle of a TLS handshake. Structs who implement this function
+    /// should provide tls certificate and key to the [TlsRef] via [ext::ssl_use_certificate] and [ext::ssl_use_private_key].
+    async fn certificate_callback(&self, _ssl: &mut TlsRef) -> () {
+        // does nothing by default
+    }
+}
+
+pub type TlsAcceptCallbacks = Box<dyn TlsAccept + Send + Sync>;
 
 struct TransportStackBuilder {
     l4: ServerAddress,
@@ -200,6 +219,7 @@ impl Listeners {
 #[cfg(test)]
 mod test {
     use super::*;
+    #[cfg(feature = "any_tls")]
     use tokio::io::AsyncWriteExt;
     use tokio::net::TcpStream;
     use tokio::time::{sleep, Duration};
@@ -233,7 +253,7 @@ mod test {
     }
 
     #[tokio::test]
-    #[cfg(feature = "some_tls")]
+    #[cfg(feature = "any_tls")]
     async fn test_listen_tls() {
         use tokio::io::AsyncReadExt;
 
diff --git a/pingora-core/src/listeners/tls/boringssl_openssl/mod.rs b/pingora-core/src/listeners/tls/boringssl_openssl/mod.rs
index 3780a94..500f959 100644
--- a/pingora-core/src/listeners/tls/boringssl_openssl/mod.rs
+++ b/pingora-core/src/listeners/tls/boringssl_openssl/mod.rs
@@ -16,14 +16,16 @@ use log::debug;
 use pingora_error::{ErrorType, OrErr, Result};
 use std::ops::{Deref, DerefMut};
 
-use crate::protocols::tls::{
-    server::{handshake, handshake_with_callback, TlsAcceptCallbacks},
-    SslStream,
-};
+pub use crate::protocols::tls::ALPN;
 use crate::protocols::IO;
 use crate::tls::ssl::{SslAcceptor, SslAcceptorBuilder, SslFiletype, SslMethod};
-
-pub use crate::protocols::tls::ALPN;
+use crate::{
+    listeners::TlsAcceptCallbacks,
+    protocols::tls::{
+        server::{handshake, handshake_with_callback},
+        SslStream,
+    },
+};
 
 pub const TLS_CONF_ERR: ErrorType = ErrorType::Custom("TLSConfigError");
 
diff --git a/pingora-core/src/listeners/tls/mod.rs b/pingora-core/src/listeners/tls/mod.rs
index 2a4d469..0bcaeac 100644
--- a/pingora-core/src/listeners/tls/mod.rs
+++ b/pingora-core/src/listeners/tls/mod.rs
@@ -1,5 +1,19 @@
-#[cfg(feature = "some_tls")]
+// Copyright 2024 Cloudflare, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#[cfg(feature = "openssl_derived")]
 mod boringssl_openssl;
 
-#[cfg(feature = "some_tls")]
+#[cfg(feature = "openssl_derived")]
 pub use boringssl_openssl::*;
diff --git a/pingora-core/src/protocols/mod.rs b/pingora-core/src/protocols/mod.rs
index 62efb9c..c9218b9 100644
--- a/pingora-core/src/protocols/mod.rs
+++ b/pingora-core/src/protocols/mod.rs
@@ -55,7 +55,7 @@ pub trait UniqueID {
 /// Interface to get TLS info
 pub trait Ssl {
     /// Return the TLS info if the connection is over TLS
-    fn get_ssl(&self) -> Option<&crate::tls::ssl::SslRef> {
+    fn get_ssl(&self) -> Option<&TlsRef> {
         None
     }
 
@@ -66,8 +66,7 @@ pub trait Ssl {
 
     /// Return selected ALPN if any
     fn selected_alpn_proto(&self) -> Option<ALPN> {
-        let ssl = self.get_ssl()?;
-        ALPN::from_wire_selected(ssl.selected_alpn_protocol()?)
+        None
     }
 }
 
@@ -249,6 +248,8 @@ use std::os::unix::prelude::AsRawFd;
 use std::os::windows::io::AsRawSocket;
 use std::{net::SocketAddr as InetSocketAddr, path::Path};
 
+use crate::protocols::tls::TlsRef;
+
 #[cfg(unix)]
 impl ConnFdReusable for SocketAddr {
     fn check_fd_match<V: AsRawFd>(&self, fd: V) -> bool {
diff --git a/pingora-core/src/protocols/tls/boringssl_openssl/mod.rs b/pingora-core/src/protocols/tls/boringssl_openssl/mod.rs
index c07f47e..3c6584e 100644
--- a/pingora-core/src/protocols/tls/boringssl_openssl/mod.rs
+++ b/pingora-core/src/protocols/tls/boringssl_openssl/mod.rs
@@ -1,2 +1,29 @@
+// Copyright 2024 Cloudflare, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 pub mod client;
 pub mod server;
+mod stream;
+
+#[cfg(feature = "boringssl")]
+use pingora_boringssl as ssl_lib;
+
+#[cfg(feature = "openssl")]
+use pingora_openssl as ssl_lib;
+
+use ssl_lib::{ssl::SslRef, x509::X509};
+pub use stream::*;
+
+pub type TlsRef = SslRef;
+pub type CaType = Box<[X509]>;
diff --git a/pingora-core/src/protocols/tls/boringssl_openssl/server.rs b/pingora-core/src/protocols/tls/boringssl_openssl/server.rs
index b7f2f6d..024565a 100644
--- a/pingora-core/src/protocols/tls/boringssl_openssl/server.rs
+++ b/pingora-core/src/protocols/tls/boringssl_openssl/server.rs
@@ -14,12 +14,13 @@
 
 //! TLS server specific implementation
 
+use crate::listeners::TlsAcceptCallbacks;
 use crate::protocols::tls::SslStream;
 use crate::protocols::{Shutdown, IO};
 use crate::tls::ext;
 use crate::tls::ext::ssl_from_acceptor;
 use crate::tls::ssl;
-use crate::tls::ssl::{SslAcceptor, SslRef};
+use crate::tls::ssl::SslAcceptor;
 
 use async_trait::async_trait;
 use log::warn;
@@ -69,19 +70,6 @@ pub async fn handshake_with_callback<S: IO>(
     }
 }
 
-/// The APIs to customize things like certificate during TLS server side handshake
-#[async_trait]
-pub trait TlsAccept {
-    // TODO: return error?
-    /// This function is called in the middle of a TLS handshake. Structs who implement this function
-    /// should provide tls certificate and key to the [SslRef] via [ext::ssl_use_certificate] and [ext::ssl_use_private_key].
-    async fn certificate_callback(&self, _ssl: &mut SslRef) -> () {
-        // does nothing by default
-    }
-}
-
-pub type TlsAcceptCallbacks = Box<dyn TlsAccept + Send + Sync>;
-
 #[async_trait]
 impl<S> Shutdown for SslStream<S>
 where
@@ -143,9 +131,12 @@ impl<S: AsyncRead + AsyncWrite + Send + Unpin> ResumableAccept for SslStream<S>
 }
 
 #[tokio::test]
-#[cfg(feature = "some_tls")]
+#[cfg(feature = "any_tls")]
 async fn test_async_cert() {
+    use crate::protocols::tls::TlsRef;
     use tokio::io::AsyncReadExt;
+
+    use crate::listeners::{TlsAccept, TlsAcceptCallbacks};
     let acceptor = ssl::SslAcceptor::mozilla_intermediate_v5(ssl::SslMethod::tls())
         .unwrap()
         .build();
@@ -153,7 +144,7 @@ async fn test_async_cert() {
     struct Callback;
     #[async_trait]
     impl TlsAccept for Callback {
-        async fn certificate_callback(&self, ssl: &mut SslRef) -> () {
+        async fn certificate_callback(&self, ssl: &mut TlsRef) -> () {
             assert_eq!(
                 ssl.servername(ssl::NameType::HOST_NAME).unwrap(),
                 "pingora.org"
diff --git a/pingora-core/src/protocols/tls/boringssl_openssl/stream.rs b/pingora-core/src/protocols/tls/boringssl_openssl/stream.rs
new file mode 100644
index 0000000..38c3027
--- /dev/null
+++ b/pingora-core/src/protocols/tls/boringssl_openssl/stream.rs
@@ -0,0 +1,217 @@
+// Copyright 2024 Cloudflare, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use crate::protocols::digest::TimingDigest;
+use crate::protocols::tls::{SslDigest, ALPN};
+use crate::protocols::{Peek, Ssl, UniqueID, UniqueIDType};
+use crate::tls::{self, ssl, tokio_ssl::SslStream as InnerSsl};
+use crate::utils::tls::{get_organization, get_serial};
+use log::warn;
+use pingora_error::{ErrorType::*, OrErr, Result};
+use std::pin::Pin;
+use std::sync::Arc;
+use std::task::{Context, Poll};
+use std::time::SystemTime;
+use tokio::io::{self, AsyncRead, AsyncWrite, ReadBuf};
+
+#[cfg(feature = "boringssl")]
+use pingora_boringssl as ssl_lib;
+
+#[cfg(feature = "openssl")]
+use pingora_openssl as ssl_lib;
+
+use ssl_lib::{hash::MessageDigest, ssl::SslRef};
+
+/// The TLS connection
+#[derive(Debug)]
+pub struct SslStream<T> {
+    ssl: InnerSsl<T>,
+    digest: Option<Arc<SslDigest>>,
+    pub(super) timing: TimingDigest,
+}
+
+impl<T> SslStream<T>
+where
+    T: AsyncRead + AsyncWrite + std::marker::Unpin,
+{
+    /// Create a new TLS connection from the given `stream`
+    ///
+    /// The caller needs to perform [`Self::connect()`] or [`Self::accept()`] to perform TLS
+    /// handshake after.
+    pub fn new(ssl: ssl::Ssl, stream: T) -> Result<Self> {
+        let ssl = InnerSsl::new(ssl, stream)
+            .explain_err(TLSHandshakeFailure, |e| format!("ssl stream error: {e}"))?;
+
+        Ok(SslStream {
+            ssl,
+            digest: None,
+            timing: Default::default(),
+        })
+    }
+
+    /// Connect to the remote TLS server as a client
+    pub async fn connect(&mut self) -> Result<(), ssl::Error> {
+        Self::clear_error();
+        Pin::new(&mut self.ssl).connect().await?;
+        self.timing.established_ts = SystemTime::now();
+        self.digest = Some(Arc::new(SslDigest::from_ssl(self.ssl())));
+        Ok(())
+    }
+
+    /// Finish the TLS handshake from client as a server
+    pub async fn accept(&mut self) -> Result<(), ssl::Error> {
+        Self::clear_error();
+        Pin::new(&mut self.ssl).accept().await?;
+        self.timing.established_ts = SystemTime::now();
+        self.digest = Some(Arc::new(SslDigest::from_ssl(self.ssl())));
+        Ok(())
+    }
+
+    #[inline]
+    fn clear_error() {
+        let errs = tls::error::ErrorStack::get();
+        if !errs.errors().is_empty() {
+            warn!("Clearing dirty TLS error stack: {}", errs);
+        }
+    }
+}
+
+impl<T> SslStream<T> {
+    pub fn ssl_digest(&self) -> Option<Arc<SslDigest>> {
+        self.digest.clone()
+    }
+}
+
+use std::ops::{Deref, DerefMut};
+
+impl<T> Deref for SslStream<T> {
+    type Target = InnerSsl<T>;
+
+    fn deref(&self) -> &Self::Target {
+        &self.ssl
+    }
+}
+
+impl<T> DerefMut for SslStream<T> {
+    fn deref_mut(&mut self) -> &mut Self::Target {
+        &mut self.ssl
+    }
+}
+
+impl<T> AsyncRead for SslStream<T>
+where
+    T: AsyncRead + AsyncWrite + Unpin,
+{
+    fn poll_read(
+        mut self: Pin<&mut Self>,
+        cx: &mut Context<'_>,
+        buf: &mut ReadBuf<'_>,
+    ) -> Poll<io::Result<()>> {
+        Self::clear_error();
+        Pin::new(&mut self.ssl).poll_read(cx, buf)
+    }
+}
+
+impl<T> AsyncWrite for SslStream<T>
+where
+    T: AsyncRead + AsyncWrite + Unpin,
+{
+    fn poll_write(
+        mut self: Pin<&mut Self>,
+        cx: &mut Context,
+        buf: &[u8],
+    ) -> Poll<io::Result<usize>> {
+        Self::clear_error();
+        Pin::new(&mut self.ssl).poll_write(cx, buf)
+    }
+
+    fn poll_flush(mut self: Pin<&mut Self>, cx: &mut Context) -> Poll<io::Result<()>> {
+        Self::clear_error();
+        Pin::new(&mut self.ssl).poll_flush(cx)
+    }
+
+    fn poll_shutdown(mut self: Pin<&mut Self>, cx: &mut Context) -> Poll<io::Result<()>> {
+        Self::clear_error();
+        Pin::new(&mut self.ssl).poll_shutdown(cx)
+    }
+
+    fn poll_write_vectored(
+        mut self: Pin<&mut Self>,
+        cx: &mut Context<'_>,
+        bufs: &[std::io::IoSlice<'_>],
+    ) -> Poll<io::Result<usize>> {
+        Self::clear_error();
+        Pin::new(&mut self.ssl).poll_write_vectored(cx, bufs)
+    }
+
+    fn is_write_vectored(&self) -> bool {
+        true
+    }
+}
+
+impl<T> UniqueID for SslStream<T>
+where
+    T: UniqueID,
+{
+    fn id(&self) -> UniqueIDType {
+        self.ssl.get_ref().id()
+    }
+}
+
+impl<T> Ssl for SslStream<T> {
+    fn get_ssl(&self) -> Option<&ssl::SslRef> {
+        Some(self.ssl())
+    }
+
+    fn get_ssl_digest(&self) -> Option<Arc<SslDigest>> {
+        self.ssl_digest()
+    }
+
+    /// Return selected ALPN if any
+    fn selected_alpn_proto(&self) -> Option<ALPN> {
+        let ssl = self.get_ssl()?;
+        ALPN::from_wire_selected(ssl.selected_alpn_protocol()?)
+    }
+}
+
+impl SslDigest {
+    pub fn from_ssl(ssl: &SslRef) -> Self {
+        let cipher = match ssl.current_cipher() {
+            Some(c) => c.name(),
+            None => "",
+        };
+
+        let (cert_digest, org, sn) = match ssl.peer_certificate() {
+            Some(cert) => {
+                let cert_digest = match cert.digest(MessageDigest::sha256()) {
+                    Ok(c) => c.as_ref().to_vec(),
+                    Err(_) => Vec::new(),
+                };
+                (cert_digest, get_organization(&cert), get_serial(&cert).ok())
+            }
+            None => (Vec::new(), None, None),
+        };
+
+        SslDigest {
+            cipher,
+            version: ssl.version_str(),
+            organization: org,
+            serial_number: sn,
+            cert_digest,
+        }
+    }
+}
+
+// TODO: implement Peek if needed
+impl<T> Peek for SslStream<T> {}
diff --git a/pingora-core/src/protocols/tls/digest.rs b/pingora-core/src/protocols/tls/digest.rs
index 3cdb7aa..72adae6 100644
--- a/pingora-core/src/protocols/tls/digest.rs
+++ b/pingora-core/src/protocols/tls/digest.rs
@@ -14,9 +14,6 @@
 
 //! TLS information from the TLS connection
 
-use crate::tls::{hash::MessageDigest, ssl::SslRef};
-use crate::utils;
-
 /// The TLS connection information
 #[derive(Clone, Debug)]
 pub struct SslDigest {
@@ -31,35 +28,3 @@ pub struct SslDigest {
     /// The digest of the peer's certificate
     pub cert_digest: Vec<u8>,
 }
-
-impl SslDigest {
-    pub fn from_ssl(ssl: &SslRef) -> Self {
-        let cipher = match ssl.current_cipher() {
-            Some(c) => c.name(),
-            None => "",
-        };
-
-        let (cert_digest, org, sn) = match ssl.peer_certificate() {
-            Some(cert) => {
-                let cert_digest = match cert.digest(MessageDigest::sha256()) {
-                    Ok(c) => c.as_ref().to_vec(),
-                    Err(_) => Vec::new(),
-                };
-                (
-                    cert_digest,
-                    utils::get_organization(&cert),
-                    utils::get_serial(&cert).ok(),
-                )
-            }
-            None => (Vec::new(), None, None),
-        };
-
-        SslDigest {
-            cipher,
-            version: ssl.version_str(),
-            organization: org,
-            serial_number: sn,
-            cert_digest,
-        }
-    }
-}
diff --git a/pingora-core/src/protocols/tls/dummy_tls/mod.rs b/pingora-core/src/protocols/tls/dummy_tls/mod.rs
deleted file mode 100644
index 9a841d6..0000000
--- a/pingora-core/src/protocols/tls/dummy_tls/mod.rs
+++ /dev/null
@@ -1,805 +0,0 @@
-// Copyright 2024 Cloudflare, Inc.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! This module contains a dummy TLS implementation for the scenarios where real TLS
-//! implementations are unavailable.
-
-macro_rules! impl_display {
-    ($ty:ty) => {
-        impl std::fmt::Display for $ty {
-            fn fmt(&self, _f: &mut std::fmt::Formatter<'_>) -> Result<(), std::fmt::Error> {
-                Ok(())
-            }
-        }
-    };
-}
-
-macro_rules! impl_deref {
-    ($from:ty => $to:ty) => {
-        impl std::ops::Deref for $from {
-            type Target = $to;
-            fn deref(&self) -> &$to {
-                unimplemented!();
-            }
-        }
-        impl std::ops::DerefMut for $from {
-            fn deref_mut(&mut self) -> &mut $to {
-                unimplemented!();
-            }
-        }
-    };
-}
-
-pub mod ssl {
-    use super::error::ErrorStack;
-    use super::x509::verify::X509VerifyParamRef;
-    use super::x509::{X509VerifyResult, X509};
-
-    /// An error returned from an ALPN selection callback.
-    pub struct AlpnError;
-    impl AlpnError {
-        /// Terminate the handshake with a fatal alert.
-        pub const ALERT_FATAL: AlpnError = Self {};
-
-        /// Do not select a protocol, but continue the handshake.
-        pub const NOACK: AlpnError = Self {};
-    }
-
-    /// A type which allows for configuration of a client-side TLS session before connection.
-    pub struct ConnectConfiguration;
-    impl_deref! {ConnectConfiguration => SslRef}
-    impl ConnectConfiguration {
-        /// Configures the use of Server Name Indication (SNI) when connecting.
-        pub fn set_use_server_name_indication(&mut self, _use_sni: bool) {
-            unimplemented!();
-        }
-
-        /// Configures the use of hostname verification when connecting.
-        pub fn set_verify_hostname(&mut self, _verify_hostname: bool) {
-            unimplemented!();
-        }
-
-        /// Returns an `Ssl` configured to connect to the provided domain.
-        pub fn into_ssl(self, _domain: &str) -> Result<Ssl, ErrorStack> {
-            unimplemented!();
-        }
-
-        /// Like `SslContextBuilder::set_verify`.
-        pub fn set_verify(&mut self, _mode: SslVerifyMode) {
-            unimplemented!();
-        }
-
-        /// Like `SslContextBuilder::set_alpn_protos`.
-        pub fn set_alpn_protos(&mut self, _protocols: &[u8]) -> Result<(), ErrorStack> {
-            unimplemented!();
-        }
-
-        /// Returns a mutable reference to the X509 verification configuration.
-        pub fn param_mut(&mut self) -> &mut X509VerifyParamRef {
-            unimplemented!();
-        }
-    }
-
-    /// An SSL error.
-    #[derive(Debug)]
-    pub struct Error;
-    impl_display!(Error);
-    impl Error {
-        pub fn code(&self) -> ErrorCode {
-            unimplemented!();
-        }
-    }
-
-    /// An error code returned from SSL functions.
-    #[derive(PartialEq)]
-    pub struct ErrorCode(i32);
-    impl ErrorCode {
-        /// An error occurred in the SSL library.
-        pub const SSL: ErrorCode = Self(0);
-    }
-
-    /// An identifier of a session name type.
-    pub struct NameType;
-    impl NameType {
-        pub const HOST_NAME: NameType = Self {};
-    }
-
-    /// The state of an SSL/TLS session.
-    pub struct Ssl;
-    impl Ssl {
-        /// Creates a new `Ssl`.
-        pub fn new(_ctx: &SslContextRef) -> Result<Ssl, ErrorStack> {
-            unimplemented!();
-        }
-    }
-    impl_deref! {Ssl => SslRef}
-
-    /// A type which wraps server-side streams in a TLS session.
-    pub struct SslAcceptor;
-    impl SslAcceptor {
-        /// Creates a new builder configured to connect to non-legacy clients. This should
-        /// generally be considered a reasonable default choice.
-        pub fn mozilla_intermediate_v5(
-            _method: SslMethod,
-        ) -> Result<SslAcceptorBuilder, ErrorStack> {
-            unimplemented!();
-        }
-    }
-
-    /// A builder for `SslAcceptor`s.
-    pub struct SslAcceptorBuilder;
-    impl SslAcceptorBuilder {
-        /// Consumes the builder, returning a `SslAcceptor`.
-        pub fn build(self) -> SslAcceptor {
-            unimplemented!();
-        }
-
-        /// Sets the callback used by a server to select a protocol for Application Layer Protocol
-        /// Negotiation (ALPN).
-        pub fn set_alpn_select_callback<F>(&mut self, _callback: F)
-        where
-            F: for<'a> Fn(&mut SslRef, &'a [u8]) -> Result<&'a [u8], AlpnError>
-                + 'static
-                + Sync
-                + Send,
-        {
-            unimplemented!();
-        }
-
-        /// Loads a certificate chain from a file.
-        pub fn set_certificate_chain_file<P: AsRef<std::path::Path>>(
-            &mut self,
-            _file: P,
-        ) -> Result<(), ErrorStack> {
-            unimplemented!();
-        }
-
-        /// Loads the private key from a file.
-        pub fn set_private_key_file<P: AsRef<std::path::Path>>(
-            &mut self,
-            _file: P,
-            _file_type: SslFiletype,
-        ) -> Result<(), ErrorStack> {
-            unimplemented!();
-        }
-
-        /// Sets the maximum supported protocol version.
-        pub fn set_max_proto_version(
-            &mut self,
-            _version: Option<SslVersion>,
-        ) -> Result<(), ErrorStack> {
-            unimplemented!();
-        }
-    }
-
-    /// Reference to an [`SslCipher`].
-    pub struct SslCipherRef;
-    impl SslCipherRef {
-        /// Returns the name of the cipher.
-        pub fn name(&self) -> &'static str {
-            unimplemented!();
-        }
-    }
-
-    /// A type which wraps client-side streams in a TLS session.
-    pub struct SslConnector;
-    impl SslConnector {
-        /// Creates a new builder for TLS connections.
-        pub fn builder(_method: SslMethod) -> Result<SslConnectorBuilder, ErrorStack> {
-            Ok(SslConnectorBuilder)
-        }
-
-        /// Returns a structure allowing for configuration of a single TLS session before connection.
-        pub fn configure(&self) -> Result<ConnectConfiguration, ErrorStack> {
-            Ok(ConnectConfiguration)
-        }
-
-        /// Returns a shared reference to the inner raw `SslContext`.
-        pub fn context(&self) -> &SslContextRef {
-            &SslContextRef
-        }
-    }
-
-    /// A builder for `SslConnector`s.
-    pub struct SslConnectorBuilder;
-    impl SslConnectorBuilder {
-        /// Consumes the builder, returning an `SslConnector`.
-        pub fn build(self) -> SslConnector {
-            SslConnector
-        }
-
-        /// Sets the list of supported ciphers for protocols before TLSv1.3.
-        pub fn set_cipher_list(&mut self, _cipher_list: &str) -> Result<(), ErrorStack> {
-            Ok(())
-        }
-
-        /// Sets the context’s supported signature algorithms.
-        pub fn set_sigalgs_list(&mut self, _sigalgs: &str) -> Result<(), ErrorStack> {
-            Ok(())
-        }
-
-        /// Sets the minimum supported protocol version.
-        pub fn set_min_proto_version(
-            &mut self,
-            _version: Option<SslVersion>,
-        ) -> Result<(), ErrorStack> {
-            Ok(())
-        }
-
-        /// Sets the maximum supported protocol version.
-        pub fn set_max_proto_version(
-            &mut self,
-            _version: Option<SslVersion>,
-        ) -> Result<(), ErrorStack> {
-            Ok(())
-        }
-
-        /// Use the default locations of trusted certificates for verification.
-        pub fn set_default_verify_paths(&mut self) -> Result<(), ErrorStack> {
-            Ok(())
-        }
-
-        /// Loads trusted root certificates from a file.
-        pub fn set_ca_file<P: AsRef<std::path::Path>>(
-            &mut self,
-            _file: P,
-        ) -> Result<(), ErrorStack> {
-            Ok(())
-        }
-
-        /// Loads a leaf certificate from a file.
-        pub fn set_certificate_file<P: AsRef<std::path::Path>>(
-            &mut self,
-            _file: P,
-            _file_type: SslFiletype,
-        ) -> Result<(), ErrorStack> {
-            Ok(())
-        }
-
-        /// Loads the private key from a file.
-        pub fn set_private_key_file<P: AsRef<std::path::Path>>(
-            &mut self,
-            _file: P,
-            _file_type: SslFiletype,
-        ) -> Result<(), ErrorStack> {
-            Ok(())
-        }
-
-        /// Sets the TLS key logging callback.
-        pub fn set_keylog_callback<F>(&mut self, _callback: F)
-        where
-            F: Fn(&SslRef, &str) + 'static + Sync + Send,
-        {
-        }
-    }
-
-    /// A context object for TLS streams.
-    pub struct SslContext;
-    impl SslContext {
-        /// Creates a new builder object for an `SslContext`.
-        pub fn builder(_method: SslMethod) -> Result<SslContextBuilder, ErrorStack> {
-            unimplemented!();
-        }
-    }
-    impl_deref! {SslContext => SslContextRef}
-
-    /// A builder for `SslContext`s.
-    pub struct SslContextBuilder;
-    impl SslContextBuilder {
-        /// Consumes the builder, returning a new `SslContext`.
-        pub fn build(self) -> SslContext {
-            unimplemented!();
-        }
-    }
-
-    /// Reference to [`SslContext`]
-    pub struct SslContextRef;
-
-    /// An identifier of the format of a certificate or key file.
-    pub struct SslFiletype;
-    impl SslFiletype {
-        /// The PEM format.
-        pub const PEM: SslFiletype = Self {};
-    }
-
-    /// A type specifying the kind of protocol an `SslContext`` will speak.
-    pub struct SslMethod;
-    impl SslMethod {
-        /// Support all versions of the TLS protocol.
-        pub fn tls() -> SslMethod {
-            Self
-        }
-    }
-
-    /// Reference to an [`Ssl`].
-    pub struct SslRef;
-    impl SslRef {
-        /// Like [`SslContextBuilder::set_verify`].
-        pub fn set_verify(&mut self, _mode: SslVerifyMode) {
-            unimplemented!();
-        }
-
-        /// Returns the current cipher if the session is active.
-        pub fn current_cipher(&self) -> Option<&SslCipherRef> {
-            unimplemented!();
-        }
-
-        /// Sets the host name to be sent to the server for Server Name Indication (SNI).
-        pub fn set_hostname(&mut self, _hostname: &str) -> Result<(), ErrorStack> {
-            unimplemented!();
-        }
-
-        /// Returns the peer’s certificate, if present.
-        pub fn peer_certificate(&self) -> Option<X509> {
-            unimplemented!();
-        }
-
-        /// Returns the certificate verification result.
-        pub fn verify_result(&self) -> X509VerifyResult {
-            unimplemented!();
-        }
-
-        /// Returns a string describing the protocol version of the session.
-        pub fn version_str(&self) -> &'static str {
-            unimplemented!();
-        }
-
-        /// Returns the protocol selected via Application Layer Protocol Negotiation (ALPN).
-        pub fn selected_alpn_protocol(&self) -> Option<&[u8]> {
-            unimplemented!();
-        }
-
-        /// Returns the servername sent by the client via Server Name Indication (SNI).
-        pub fn servername(&self, _type_: NameType) -> Option<&str> {
-            unimplemented!();
-        }
-    }
-
-    /// Options controlling the behavior of certificate verification.
-    pub struct SslVerifyMode;
-    impl SslVerifyMode {
-        /// Verifies that the peer’s certificate is trusted.
-        pub const PEER: Self = Self {};
-
-        /// Disables verification of the peer’s certificate.
-        pub const NONE: Self = Self {};
-    }
-
-    /// An SSL/TLS protocol version.
-    pub struct SslVersion;
-    impl SslVersion {
-        /// TLSv1.0
-        pub const TLS1: SslVersion = Self {};
-
-        /// TLSv1.2
-        pub const TLS1_2: SslVersion = Self {};
-
-        /// TLSv1.3
-        pub const TLS1_3: SslVersion = Self {};
-    }
-
-    /// A standard implementation of protocol selection for Application Layer Protocol Negotiation
-    /// (ALPN).
-    pub fn select_next_proto<'a>(_server: &[u8], _client: &'a [u8]) -> Option<&'a [u8]> {
-        unimplemented!();
-    }
-}
-
-pub mod ssl_sys {
-    pub const X509_V_OK: i32 = 0;
-    pub const X509_V_ERR_INVALID_CALL: i32 = 69;
-}
-
-pub mod error {
-    use super::ssl::Error;
-
-    /// Collection of [`Errors`] from OpenSSL.
-    #[derive(Debug)]
-    pub struct ErrorStack;
-    impl_display!(ErrorStack);
-    impl std::error::Error for ErrorStack {}
-    impl ErrorStack {
-        /// Returns the contents of the OpenSSL error stack.
-        pub fn get() -> ErrorStack {
-            unimplemented!();
-        }
-
-        /// Returns the errors in the stack.
-        pub fn errors(&self) -> &[Error] {
-            unimplemented!();
-        }
-    }
-}
-
-pub mod x509 {
-    use super::asn1::{Asn1IntegerRef, Asn1StringRef, Asn1TimeRef};
-    use super::error::ErrorStack;
-    use super::hash::{DigestBytes, MessageDigest};
-    use super::nid::Nid;
-
-    /// An `X509` public key certificate.
-    #[derive(Debug, Clone)]
-    pub struct X509;
-    impl_deref! {X509 => X509Ref}
-    impl X509 {
-        /// Deserializes a PEM-encoded X509 structure.
-        pub fn from_pem(_pem: &[u8]) -> Result<X509, ErrorStack> {
-            unimplemented!();
-        }
-    }
-
-    /// A type to destructure and examine an `X509Name`.
-    pub struct X509NameEntries<'a> {
-        marker: std::marker::PhantomData<&'a ()>,
-    }
-    impl<'a> Iterator for X509NameEntries<'a> {
-        type Item = &'a X509NameEntryRef;
-        fn next(&mut self) -> Option<&'a X509NameEntryRef> {
-            unimplemented!();
-        }
-    }
-
-    /// Reference to `X509NameEntry`.
-    pub struct X509NameEntryRef;
-    impl X509NameEntryRef {
-        pub fn data(&self) -> &Asn1StringRef {
-            unimplemented!();
-        }
-    }
-
-    /// Reference to `X509Name`.
-    pub struct X509NameRef;
-    impl X509NameRef {
-        /// Returns the name entries by the nid.
-        pub fn entries_by_nid(&self, _nid: Nid) -> X509NameEntries<'_> {
-            unimplemented!();
-        }
-    }
-
-    /// Reference to `X509`.
-    pub struct X509Ref;
-    impl X509Ref {
-        /// Returns this certificate’s subject name.
-        pub fn subject_name(&self) -> &X509NameRef {
-            unimplemented!();
-        }
-
-        /// Returns a digest of the DER representation of the certificate.
-        pub fn digest(&self, _hash_type: MessageDigest) -> Result<DigestBytes, ErrorStack> {
-            unimplemented!();
-        }
-
-        /// Returns the certificate’s Not After validity period.
-        pub fn not_after(&self) -> &Asn1TimeRef {
-            unimplemented!();
-        }
-
-        /// Returns this certificate’s serial number.
-        pub fn serial_number(&self) -> &Asn1IntegerRef {
-            unimplemented!();
-        }
-    }
-
-    /// The result of peer certificate verification.
-    pub struct X509VerifyResult;
-    impl X509VerifyResult {
-        /// Return the integer representation of an `X509VerifyResult`.
-        pub fn as_raw(&self) -> i32 {
-            unimplemented!();
-        }
-    }
-
-    pub mod store {
-        use super::super::error::ErrorStack;
-        use super::X509;
-
-        /// A builder type used to construct an `X509Store`.
-        pub struct X509StoreBuilder;
-        impl X509StoreBuilder {
-            /// Returns a builder for a certificate store..
-            pub fn new() -> Result<X509StoreBuilder, ErrorStack> {
-                unimplemented!();
-            }
-
-            /// Constructs the `X509Store`.
-            pub fn build(self) -> X509Store {
-                unimplemented!();
-            }
-
-            /// Adds a certificate to the certificate store.
-            pub fn add_cert(&mut self, _cert: X509) -> Result<(), ErrorStack> {
-                unimplemented!();
-            }
-        }
-
-        /// A certificate store to hold trusted X509 certificates.
-        pub struct X509Store;
-        impl_deref! {X509Store => X509StoreRef}
-
-        /// Reference to an `X509Store`.
-        pub struct X509StoreRef;
-    }
-
-    pub mod verify {
-        /// Reference to `X509VerifyParam`.
-        pub struct X509VerifyParamRef;
-    }
-}
-
-pub mod nid {
-    /// A numerical identifier for an OpenSSL object.
-    pub struct Nid;
-    impl Nid {
-        pub const COMMONNAME: Nid = Self {};
-        pub const ORGANIZATIONNAME: Nid = Self {};
-        pub const ORGANIZATIONALUNITNAME: Nid = Self {};
-    }
-}
-
-pub mod pkey {
-    use super::error::ErrorStack;
-
-    /// A public or private key.
-    #[derive(Clone)]
-    pub struct PKey<T> {
-        marker: std::marker::PhantomData<T>,
-    }
-    impl<T> std::ops::Deref for PKey<T> {
-        type Target = PKeyRef<T>;
-        fn deref(&self) -> &PKeyRef<T> {
-            unimplemented!();
-        }
-    }
-    impl<T> std::ops::DerefMut for PKey<T> {
-        fn deref_mut(&mut self) -> &mut PKeyRef<T> {
-            unimplemented!();
-        }
-    }
-    impl PKey<Private> {
-        pub fn private_key_from_pem(_pem: &[u8]) -> Result<PKey<Private>, ErrorStack> {
-            unimplemented!();
-        }
-    }
-
-    /// Reference to `PKey`.
-    pub struct PKeyRef<T> {
-        marker: std::marker::PhantomData<T>,
-    }
-
-    /// A tag type indicating that a key has private components.
-    #[derive(Clone)]
-    pub enum Private {}
-    unsafe impl HasPrivate for Private {}
-
-    /// A trait indicating that a key has private components.
-    pub unsafe trait HasPrivate {}
-}
-
-pub mod hash {
-    /// A message digest algorithm.
-    pub struct MessageDigest;
-    impl MessageDigest {
-        pub fn sha256() -> MessageDigest {
-            unimplemented!();
-        }
-    }
-
-    /// The resulting bytes of a digest.
-    pub struct DigestBytes;
-    impl AsRef<[u8]> for DigestBytes {
-        fn as_ref(&self) -> &[u8] {
-            unimplemented!();
-        }
-    }
-}
-
-pub mod asn1 {
-    use super::bn::BigNum;
-    use super::error::ErrorStack;
-
-    /// A reference to an `Asn1Integer`.
-    pub struct Asn1IntegerRef;
-    impl Asn1IntegerRef {
-        /// Converts the integer to a `BigNum`.
-        pub fn to_bn(&self) -> Result<BigNum, ErrorStack> {
-            unimplemented!();
-        }
-    }
-
-    /// A reference to an `Asn1String`.
-    pub struct Asn1StringRef;
-    impl Asn1StringRef {
-        pub fn as_utf8(&self) -> Result<&str, ErrorStack> {
-            unimplemented!();
-        }
-    }
-
-    /// Reference to an `Asn1Time`
-    pub struct Asn1TimeRef;
-    impl_display! {Asn1TimeRef}
-}
-
-pub mod bn {
-    use super::error::ErrorStack;
-
-    /// Dynamically sized large number implementation
-    pub struct BigNum;
-    impl BigNum {
-        /// Returns a hexadecimal string representation of `self`.
-        pub fn to_hex_str(&self) -> Result<&str, ErrorStack> {
-            unimplemented!();
-        }
-    }
-}
-
-pub mod ext {
-    use super::error::ErrorStack;
-    use super::pkey::{HasPrivate, PKeyRef};
-    use super::ssl::{Ssl, SslAcceptor, SslRef};
-    use super::x509::store::X509StoreRef;
-    use super::x509::verify::X509VerifyParamRef;
-    use super::x509::X509Ref;
-
-    /// Add name as an additional reference identifier that can match the peer's certificate
-    pub fn add_host(_verify_param: &mut X509VerifyParamRef, _host: &str) -> Result<(), ErrorStack> {
-        unimplemented!();
-    }
-
-    /// Set the verify cert store of `_ssl`
-    pub fn ssl_set_verify_cert_store(
-        _ssl: &mut SslRef,
-        _cert_store: &X509StoreRef,
-    ) -> Result<(), ErrorStack> {
-        unimplemented!();
-    }
-
-    /// Load the certificate into `_ssl`
-    pub fn ssl_use_certificate(_ssl: &mut SslRef, _cert: &X509Ref) -> Result<(), ErrorStack> {
-        unimplemented!();
-    }
-
-    /// Load the private key into `_ssl`
-    pub fn ssl_use_private_key<T>(_ssl: &mut SslRef, _key: &PKeyRef<T>) -> Result<(), ErrorStack>
-    where
-        T: HasPrivate,
-    {
-        unimplemented!();
-    }
-
-    /// Clear the error stack
-    pub fn clear_error_stack() {}
-
-    /// Create a new [Ssl] from &[SslAcceptor]
-    pub fn ssl_from_acceptor(_acceptor: &SslAcceptor) -> Result<Ssl, ErrorStack> {
-        unimplemented!();
-    }
-
-    /// Suspend the TLS handshake when a certificate is needed.
-    pub fn suspend_when_need_ssl_cert(_ssl: &mut SslRef) {
-        unimplemented!();
-    }
-
-    /// Unblock a TLS handshake after the certificate is set.
-    pub fn unblock_ssl_cert(_ssl: &mut SslRef) {
-        unimplemented!();
-    }
-
-    /// Whether the TLS error is SSL_ERROR_WANT_X509_LOOKUP
-    pub fn is_suspended_for_cert(_error: &super::ssl::Error) -> bool {
-        unimplemented!();
-    }
-
-    /// Add the certificate into the cert chain of `_ssl`
-    pub fn ssl_add_chain_cert(_ssl: &mut SslRef, _cert: &X509Ref) -> Result<(), ErrorStack> {
-        unimplemented!();
-    }
-
-    /// Set renegotiation
-    pub fn ssl_set_renegotiate_mode_freely(_ssl: &mut SslRef) {}
-
-    /// Set the curves/groups of `_ssl`
-    pub fn ssl_set_groups_list(_ssl: &mut SslRef, _groups: &str) -> Result<(), ErrorStack> {
-        unimplemented!();
-    }
-
-    /// Sets whether a second keyshare to be sent in client hello when PQ is used.
-    pub fn ssl_use_second_key_share(_ssl: &mut SslRef, _enabled: bool) {}
-
-    /// Get a mutable SslRef ouf of SslRef, which is a missing functionality even when holding &mut SslStream
-    /// # Safety
-    pub unsafe fn ssl_mut(_ssl: &SslRef) -> &mut SslRef {
-        unimplemented!();
-    }
-}
-
-pub mod tokio_ssl {
-    use std::pin::Pin;
-    use std::task::{Context, Poll};
-    use tokio::io::{AsyncRead, AsyncWrite, ReadBuf};
-
-    use super::error::ErrorStack;
-    use super::ssl::{Error, Ssl, SslRef};
-
-    /// A TLS session over a stream.
-    #[derive(Debug)]
-    pub struct SslStream<S> {
-        marker: std::marker::PhantomData<S>,
-    }
-    impl<S> SslStream<S> {
-        /// Creates a new `SslStream`.
-        pub fn new(_ssl: Ssl, _stream: S) -> Result<Self, ErrorStack> {
-            unimplemented!();
-        }
-
-        /// Initiates a client-side TLS handshake.
-        pub async fn connect(self: Pin<&mut Self>) -> Result<(), Error> {
-            unimplemented!();
-        }
-
-        /// Initiates a server-side TLS handshake.
-        pub async fn accept(self: Pin<&mut Self>) -> Result<(), Error> {
-            unimplemented!();
-        }
-
-        /// Returns a shared reference to the `Ssl` object associated with this stream.
-        pub fn ssl(&self) -> &SslRef {
-            unimplemented!();
-        }
-
-        /// Returns a shared reference to the underlying stream.
-        pub fn get_ref(&self) -> &S {
-            unimplemented!();
-        }
-
-        /// Returns a mutable reference to the underlying stream.
-        pub fn get_mut(&mut self) -> &mut S {
-            unimplemented!();
-        }
-    }
-    impl<S> AsyncRead for SslStream<S>
-    where
-        S: AsyncRead + AsyncWrite,
-    {
-        fn poll_read(
-            self: Pin<&mut Self>,
-            _ctx: &mut Context<'_>,
-            _buf: &mut ReadBuf<'_>,
-        ) -> Poll<std::io::Result<()>> {
-            unimplemented!();
-        }
-    }
-    impl<S> AsyncWrite for SslStream<S>
-    where
-        S: AsyncRead + AsyncWrite,
-    {
-        fn poll_write(
-            self: Pin<&mut Self>,
-            _ctx: &mut Context<'_>,
-            _buf: &[u8],
-        ) -> Poll<std::io::Result<usize>> {
-            unimplemented!();
-        }
-
-        fn poll_flush(self: Pin<&mut Self>, _ctx: &mut Context<'_>) -> Poll<std::io::Result<()>> {
-            unimplemented!();
-        }
-
-        fn poll_shutdown(
-            self: Pin<&mut Self>,
-            _ctx: &mut Context<'_>,
-        ) -> Poll<std::io::Result<()>> {
-            unimplemented!();
-        }
-    }
-}
diff --git a/pingora-core/src/protocols/tls/mod.rs b/pingora-core/src/protocols/tls/mod.rs
index fceb0a5..c479a2d 100644
--- a/pingora-core/src/protocols/tls/mod.rs
+++ b/pingora-core/src/protocols/tls/mod.rs
@@ -15,177 +15,19 @@
 //! The TLS layer implementations
 
 pub mod digest;
+pub use digest::*;
 
-#[cfg(feature = "some_tls")]
+#[cfg(feature = "openssl_derived")]
 mod boringssl_openssl;
 
-#[cfg(feature = "some_tls")]
+#[cfg(feature = "openssl_derived")]
 pub use boringssl_openssl::*;
 
-#[cfg(not(feature = "some_tls"))]
-pub mod dummy_tls;
+#[cfg(not(feature = "any_tls"))]
+pub mod noop_tls;
 
-use crate::protocols::digest::TimingDigest;
-use crate::protocols::{Peek, Ssl, UniqueID, UniqueIDType};
-use crate::tls::{self, ssl, tokio_ssl::SslStream as InnerSsl};
-use log::warn;
-use pingora_error::{ErrorType::*, OrErr, Result};
-use std::pin::Pin;
-use std::sync::Arc;
-use std::task::{Context, Poll};
-use std::time::SystemTime;
-use tokio::io::{self, AsyncRead, AsyncWrite, ReadBuf};
-
-pub use digest::SslDigest;
-
-/// The TLS connection
-#[derive(Debug)]
-pub struct SslStream<T> {
-    ssl: InnerSsl<T>,
-    digest: Option<Arc<SslDigest>>,
-    timing: TimingDigest,
-}
-
-impl<T> SslStream<T>
-where
-    T: AsyncRead + AsyncWrite + std::marker::Unpin,
-{
-    /// Create a new TLS connection from the given `stream`
-    ///
-    /// The caller needs to perform [`Self::connect()`] or [`Self::accept()`] to perform TLS
-    /// handshake after.
-    pub fn new(ssl: ssl::Ssl, stream: T) -> Result<Self> {
-        let ssl = InnerSsl::new(ssl, stream)
-            .explain_err(TLSHandshakeFailure, |e| format!("ssl stream error: {e}"))?;
-
-        Ok(SslStream {
-            ssl,
-            digest: None,
-            timing: Default::default(),
-        })
-    }
-
-    /// Connect to the remote TLS server as a client
-    pub async fn connect(&mut self) -> Result<(), ssl::Error> {
-        Self::clear_error();
-        Pin::new(&mut self.ssl).connect().await?;
-        self.timing.established_ts = SystemTime::now();
-        self.digest = Some(Arc::new(SslDigest::from_ssl(self.ssl())));
-        Ok(())
-    }
-
-    /// Finish the TLS handshake from client as a server
-    pub async fn accept(&mut self) -> Result<(), ssl::Error> {
-        Self::clear_error();
-        Pin::new(&mut self.ssl).accept().await?;
-        self.timing.established_ts = SystemTime::now();
-        self.digest = Some(Arc::new(SslDigest::from_ssl(self.ssl())));
-        Ok(())
-    }
-
-    #[inline]
-    fn clear_error() {
-        let errs = tls::error::ErrorStack::get();
-        if !errs.errors().is_empty() {
-            warn!("Clearing dirty TLS error stack: {}", errs);
-        }
-    }
-}
-
-impl<T> SslStream<T> {
-    pub fn ssl_digest(&self) -> Option<Arc<SslDigest>> {
-        self.digest.clone()
-    }
-}
-
-use std::ops::{Deref, DerefMut};
-
-impl<T> Deref for SslStream<T> {
-    type Target = InnerSsl<T>;
-
-    fn deref(&self) -> &Self::Target {
-        &self.ssl
-    }
-}
-
-impl<T> DerefMut for SslStream<T> {
-    fn deref_mut(&mut self) -> &mut Self::Target {
-        &mut self.ssl
-    }
-}
-
-impl<T> AsyncRead for SslStream<T>
-where
-    T: AsyncRead + AsyncWrite + Unpin,
-{
-    fn poll_read(
-        mut self: Pin<&mut Self>,
-        cx: &mut Context<'_>,
-        buf: &mut ReadBuf<'_>,
-    ) -> Poll<io::Result<()>> {
-        Self::clear_error();
-        Pin::new(&mut self.ssl).poll_read(cx, buf)
-    }
-}
-
-impl<T> AsyncWrite for SslStream<T>
-where
-    T: AsyncRead + AsyncWrite + Unpin,
-{
-    fn poll_write(
-        mut self: Pin<&mut Self>,
-        cx: &mut Context,
-        buf: &[u8],
-    ) -> Poll<io::Result<usize>> {
-        Self::clear_error();
-        Pin::new(&mut self.ssl).poll_write(cx, buf)
-    }
-
-    fn poll_flush(mut self: Pin<&mut Self>, cx: &mut Context) -> Poll<io::Result<()>> {
-        Self::clear_error();
-        Pin::new(&mut self.ssl).poll_flush(cx)
-    }
-
-    fn poll_shutdown(mut self: Pin<&mut Self>, cx: &mut Context) -> Poll<io::Result<()>> {
-        Self::clear_error();
-        Pin::new(&mut self.ssl).poll_shutdown(cx)
-    }
-
-    fn poll_write_vectored(
-        mut self: Pin<&mut Self>,
-        cx: &mut Context<'_>,
-        bufs: &[std::io::IoSlice<'_>],
-    ) -> Poll<io::Result<usize>> {
-        Self::clear_error();
-        Pin::new(&mut self.ssl).poll_write_vectored(cx, bufs)
-    }
-
-    fn is_write_vectored(&self) -> bool {
-        true
-    }
-}
-
-impl<T> UniqueID for SslStream<T>
-where
-    T: UniqueID,
-{
-    fn id(&self) -> UniqueIDType {
-        self.ssl.get_ref().id()
-    }
-}
-
-impl<T> Ssl for SslStream<T> {
-    fn get_ssl(&self) -> Option<&ssl::SslRef> {
-        Some(self.ssl())
-    }
-
-    fn get_ssl_digest(&self) -> Option<Arc<SslDigest>> {
-        self.ssl_digest()
-    }
-}
-
-// TODO: implement Peek if needed
-impl<T> Peek for SslStream<T> {}
+#[cfg(not(feature = "any_tls"))]
+pub use noop_tls::*;
 
 /// The protocol for Application-Layer Protocol Negotiation
 #[derive(Hash, Clone, Debug)]
@@ -236,6 +78,7 @@ impl ALPN {
         }
     }
 
+    #[cfg(feature = "openssl_derived")]
     pub(crate) fn to_wire_preference(&self) -> &[u8] {
         // https://www.openssl.org/docs/manmaster/man3/SSL_CTX_set_alpn_select_cb.html
         // "vector of nonempty, 8-bit length-prefixed, byte strings"
@@ -246,6 +89,7 @@ impl ALPN {
         }
     }
 
+    #[cfg(feature = "any_tls")]
     pub(crate) fn from_wire_selected(raw: &[u8]) -> Option<Self> {
         match raw {
             b"http/1.1" => Some(Self::H1),
@@ -253,4 +97,13 @@ impl ALPN {
             _ => None,
         }
     }
+
+    #[cfg(feature = "rustls")]
+    pub(crate) fn to_wire_protocols(&self) -> Vec<Vec<u8>> {
+        match self {
+            ALPN::H1 => vec![b"http/1.1".to_vec()],
+            ALPN::H2 => vec![b"h2".to_vec()],
+            ALPN::H2H1 => vec![b"h2".to_vec(), b"http/1.1".to_vec()],
+        }
+    }
 }
diff --git a/pingora-core/src/protocols/tls/noop_tls/mod.rs b/pingora-core/src/protocols/tls/noop_tls/mod.rs
new file mode 100644
index 0000000..5e8a701
--- /dev/null
+++ b/pingora-core/src/protocols/tls/noop_tls/mod.rs
@@ -0,0 +1,216 @@
+// Copyright 2024 Cloudflare, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! This is a set of stubs that provides the minimum types to let pingora work
+//! without any tls providers configured
+
+pub struct TlsRef;
+
+pub type CaType = [CertWrapper];
+
+#[derive(Debug)]
+pub struct CertWrapper;
+
+impl CertWrapper {
+    pub fn not_after(&self) -> &str {
+        ""
+    }
+}
+
+pub mod connectors {
+    use pingora_error::Result;
+
+    use crate::{
+        connectors::ConnectorOptions,
+        protocols::{ALPN, IO},
+        upstreams::peer::Peer,
+    };
+
+    use super::stream::SslStream;
+
+    #[derive(Clone)]
+    pub struct Connector {
+        pub ctx: TlsConnector,
+    }
+
+    #[derive(Clone)]
+    pub struct TlsConnector;
+
+    pub struct TlsSettings;
+
+    impl Connector {
+        pub fn new(_: Option<ConnectorOptions>) -> Self {
+            Self { ctx: TlsConnector }
+        }
+    }
+
+    pub async fn connect<T, P>(
+        _: T,
+        _: &P,
+        _: Option<ALPN>,
+        _: &TlsConnector,
+    ) -> Result<SslStream<T>>
+    where
+        T: IO,
+        P: Peer + Send + Sync,
+    {
+        Ok(SslStream::default())
+    }
+}
+
+pub mod listeners {
+    use pingora_error::Result;
+    use tokio::io::{AsyncRead, AsyncWrite};
+
+    use super::stream::SslStream;
+
+    pub struct Acceptor;
+
+    pub struct TlsSettings;
+
+    impl TlsSettings {
+        pub fn build(&self) -> Acceptor {
+            Acceptor
+        }
+
+        pub fn intermediate(_: &str, _: &str) -> Result<Self> {
+            Ok(Self)
+        }
+
+        pub fn enable_h2(&mut self) {}
+    }
+
+    impl Acceptor {
+        pub async fn tls_handshake<S: AsyncRead + AsyncWrite>(&self, _: S) -> Result<SslStream<S>> {
+            unimplemented!("No tls feature was specified")
+        }
+    }
+}
+
+pub mod stream {
+    use std::{
+        pin::Pin,
+        task::{Context, Poll},
+    };
+
+    use async_trait::async_trait;
+    use tokio::io::{AsyncRead, AsyncWrite, ReadBuf};
+
+    use crate::protocols::{
+        GetProxyDigest, GetSocketDigest, GetTimingDigest, Shutdown, Ssl, UniqueID,
+    };
+
+    /// A TLS session over a stream.
+    #[derive(Debug)]
+    pub struct SslStream<S> {
+        marker: std::marker::PhantomData<S>,
+    }
+
+    impl<S> Default for SslStream<S> {
+        fn default() -> Self {
+            Self {
+                marker: Default::default(),
+            }
+        }
+    }
+
+    impl<S> AsyncRead for SslStream<S>
+    where
+        S: AsyncRead + AsyncWrite,
+    {
+        fn poll_read(
+            self: Pin<&mut Self>,
+            _ctx: &mut Context<'_>,
+            _buf: &mut ReadBuf<'_>,
+        ) -> Poll<std::io::Result<()>> {
+            Poll::Ready(Ok(()))
+        }
+    }
+
+    impl<S> AsyncWrite for SslStream<S>
+    where
+        S: AsyncRead + AsyncWrite,
+    {
+        fn poll_write(
+            self: Pin<&mut Self>,
+            _ctx: &mut Context<'_>,
+            buf: &[u8],
+        ) -> Poll<std::io::Result<usize>> {
+            Poll::Ready(Ok(buf.len()))
+        }
+
+        fn poll_flush(self: Pin<&mut Self>, _ctx: &mut Context<'_>) -> Poll<std::io::Result<()>> {
+            Poll::Ready(Ok(()))
+        }
+
+        fn poll_shutdown(
+            self: Pin<&mut Self>,
+            _ctx: &mut Context<'_>,
+        ) -> Poll<std::io::Result<()>> {
+            Poll::Ready(Ok(()))
+        }
+    }
+
+    #[async_trait]
+    impl<S: Send> Shutdown for SslStream<S> {
+        async fn shutdown(&mut self) {}
+    }
+
+    impl<S> UniqueID for SslStream<S> {
+        fn id(&self) -> crate::protocols::UniqueIDType {
+            0
+        }
+    }
+
+    impl<S> Ssl for SslStream<S> {}
+
+    impl<S> GetTimingDigest for SslStream<S> {
+        fn get_timing_digest(&self) -> Vec<Option<crate::protocols::TimingDigest>> {
+            vec![]
+        }
+    }
+
+    impl<S> GetProxyDigest for SslStream<S> {
+        fn get_proxy_digest(
+            &self,
+        ) -> Option<std::sync::Arc<crate::protocols::raw_connect::ProxyDigest>> {
+            None
+        }
+    }
+
+    impl<S> GetSocketDigest for SslStream<S> {
+        fn get_socket_digest(&self) -> Option<std::sync::Arc<crate::protocols::SocketDigest>> {
+            None
+        }
+    }
+}
+
+pub mod utils {
+    use std::fmt::Display;
+
+    use super::CertWrapper;
+
+    #[derive(Debug, Clone, Hash)]
+    pub struct CertKey;
+
+    impl Display for CertKey {
+        fn fmt(&self, _: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+            Ok(())
+        }
+    }
+
+    pub fn get_organization_unit(_: &CertWrapper) -> Option<String> {
+        None
+    }
+}
diff --git a/pingora-core/src/services/listening.rs b/pingora-core/src/services/listening.rs
index b1b2800..3cdb3b8 100644
--- a/pingora-core/src/services/listening.rs
+++ b/pingora-core/src/services/listening.rs
@@ -19,7 +19,8 @@
 //! more endpoints to listen to.
 
 use crate::apps::ServerApp;
-use crate::listeners::{Listeners, ServerAddress, TcpSocketOptions, TlsSettings, TransportStack};
+use crate::listeners::tls::TlsSettings;
+use crate::listeners::{Listeners, ServerAddress, TcpSocketOptions, TransportStack};
 use crate::protocols::Stream;
 #[cfg(unix)]
 use crate::server::ListenFds;
diff --git a/pingora-core/src/upstreams/peer.rs b/pingora-core/src/upstreams/peer.rs
index 4030667..87bfab6 100644
--- a/pingora-core/src/upstreams/peer.rs
+++ b/pingora-core/src/upstreams/peer.rs
@@ -33,11 +33,11 @@ use std::time::Duration;
 
 use crate::connectors::{l4::BindTo, L4Connect};
 use crate::protocols::l4::socket::SocketAddr;
+use crate::protocols::tls::CaType;
 #[cfg(unix)]
 use crate::protocols::ConnFdReusable;
 use crate::protocols::TcpKeepalive;
-use crate::tls::x509::X509;
-use crate::utils::{get_organization_unit, CertKey};
+use crate::utils::tls::{get_organization_unit, CertKey};
 
 pub use crate::protocols::tls::ALPN;
 
@@ -148,7 +148,7 @@ pub trait Peer: Display + Clone {
     /// Get the CA cert to use to validate the server cert.
     ///
     /// If not set, the default CAs will be used.
-    fn get_ca(&self) -> Option<&Arc<Box<[X509]>>> {
+    fn get_ca(&self) -> Option<&Arc<CaType>> {
         match self.get_peer_options() {
             Some(opt) => opt.ca.as_ref(),
             None => None,
@@ -316,7 +316,7 @@ pub struct PeerOptions {
     /* accept the cert if it's CN matches the SNI or this name */
     pub alternative_cn: Option<String>,
     pub alpn: ALPN,
-    pub ca: Option<Arc<Box<[X509]>>>,
+    pub ca: Option<Arc<CaType>>,
     pub tcp_keepalive: Option<TcpKeepalive>,
     pub tcp_recv_buf: Option<usize>,
     pub dscp: Option<u8>,
diff --git a/pingora-core/src/utils/mod.rs b/pingora-core/src/utils/mod.rs
index c36f7c8..9826cf9 100644
--- a/pingora-core/src/utils/mod.rs
+++ b/pingora-core/src/utils/mod.rs
@@ -15,12 +15,13 @@
 //! This module contains various types that make it easier to work with bytes and X509
 //! certificates.
 
-// TODO: move below to its own mod
-use crate::tls::{nid::Nid, pkey::PKey, pkey::Private, x509::X509};
-use crate::Result;
+#[cfg(feature = "any_tls")]
+pub mod tls;
+
+#[cfg(not(feature = "any_tls"))]
+pub use crate::tls::utils as tls;
+
 use bytes::Bytes;
-use pingora_error::{ErrorType::*, OrErr};
-use std::hash::{Hash, Hasher};
 
 /// A `BufRef` is a reference to a buffer of bytes. It removes the need for self-referential data
 /// structures. It is safe to use as long as the underlying buffer does not get mutated.
@@ -108,125 +109,3 @@ pub const EMPTY_KV_REF: KVRef = KVRef {
     name: BufRef(0, 0),
     value: BufRef(0, 0),
 };
-
-fn get_subject_name(cert: &X509, name_type: Nid) -> Option<String> {
-    cert.subject_name()
-        .entries_by_nid(name_type)
-        .next()
-        .map(|name| {
-            name.data()
-                .as_utf8()
-                .map(|s| s.to_string())
-                .unwrap_or_default()
-        })
-}
-
-/// Return the organization associated with the X509 certificate.
-pub fn get_organization(cert: &X509) -> Option<String> {
-    get_subject_name(cert, Nid::ORGANIZATIONNAME)
-}
-
-/// Return the common name associated with the X509 certificate.
-pub fn get_common_name(cert: &X509) -> Option<String> {
-    get_subject_name(cert, Nid::COMMONNAME)
-}
-
-/// Return the common name associated with the X509 certificate.
-pub fn get_organization_unit(cert: &X509) -> Option<String> {
-    get_subject_name(cert, Nid::ORGANIZATIONALUNITNAME)
-}
-
-/// Return the serial number associated with the X509 certificate as a hexadecimal value.
-pub fn get_serial(cert: &X509) -> Result<String> {
-    let bn = cert
-        .serial_number()
-        .to_bn()
-        .or_err(InvalidCert, "Invalid serial")?;
-    let hex = bn.to_hex_str().or_err(InvalidCert, "Invalid serial")?;
-
-    let hex_str: &str = hex.as_ref();
-    Ok(hex_str.to_owned())
-}
-
-/// This type contains a list of one or more certificates and an associated private key. The leaf
-/// certificate should always be first.
-#[derive(Clone)]
-pub struct CertKey {
-    certificates: Vec<X509>,
-    key: PKey<Private>,
-}
-
-impl CertKey {
-    /// Create a new `CertKey` given a list of certificates and a private key.
-    pub fn new(certificates: Vec<X509>, key: PKey<Private>) -> CertKey {
-        assert!(
-            !certificates.is_empty(),
-            "expected a non-empty vector of certificates in CertKey::new"
-        );
-
-        CertKey { certificates, key }
-    }
-
-    /// Peek at the leaf certificate.
-    pub fn leaf(&self) -> &X509 {
-        // This is safe due to the assertion above.
-        &self.certificates[0]
-    }
-
-    /// Return the key.
-    pub fn key(&self) -> &PKey<Private> {
-        &self.key
-    }
-
-    /// Return a slice of intermediate certificates. An empty slice means there are none.
-    pub fn intermediates(&self) -> &[X509] {
-        if self.certificates.len() <= 1 {
-            return &[];
-        }
-        &self.certificates[1..]
-    }
-
-    /// Return the organization from the leaf certificate.
-    pub fn organization(&self) -> Option<String> {
-        get_organization(self.leaf())
-    }
-
-    /// Return the serial from the leaf certificate.
-    pub fn serial(&self) -> Result<String> {
-        get_serial(self.leaf())
-    }
-}
-
-impl Hash for CertKey {
-    fn hash<H: Hasher>(&self, state: &mut H) {
-        for certificate in &self.certificates {
-            if let Ok(serial) = get_serial(certificate) {
-                serial.hash(state)
-            }
-        }
-    }
-}
-
-// hide private key
-impl std::fmt::Debug for CertKey {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("CertKey")
-            .field("X509", &self.leaf())
-            .finish()
-    }
-}
-
-impl std::fmt::Display for CertKey {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        let leaf = self.leaf();
-        if let Some(cn) = get_common_name(leaf) {
-            // Write CN if it exists
-            write!(f, "CN: {cn},")?;
-        } else if let Some(org_unit) = get_organization_unit(leaf) {
-            // CA cert might not have CN, so print its unit name instead
-            write!(f, "Org Unit: {org_unit},")?;
-        }
-        write!(f, ", expire: {}", leaf.not_after())
-        // ignore the details of the private key
-    }
-}
diff --git a/pingora-core/src/utils/tls/boringssl_openssl.rs b/pingora-core/src/utils/tls/boringssl_openssl.rs
new file mode 100644
index 0000000..8842c3c
--- /dev/null
+++ b/pingora-core/src/utils/tls/boringssl_openssl.rs
@@ -0,0 +1,140 @@
+// Copyright 2024 Cloudflare, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use crate::tls::{nid::Nid, pkey::PKey, pkey::Private, x509::X509};
+use crate::Result;
+use pingora_error::{ErrorType::*, OrErr};
+use std::hash::{Hash, Hasher};
+
+fn get_subject_name(cert: &X509, name_type: Nid) -> Option<String> {
+    cert.subject_name()
+        .entries_by_nid(name_type)
+        .next()
+        .map(|name| {
+            name.data()
+                .as_utf8()
+                .map(|s| s.to_string())
+                .unwrap_or_default()
+        })
+}
+
+/// Return the organization associated with the X509 certificate.
+pub fn get_organization(cert: &X509) -> Option<String> {
+    get_subject_name(cert, Nid::ORGANIZATIONNAME)
+}
+
+/// Return the common name associated with the X509 certificate.
+pub fn get_common_name(cert: &X509) -> Option<String> {
+    get_subject_name(cert, Nid::COMMONNAME)
+}
+
+/// Return the common name associated with the X509 certificate.
+pub fn get_organization_unit(cert: &X509) -> Option<String> {
+    get_subject_name(cert, Nid::ORGANIZATIONALUNITNAME)
+}
+
+/// Return the serial number associated with the X509 certificate as a hexadecimal value.
+pub fn get_serial(cert: &X509) -> Result<String> {
+    let bn = cert
+        .serial_number()
+        .to_bn()
+        .or_err(InvalidCert, "Invalid serial")?;
+    let hex = bn.to_hex_str().or_err(InvalidCert, "Invalid serial")?;
+
+    let hex_str: &str = hex.as_ref();
+    Ok(hex_str.to_owned())
+}
+
+/// This type contains a list of one or more certificates and an associated private key. The leaf
+/// certificate should always be first.
+#[derive(Clone)]
+pub struct CertKey {
+    certificates: Vec<X509>,
+    key: PKey<Private>,
+}
+
+impl CertKey {
+    /// Create a new `CertKey` given a list of certificates and a private key.
+    pub fn new(certificates: Vec<X509>, key: PKey<Private>) -> CertKey {
+        assert!(
+            !certificates.is_empty(),
+            "expected a non-empty vector of certificates in CertKey::new"
+        );
+
+        CertKey { certificates, key }
+    }
+
+    /// Peek at the leaf certificate.
+    pub fn leaf(&self) -> &X509 {
+        // This is safe due to the assertion above.
+        &self.certificates[0]
+    }
+
+    /// Return the key.
+    pub fn key(&self) -> &PKey<Private> {
+        &self.key
+    }
+
+    /// Return a slice of intermediate certificates. An empty slice means there are none.
+    pub fn intermediates(&self) -> &[X509] {
+        if self.certificates.len() <= 1 {
+            return &[];
+        }
+        &self.certificates[1..]
+    }
+
+    /// Return the organization from the leaf certificate.
+    pub fn organization(&self) -> Option<String> {
+        get_organization(self.leaf())
+    }
+
+    /// Return the serial from the leaf certificate.
+    pub fn serial(&self) -> Result<String> {
+        get_serial(self.leaf())
+    }
+}
+
+impl Hash for CertKey {
+    fn hash<H: Hasher>(&self, state: &mut H) {
+        for certificate in &self.certificates {
+            if let Ok(serial) = get_serial(certificate) {
+                serial.hash(state)
+            }
+        }
+    }
+}
+
+// hide private key
+impl std::fmt::Debug for CertKey {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("CertKey")
+            .field("X509", &self.leaf())
+            .finish()
+    }
+}
+
+impl std::fmt::Display for CertKey {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        let leaf = self.leaf();
+        if let Some(cn) = get_common_name(leaf) {
+            // Write CN if it exists
+            write!(f, "CN: {cn},")?;
+        } else if let Some(org_unit) = get_organization_unit(leaf) {
+            // CA cert might not have CN, so print its unit name instead
+            write!(f, "Org Unit: {org_unit},")?;
+        }
+        write!(f, ", expire: {}", leaf.not_after())
+        // ignore the details of the private key
+    }
+}
diff --git a/pingora-core/src/utils/tls/mod.rs b/pingora-core/src/utils/tls/mod.rs
new file mode 100644
index 0000000..0bcaeac
--- /dev/null
+++ b/pingora-core/src/utils/tls/mod.rs
@@ -0,0 +1,19 @@
+// Copyright 2024 Cloudflare, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#[cfg(feature = "openssl_derived")]
+mod boringssl_openssl;
+
+#[cfg(feature = "openssl_derived")]
+pub use boringssl_openssl::*;
diff --git a/pingora-core/tests/test_basic.rs b/pingora-core/tests/test_basic.rs
index ace35cb..32954de 100644
--- a/pingora-core/tests/test_basic.rs
+++ b/pingora-core/tests/test_basic.rs
@@ -14,23 +14,20 @@
 
 mod utils;
 
-use hyper::Client;
-#[cfg(unix)]
+#[cfg(all(unix, feature = "any_tls"))]
 use hyperlocal::{UnixClientExt, Uri};
-use utils::init;
 
-#[cfg(feature = "some_tls")]
 #[tokio::test]
 async fn test_http() {
-    init();
+    utils::init();
     let res = reqwest::get("http://127.0.0.1:6145").await.unwrap();
     assert_eq!(res.status(), reqwest::StatusCode::OK);
 }
 
-#[cfg(feature = "some_tls")]
+#[cfg(feature = "any_tls")]
 #[tokio::test]
 async fn test_https_http2() {
-    init();
+    utils::init();
 
     let client = reqwest::Client::builder()
         .danger_accept_invalid_certs(true)
@@ -53,12 +50,12 @@ async fn test_https_http2() {
 }
 
 #[cfg(unix)]
-#[cfg(feature = "some_tls")]
+#[cfg(feature = "any_tls")]
 #[tokio::test]
 async fn test_uds() {
-    init();
+    utils::init();
     let url = Uri::new("/tmp/echo.sock", "/").into();
-    let client = Client::unix();
+    let client = hyper::Client::unix();
 
     let res = client.get(url).await.unwrap();
     assert_eq!(res.status(), reqwest::StatusCode::OK);
diff --git a/pingora-core/tests/utils/mod.rs b/pingora-core/tests/utils/mod.rs
index 46f050f..a832c4a 100644
--- a/pingora-core/tests/utils/mod.rs
+++ b/pingora-core/tests/utils/mod.rs
@@ -82,7 +82,7 @@ fn entry_point(opt: Option<Opt>) {
     listeners.add_uds("/tmp/echo.sock", None);
 
     let mut tls_settings =
-        pingora_core::listeners::TlsSettings::intermediate(&cert_path, &key_path).unwrap();
+        pingora_core::listeners::tls::TlsSettings::intermediate(&cert_path, &key_path).unwrap();
     tls_settings.enable_h2();
     listeners.add_tls_with_settings("0.0.0.0:6146", None, tls_settings);
 
diff --git a/pingora-error/src/lib.rs b/pingora-error/src/lib.rs
index d856763..935b252 100644
--- a/pingora-error/src/lib.rs
+++ b/pingora-error/src/lib.rs
@@ -105,6 +105,7 @@ pub enum ErrorType {
     ConnectTimedout,
     ConnectRefused,
     ConnectNoRoute,
+    TLSWantX509Lookup,
     TLSHandshakeFailure,
     TLSHandshakeTimedout,
     InvalidCert,
@@ -164,6 +165,7 @@ impl ErrorType {
             ErrorType::ConnectRefused => "ConnectRefused",
             ErrorType::ConnectNoRoute => "ConnectNoRoute",
             ErrorType::ConnectProxyFailure => "ConnectProxyFailure",
+            ErrorType::TLSWantX509Lookup => "TLSWantX509Lookup",
             ErrorType::TLSHandshakeFailure => "TLSHandshakeFailure",
             ErrorType::TLSHandshakeTimedout => "TLSHandshakeTimedout",
             ErrorType::InvalidCert => "InvalidCert",
diff --git a/pingora-load-balancing/Cargo.toml b/pingora-load-balancing/Cargo.toml
index 523e2f4..e87c598 100644
--- a/pingora-load-balancing/Cargo.toml
+++ b/pingora-load-balancing/Cargo.toml
@@ -35,6 +35,9 @@ derivative = "2.2.0"
 [dev-dependencies]
 
 [features]
-default = ["openssl"]
-openssl = ["pingora-core/openssl"]
-boringssl = ["pingora-core/boringssl"]
+default = []
+openssl = ["pingora-core/openssl", "openssl_derived"]
+boringssl = ["pingora-core/boringssl", "openssl_derived"]
+rustls = ["pingora-core/rustls", "any_tls"]
+openssl_derived = ["any_tls"]
+any_tls = []
diff --git a/pingora-load-balancing/src/health_check.rs b/pingora-load-balancing/src/health_check.rs
index ac63579..4e658bb 100644
--- a/pingora-load-balancing/src/health_check.rs
+++ b/pingora-load-balancing/src/health_check.rs
@@ -375,6 +375,7 @@ mod test {
         assert!(tcp_check.check(&backend).await.is_err());
     }
 
+    #[cfg(feature = "any_tls")]
     #[tokio::test]
     async fn test_tls_check() {
         let tls_check = TcpHealthCheck::new_tls("one.one.one.one");
@@ -387,6 +388,7 @@ mod test {
         assert!(tls_check.check(&backend).await.is_ok());
     }
 
+    #[cfg(feature = "any_tls")]
     #[tokio::test]
     async fn test_https_check() {
         let https_check = HttpHealthCheck::new("one.one.one.one", true);
diff --git a/pingora-proxy/Cargo.toml b/pingora-proxy/Cargo.toml
index 13d4804..b65e0d8 100644
--- a/pingora-proxy/Cargo.toml
+++ b/pingora-proxy/Cargo.toml
@@ -44,7 +44,7 @@ env_logger = "0.9"
 hyper = "0.14"
 tokio-tungstenite = "0.20.1"
 pingora-limits = { version = "0.3.0", path = "../pingora-limits" }
-pingora-load-balancing = { version = "0.3.0", path = "../pingora-load-balancing" }
+pingora-load-balancing = { version = "0.3.0", path = "../pingora-load-balancing", default-features=false }
 prometheus = "0"
 futures-util = "0.3"
 serde = { version = "1.0", features = ["derive"] }
@@ -55,9 +55,12 @@ serde_yaml = "0.8"
 hyperlocal = "0.8"
 
 [features]
-default = ["openssl"]
-openssl = ["pingora-core/openssl", "pingora-cache/openssl"]
-boringssl = ["pingora-core/boringssl", "pingora-cache/boringssl"]
+default = []
+openssl = ["pingora-core/openssl", "pingora-cache/openssl", "openssl_derived"]
+boringssl = ["pingora-core/boringssl", "pingora-cache/boringssl", "openssl_derived"]
+rustls = ["pingora-core/rustls", "pingora-cache/rustls", "any_tls"]
+openssl_derived = ["any_tls"]
+any_tls = []
 sentry = ["pingora-core/sentry"]
 
 # or locally cargo doc --config "build.rustdocflags='--cfg doc_async_trait'"
diff --git a/pingora-proxy/examples/load_balancer.rs b/pingora-proxy/examples/load_balancer.rs
index 614981d..a428b9b 100644
--- a/pingora-proxy/examples/load_balancer.rs
+++ b/pingora-proxy/examples/load_balancer.rs
@@ -86,7 +86,7 @@ fn main() {
     let key_path = format!("{}/tests/keys/key.pem", env!("CARGO_MANIFEST_DIR"));
 
     let mut tls_settings =
-        pingora_core::listeners::TlsSettings::intermediate(&cert_path, &key_path).unwrap();
+        pingora_core::listeners::tls::TlsSettings::intermediate(&cert_path, &key_path).unwrap();
     tls_settings.enable_h2();
     lb.add_tls_with_settings("0.0.0.0:6189", None, tls_settings);
 
diff --git a/pingora-proxy/tests/test_basic.rs b/pingora-proxy/tests/test_basic.rs
index 569e51a..f33a247 100644
--- a/pingora-proxy/tests/test_basic.rs
+++ b/pingora-proxy/tests/test_basic.rs
@@ -67,6 +67,7 @@ async fn test_simple_proxy() {
 }
 
 #[tokio::test]
+#[cfg(feature = "any_tls")]
 async fn test_h2_to_h1() {
     init();
     let client = reqwest::Client::builder()
@@ -74,7 +75,12 @@ async fn test_h2_to_h1() {
         .build()
         .unwrap();
 
-    let res = client.get("https://127.0.0.1:6150").send().await.unwrap();
+    let res = client
+        .get("https://127.0.0.1:6150")
+        .header("sni", "openrusty.org")
+        .send()
+        .await
+        .unwrap();
     assert_eq!(res.status(), reqwest::StatusCode::OK);
     assert_eq!(res.version(), reqwest::Version::HTTP_2);
 
@@ -104,6 +110,7 @@ async fn test_h2_to_h1() {
 }
 
 #[tokio::test]
+#[cfg(feature = "any_tls")]
 async fn test_h2_to_h2() {
     init();
     let client = reqwest::Client::builder()
@@ -113,6 +120,7 @@ async fn test_h2_to_h2() {
 
     let res = client
         .get("https://127.0.0.1:6150")
+        .header("sni", "openrusty.org")
         .header("x-h2", "true")
         .send()
         .await
@@ -189,6 +197,7 @@ async fn test_h1_on_h2c_port() {
 }
 
 #[tokio::test]
+#[cfg(feature = "openssl_derived")]
 async fn test_h2_to_h2_host_override() {
     init();
     let client = reqwest::Client::builder()
@@ -212,6 +221,7 @@ async fn test_h2_to_h2_host_override() {
 }
 
 #[tokio::test]
+#[cfg(feature = "any_tls")]
 async fn test_h2_to_h2_upload() {
     init();
     let client = reqwest::Client::builder()
@@ -223,6 +233,7 @@ async fn test_h2_to_h2_upload() {
 
     let res = client
         .get("https://127.0.0.1:6150/echo")
+        .header("sni", "openrusty.org")
         .header("x-h2", "true")
         .body(payload)
         .send()
@@ -235,6 +246,7 @@ async fn test_h2_to_h2_upload() {
 }
 
 #[tokio::test]
+#[cfg(feature = "any_tls")]
 async fn test_h2_to_h1_upload() {
     init();
     let client = reqwest::Client::builder()
@@ -246,6 +258,7 @@ async fn test_h2_to_h1_upload() {
 
     let res = client
         .get("https://127.0.0.1:6150/echo")
+        .header("sni", "openrusty.org")
         .body(payload)
         .send()
         .await
@@ -313,7 +326,10 @@ async fn test_simple_proxy_uds_peer() {
     assert!(is_specified_port(sockaddr.port()));
 
     assert_eq!(headers["x-upstream-client-addr"], "unset"); // unnamed UDS
-    assert_eq!(headers["x-upstream-server-addr"], "/tmp/nginx-test.sock");
+    assert_eq!(
+        headers["x-upstream-server-addr"],
+        "/tmp/pingora_nginx_test.sock"
+    );
 
     let body = res.text().await.unwrap();
     assert_eq!(body, "Hello World!\n");
@@ -444,6 +460,8 @@ async fn test_dropped_conn() {
     test_dropped_conn_post_body_over().await;
 }
 
+// currently not supported with Rustls implementation
+#[cfg(feature = "openssl_derived")]
 #[tokio::test]
 async fn test_tls_no_verify() {
     init();
@@ -457,6 +475,7 @@ async fn test_tls_no_verify() {
     assert_eq!(res.status(), StatusCode::OK);
 }
 
+#[cfg(feature = "any_tls")]
 #[tokio::test]
 async fn test_tls_verify_sni_not_host() {
     init();
@@ -473,6 +492,8 @@ async fn test_tls_verify_sni_not_host() {
     assert_eq!(res.status(), StatusCode::OK);
 }
 
+// currently not supported with Rustls implementation
+#[cfg(feature = "openssl_derived")]
 #[tokio::test]
 async fn test_tls_none_verify_host() {
     init();
@@ -489,6 +510,7 @@ async fn test_tls_none_verify_host() {
     assert_eq!(res.status(), StatusCode::OK);
 }
 
+#[cfg(feature = "any_tls")]
 #[tokio::test]
 async fn test_tls_verify_sni_host() {
     init();
@@ -506,6 +528,7 @@ async fn test_tls_verify_sni_host() {
     assert_eq!(res.status(), StatusCode::OK);
 }
 
+#[cfg(feature = "any_tls")]
 #[tokio::test]
 async fn test_tls_underscore_sub_sni_verify_host() {
     init();
@@ -523,6 +546,7 @@ async fn test_tls_underscore_sub_sni_verify_host() {
     assert_eq!(res.status(), StatusCode::OK);
 }
 
+#[cfg(feature = "any_tls")]
 #[tokio::test]
 async fn test_tls_underscore_non_sub_sni_verify_host() {
     init();
@@ -542,6 +566,7 @@ async fn test_tls_underscore_non_sub_sni_verify_host() {
     assert_eq!(headers[header::CONNECTION], "close");
 }
 
+#[cfg(feature = "any_tls")]
 #[tokio::test]
 async fn test_tls_alt_verify_host() {
     init();
@@ -560,6 +585,7 @@ async fn test_tls_alt_verify_host() {
     assert_eq!(res.status(), StatusCode::OK);
 }
 
+#[cfg(feature = "any_tls")]
 #[tokio::test]
 async fn test_tls_underscore_sub_alt_verify_host() {
     init();
@@ -578,6 +604,7 @@ async fn test_tls_underscore_sub_alt_verify_host() {
     assert_eq!(res.status(), StatusCode::OK);
 }
 
+#[cfg(feature = "any_tls")]
 #[tokio::test]
 async fn test_tls_underscore_non_sub_alt_verify_host() {
     init();
@@ -691,6 +718,7 @@ async fn test_connect_close() {
 }
 
 #[tokio::test]
+#[cfg(feature = "any_tls")]
 async fn test_mtls_no_client_cert() {
     init();
     let client = reqwest::Client::new();
@@ -709,6 +737,7 @@ async fn test_mtls_no_client_cert() {
     assert_eq!(res.status(), StatusCode::BAD_REQUEST);
 }
 
+#[cfg(feature = "any_tls")]
 #[tokio::test]
 async fn test_mtls_no_intermediate_cert() {
     init();
@@ -730,6 +759,7 @@ async fn test_mtls_no_intermediate_cert() {
 }
 
 #[tokio::test]
+#[cfg(feature = "any_tls")]
 async fn test_mtls() {
     init();
     let client = reqwest::Client::new();
@@ -748,6 +778,7 @@ async fn test_mtls() {
     assert_eq!(res.status(), StatusCode::OK);
 }
 
+#[cfg(feature = "any_tls")]
 async fn assert_reuse(req: reqwest::RequestBuilder) {
     req.try_clone().unwrap().send().await.unwrap();
     let res = req.send().await.unwrap();
@@ -755,6 +786,7 @@ async fn assert_reuse(req: reqwest::RequestBuilder) {
     assert!(headers.get("x-conn-reuse").is_some());
 }
 
+#[cfg(feature = "any_tls")]
 #[tokio::test]
 async fn test_mtls_diff_cert_no_reuse() {
     init();
@@ -789,6 +821,7 @@ async fn test_mtls_diff_cert_no_reuse() {
     assert!(headers.get("x-conn-reuse").is_none());
 }
 
+#[cfg(feature = "any_tls")]
 #[tokio::test]
 async fn test_tls_diff_verify_no_reuse() {
     init();
@@ -815,6 +848,7 @@ async fn test_tls_diff_verify_no_reuse() {
     assert!(headers.get("x-conn-reuse").is_none());
 }
 
+#[cfg(feature = "any_tls")]
 #[tokio::test]
 async fn test_tls_diff_verify_host_no_reuse() {
     init();
@@ -843,6 +877,7 @@ async fn test_tls_diff_verify_host_no_reuse() {
     assert!(headers.get("x-conn-reuse").is_none());
 }
 
+#[cfg(feature = "any_tls")]
 #[tokio::test]
 async fn test_tls_diff_alt_cnt_no_reuse() {
     init();
diff --git a/pingora-proxy/tests/utils/cert.rs b/pingora-proxy/tests/utils/cert.rs
index 674a3ac..fb6f54c 100644
--- a/pingora-proxy/tests/utils/cert.rs
+++ b/pingora-proxy/tests/utils/cert.rs
@@ -13,35 +13,64 @@
 // limitations under the License.
 
 use once_cell::sync::Lazy;
-use pingora_core::tls::pkey::{PKey, Private};
-use pingora_core::tls::x509::X509;
+#[cfg(feature = "rustls")]
+use pingora_core::tls::{load_pem_file_ca, load_pem_file_private_key};
+#[cfg(feature = "openssl_derived")]
+use pingora_core::tls::{
+    pkey::{PKey, Private},
+    x509::X509,
+};
 use std::fs;
 
-pub static ROOT_CERT: Lazy<X509> = Lazy::new(|| load_cert("keys/root.crt"));
-pub static ROOT_KEY: Lazy<PKey<Private>> = Lazy::new(|| load_key("keys/root.key"));
-pub static INTERMEDIATE_CERT: Lazy<X509> = Lazy::new(|| load_cert("keys/intermediate.crt"));
-pub static INTERMEDIATE_KEY: Lazy<PKey<Private>> = Lazy::new(|| load_key("keys/intermediate.key"));
-pub static LEAF_CERT: Lazy<X509> = Lazy::new(|| load_cert("keys/leaf.crt"));
-pub static LEAF2_CERT: Lazy<X509> = Lazy::new(|| load_cert("keys/leaf2.crt"));
-pub static LEAF_KEY: Lazy<PKey<Private>> = Lazy::new(|| load_key("keys/leaf.key"));
-pub static LEAF2_KEY: Lazy<PKey<Private>> = Lazy::new(|| load_key("keys/leaf2.key"));
-pub static SERVER_CERT: Lazy<X509> = Lazy::new(|| load_cert("keys/server.crt"));
-pub static SERVER_KEY: Lazy<PKey<Private>> = Lazy::new(|| load_key("keys/key.pem"));
-pub static CURVE_521_TEST_KEY: Lazy<PKey<Private>> =
+#[cfg(feature = "openssl_derived")]
+mod key_types {
+    use super::*;
+    pub type PrivateKeyType = PKey<Private>;
+    pub type CertType = X509;
+}
+
+#[cfg(feature = "rustls")]
+mod key_types {
+    use super::*;
+    pub type PrivateKeyType = Vec<u8>;
+    pub type CertType = Vec<u8>;
+}
+
+use key_types::*;
+
+pub static INTERMEDIATE_CERT: Lazy<CertType> = Lazy::new(|| load_cert("keys/intermediate.crt"));
+pub static LEAF_CERT: Lazy<CertType> = Lazy::new(|| load_cert("keys/leaf.crt"));
+pub static LEAF2_CERT: Lazy<CertType> = Lazy::new(|| load_cert("keys/leaf2.crt"));
+pub static LEAF_KEY: Lazy<PrivateKeyType> = Lazy::new(|| load_key("keys/leaf.key"));
+pub static LEAF2_KEY: Lazy<PrivateKeyType> = Lazy::new(|| load_key("keys/leaf2.key"));
+pub static CURVE_521_TEST_KEY: Lazy<PrivateKeyType> =
     Lazy::new(|| load_key("keys/curve_test.521.key.pem"));
-pub static CURVE_521_TEST_CERT: Lazy<X509> = Lazy::new(|| load_cert("keys/curve_test.521.crt"));
-pub static CURVE_384_TEST_KEY: Lazy<PKey<Private>> =
+pub static CURVE_521_TEST_CERT: Lazy<CertType> = Lazy::new(|| load_cert("keys/curve_test.521.crt"));
+pub static CURVE_384_TEST_KEY: Lazy<PrivateKeyType> =
     Lazy::new(|| load_key("keys/curve_test.384.key.pem"));
-pub static CURVE_384_TEST_CERT: Lazy<X509> = Lazy::new(|| load_cert("keys/curve_test.384.crt"));
+pub static CURVE_384_TEST_CERT: Lazy<CertType> = Lazy::new(|| load_cert("keys/curve_test.384.crt"));
 
+#[cfg(feature = "openssl_derived")]
 fn load_cert(path: &str) -> X509 {
     let path = format!("{}/{path}", super::conf_dir());
     let cert_bytes = fs::read(path).unwrap();
     X509::from_pem(&cert_bytes).unwrap()
 }
-
+#[cfg(feature = "openssl_derived")]
 fn load_key(path: &str) -> PKey<Private> {
     let path = format!("{}/{path}", super::conf_dir());
     let key_bytes = fs::read(path).unwrap();
     PKey::private_key_from_pem(&key_bytes).unwrap()
 }
+
+#[cfg(feature = "rustls")]
+fn load_cert(path: &str) -> Vec<u8> {
+    let path = format!("{}/{path}", super::conf_dir());
+    load_pem_file_ca(&path)
+}
+
+#[cfg(feature = "rustls")]
+fn load_key(path: &str) -> Vec<u8> {
+    let path = format!("{}/{path}", super::conf_dir());
+    load_pem_file_private_key(&path)
+}
diff --git a/pingora-proxy/tests/utils/conf/keys/README.md b/pingora-proxy/tests/utils/conf/keys/README.md
index 13965cd..44944ab 100644
--- a/pingora-proxy/tests/utils/conf/keys/README.md
+++ b/pingora-proxy/tests/utils/conf/keys/README.md
@@ -16,3 +16,12 @@ openssl ecparam -genkey -name secp256r1 -noout -out test_key.pem
 openssl req -new -key test_key.pem -out test.csr
 openssl x509 -req -in test.csr -CA server.crt -CAkey key.pem -CAcreateserial -CAserial test.srl -out test.crt -days 3650 -sha256
 ```
+
+```
+openssl version
+# OpenSSL 3.1.1
+echo '[v3_req]' > openssl.cnf
+openssl req -config openssl.cnf -new -x509 -key key.pem -out server_rustls.crt -days 3650 -sha256 \
+    -subj '/C=US/ST=CA/L=San Francisco/O=Cloudflare, Inc/CN=openrusty.org' \
+    -addext "subjectAltName=DNS:*.openrusty.org,DNS:openrusty.org,DNS:cat.com,DNS:dog.com"
+```
\ No newline at end of file
diff --git a/pingora-proxy/tests/utils/conf/keys/server_boringssl_openssl.crt b/pingora-proxy/tests/utils/conf/keys/server_boringssl_openssl.crt
new file mode 100644
index 0000000..afb2d1e
--- /dev/null
+++ b/pingora-proxy/tests/utils/conf/keys/server_boringssl_openssl.crt
@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIIB9zCCAZ2gAwIBAgIUMI7aLvTxyRFCHhw57hGt4U6yupcwCgYIKoZIzj0EAwIw
+ZDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRYwFAYDVQQHDA1TYW4gRnJhbmNp
+c2NvMRgwFgYDVQQKDA9DbG91ZGZsYXJlLCBJbmMxFjAUBgNVBAMMDW9wZW5ydXN0
+eS5vcmcwHhcNMjIwNDExMjExMzEzWhcNMzIwNDA4MjExMzEzWjBkMQswCQYDVQQG
+EwJVUzELMAkGA1UECAwCQ0ExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xGDAWBgNV
+BAoMD0Nsb3VkZmxhcmUsIEluYzEWMBQGA1UEAwwNb3BlbnJ1c3R5Lm9yZzBZMBMG
+ByqGSM49AgEGCCqGSM49AwEHA0IABNn/9RZtR48knaJD6tk9BdccaJfZ0hGEPn6B
+SDXmlmJPhcTBqa4iUwW/ABpGvO3FpJcNWasrX2k+qZLq3g205MKjLTArMCkGA1Ud
+EQQiMCCCDyoub3BlbnJ1c3R5Lm9yZ4INb3BlbnJ1c3R5Lm9yZzAKBggqhkjOPQQD
+AgNIADBFAiAjISZ9aEKmobKGlT76idO740J6jPaX/hOrm41MLeg69AIhAJqKrSyz
+wD/AAF5fR6tXmBqlnpQOmtxfdy13wDr4MT3h
+-----END CERTIFICATE-----
diff --git a/pingora-proxy/tests/utils/conf/keys/server.csr b/pingora-proxy/tests/utils/conf/keys/server_boringssl_openssl.csr
index ca75dce..ca75dce 100644
--- a/pingora-proxy/tests/utils/conf/keys/server.csr
+++ b/pingora-proxy/tests/utils/conf/keys/server_boringssl_openssl.csr
diff --git a/pingora-proxy/tests/utils/conf/keys/server_rustls.crt b/pingora-proxy/tests/utils/conf/keys/server_rustls.crt
new file mode 100644
index 0000000..28cdadf
--- /dev/null
+++ b/pingora-proxy/tests/utils/conf/keys/server_rustls.crt
@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICJzCCAc6gAwIBAgIUU+G0acG/uiMu1ZDSjlcoY4gH53QwCgYIKoZIzj0EAwIw
+ZDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRYwFAYDVQQHDA1TYW4gRnJhbmNp
+c2NvMRgwFgYDVQQKDA9DbG91ZGZsYXJlLCBJbmMxFjAUBgNVBAMMDW9wZW5ydXN0
+eS5vcmcwHhcNMjQwNzI0MTMzOTQ4WhcNMzQwNzIyMTMzOTQ4WjBkMQswCQYDVQQG
+EwJVUzELMAkGA1UECAwCQ0ExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xGDAWBgNV
+BAoMD0Nsb3VkZmxhcmUsIEluYzEWMBQGA1UEAwwNb3BlbnJ1c3R5Lm9yZzBZMBMG
+ByqGSM49AgEGCCqGSM49AwEHA0IABNn/9RZtR48knaJD6tk9BdccaJfZ0hGEPn6B
+SDXmlmJPhcTBqa4iUwW/ABpGvO3FpJcNWasrX2k+qZLq3g205MKjXjBcMDsGA1Ud
+EQQ0MDKCDyoub3BlbnJ1c3R5Lm9yZ4INb3BlbnJ1c3R5Lm9yZ4IHY2F0LmNvbYIH
+ZG9nLmNvbTAdBgNVHQ4EFgQUnfYAFWyQnSN57IGokj7jcz8ChJQwCgYIKoZIzj0E
+AwIDRwAwRAIgQr+Ly2cH04CncbnbhUf4hBl5frTp1pXgGnn8dYjd+UcCICuunEtp
+H/a42/sVGBFvjS6FOFe6ZDs4oWBNEqQSw0S2
+-----END CERTIFICATE-----
\ No newline at end of file
diff --git a/pingora-proxy/tests/utils/conf/origin/conf/nginx.conf b/pingora-proxy/tests/utils/conf/origin/conf/nginx.conf
index 6d5abd7..2718f88 100644
--- a/pingora-proxy/tests/utils/conf/origin/conf/nginx.conf
+++ b/pingora-proxy/tests/utils/conf/origin/conf/nginx.conf
@@ -6,7 +6,7 @@ error_log  /dev/stdout;
 #error_log  logs/error.log  notice;
 #error_log  logs/error.log  info;
 
-pid        /tmp/mock_origin.pid;
+pid        /tmp/pingora_mock_origin.pid;
 master_process off;
 daemon off;
 
@@ -85,7 +85,7 @@ http {
         listen       8001;
         listen       [::]:8000;
         #listen       8443 ssl;
-        listen       unix:/tmp/nginx-test.sock;
+        listen       unix:/tmp/pingora_nginx_test.sock;
         listen       8443 ssl http2;
         server_name  localhost;
 
@@ -97,6 +97,9 @@ http {
         # for benchmark
         http2_max_requests 999999;
 
+        # increase max body size for /upload/ test
+        client_max_body_size 128m;
+        
         #charset koi8-r;
 
         #access_log  logs/host.access.log  main;
diff --git a/pingora-proxy/tests/utils/mock_origin.rs b/pingora-proxy/tests/utils/mock_origin.rs
index db84f8d..ec59e51 100644
--- a/pingora-proxy/tests/utils/mock_origin.rs
+++ b/pingora-proxy/tests/utils/mock_origin.rs
@@ -13,15 +13,38 @@
 // limitations under the License.
 
 use once_cell::sync::Lazy;
+use std::path::Path;
 use std::process;
 use std::{thread, time};
 
 pub static MOCK_ORIGIN: Lazy<bool> = Lazy::new(init);
 
 fn init() -> bool {
+    #[cfg(feature = "rustls")]
+    let src_cert_path = format!(
+        "{}/tests/utils/conf/keys/server_rustls.crt",
+        env!("CARGO_MANIFEST_DIR")
+    );
+    #[cfg(feature = "openssl_derived")]
+    let src_cert_path = format!(
+        "{}/tests/utils/conf/keys/server_boringssl_openssl.crt",
+        env!("CARGO_MANIFEST_DIR")
+    );
+
+    #[cfg(feature = "any_tls")]
+    {
+        let mut dst_cert_path = format!("{}/tests/keys/server.crt", env!("CARGO_MANIFEST_DIR"));
+        std::fs::copy(Path::new(&src_cert_path), Path::new(&dst_cert_path));
+        dst_cert_path = format!(
+            "{}/tests/utils/conf/keys/server.crt",
+            env!("CARGO_MANIFEST_DIR")
+        );
+        std::fs::copy(Path::new(&src_cert_path), Path::new(&dst_cert_path));
+    }
+
     // TODO: figure out a way to kill openresty when exiting
     process::Command::new("pkill")
-        .args(["-F", "/tmp/mock_origin.pid"])
+        .args(["-F", "/tmp/pingora_mock_origin.pid"])
         .spawn()
         .unwrap();
     let _origin = thread::spawn(|| {
diff --git a/pingora-proxy/tests/utils/mod.rs b/pingora-proxy/tests/utils/mod.rs
index 6a5a1c9..df769e5 100644
--- a/pingora-proxy/tests/utils/mod.rs
+++ b/pingora-proxy/tests/utils/mod.rs
@@ -14,7 +14,9 @@
 
 #![allow(unused)]
 
+#[cfg(feature = "any_tls")]
 pub mod cert;
+
 pub mod mock_origin;
 pub mod server_utils;
 pub mod websocket;
diff --git a/pingora-proxy/tests/utils/server_utils.rs b/pingora-proxy/tests/utils/server_utils.rs
index 885fcb1..62b5882 100644
--- a/pingora-proxy/tests/utils/server_utils.rs
+++ b/pingora-proxy/tests/utils/server_utils.rs
@@ -12,6 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+#[cfg(feature = "any_tls")]
 use super::cert;
 use async_trait::async_trait;
 use clap::Parser;
@@ -32,7 +33,7 @@ use pingora_core::protocols::{l4::socket::SocketAddr, Digest};
 use pingora_core::server::configuration::Opt;
 use pingora_core::services::Service;
 use pingora_core::upstreams::peer::HttpPeer;
-use pingora_core::utils::CertKey;
+use pingora_core::utils::tls::CertKey;
 use pingora_error::{Error, ErrorSource, Result};
 use pingora_http::{RequestHeader, ResponseHeader};
 use pingora_proxy::{ProxyHttp, Session};
@@ -106,6 +107,7 @@ fn response_filter_common(
 }
 
 #[async_trait]
+#[cfg(feature = "any_tls")]
 impl ProxyHttp for ExampleProxyHttps {
     type CTX = CTX;
     fn new_ctx(&self) -> Self::CTX {
@@ -283,7 +285,7 @@ impl ProxyHttp for ExampleProxyHttp {
         #[cfg(unix)]
         if req.headers.contains_key("x-uds-peer") {
             return Ok(Box::new(HttpPeer::new_uds(
-                "/tmp/nginx-test.sock",
+                "/tmp/pingora_nginx_test.sock",
                 false,
                 "".to_string(),
             )?));
@@ -558,27 +560,36 @@ fn test_main() {
     http_logic.server_options = Some(http_server_options);
     proxy_service_h2c.add_tcp("0.0.0.0:6146");
 
-    let mut proxy_service_https =
-        pingora_proxy::http_proxy_service(&my_server.configuration, ExampleProxyHttps {});
-    proxy_service_https.add_tcp("0.0.0.0:6149");
-    let cert_path = format!("{}/tests/keys/server.crt", env!("CARGO_MANIFEST_DIR"));
-    let key_path = format!("{}/tests/keys/key.pem", env!("CARGO_MANIFEST_DIR"));
-    let mut tls_settings =
-        pingora_core::listeners::TlsSettings::intermediate(&cert_path, &key_path).unwrap();
-    tls_settings.enable_h2();
-    proxy_service_https.add_tls_with_settings("0.0.0.0:6150", None, tls_settings);
+    let mut proxy_service_https_opt: Option<Box<dyn Service>> = None;
+
+    #[cfg(feature = "any_tls")]
+    {
+        let mut proxy_service_https =
+            pingora_proxy::http_proxy_service(&my_server.configuration, ExampleProxyHttps {});
+        proxy_service_https.add_tcp("0.0.0.0:6149");
+        let cert_path = format!("{}/tests/keys/server.crt", env!("CARGO_MANIFEST_DIR"));
+        let key_path = format!("{}/tests/keys/key.pem", env!("CARGO_MANIFEST_DIR"));
+        let mut tls_settings =
+            pingora_core::listeners::tls::TlsSettings::intermediate(&cert_path, &key_path).unwrap();
+        tls_settings.enable_h2();
+        proxy_service_https.add_tls_with_settings("0.0.0.0:6150", None, tls_settings);
+        proxy_service_https_opt = Some(Box::new(proxy_service_https))
+    }
 
     let mut proxy_service_cache =
         pingora_proxy::http_proxy_service(&my_server.configuration, ExampleProxyCache {});
     proxy_service_cache.add_tcp("0.0.0.0:6148");
 
-    let services: Vec<Box<dyn Service>> = vec![
+    let mut services: Vec<Box<dyn Service>> = vec![
         Box::new(proxy_service_h2c),
         Box::new(proxy_service_http),
-        Box::new(proxy_service_https),
         Box::new(proxy_service_cache),
     ];
 
+    if let Some(proxy_service_https) = proxy_service_https_opt {
+        services.push(proxy_service_https)
+    }
+
     set_compression_dict_path("tests/headers.dict");
     my_server.add_services(services);
     my_server.run_forever();
diff --git a/pingora-rustls/Cargo.toml b/pingora-rustls/Cargo.toml
new file mode 100644
index 0000000..858ce30
--- /dev/null
+++ b/pingora-rustls/Cargo.toml
@@ -0,0 +1,17 @@
+[package]
+name = "pingora-rustls"
+version = "0.3.0"
+authors = ["Harald Gutmann <[email protected]>"]
+license = "Apache-2.0"
+edition = "2021"
+repository = "https://github.com/cloudflare/pingora"
+categories = ["asynchronous", "network-programming"]
+keywords = ["async", "tls", "ssl", "pingora"]
+description = """
+RusTLS async APIs for Pingora.
+"""
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+[lib]
+name = "pingora_rustls"
+path = "src/lib.rs"
diff --git a/pingora-rustls/LICENSE b/pingora-rustls/LICENSE
new file mode 100644
index 0000000..d645695
--- /dev/null
+++ b/pingora-rustls/LICENSE
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/pingora-rustls/src/lib.rs b/pingora-rustls/src/lib.rs
new file mode 100644
index 0000000..814bcb9
--- /dev/null
+++ b/pingora-rustls/src/lib.rs
@@ -0,0 +1,17 @@
+// Copyright 2024 Cloudflare, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+pub fn rustls() {
+    todo!()
+}
diff --git a/pingora/Cargo.toml b/pingora/Cargo.toml
index 236c2d3..8dccca1 100644
--- a/pingora/Cargo.toml
+++ b/pingora/Cargo.toml
@@ -49,21 +49,32 @@ hyperlocal = "0.8"
 jemallocator = "0.5"
 
 [features]
-default = ["openssl"]
+default = []
 openssl = [
     "pingora-core/openssl",
     "pingora-proxy?/openssl",
     "pingora-cache?/openssl",
     "pingora-load-balancing?/openssl",
+    "openssl_derived",
 ]
 boringssl = [
     "pingora-core/boringssl",
     "pingora-proxy?/boringssl",
     "pingora-cache?/boringssl",
     "pingora-load-balancing?/boringssl",
+    "openssl_derived",
 ]
 proxy = ["pingora-proxy"]
 lb = ["pingora-load-balancing", "proxy"]
 cache = ["pingora-cache"]
 time = []
 sentry = ["pingora-core/sentry"]
+rustls = [
+    "pingora-core/rustls",
+    "pingora-proxy?/rustls",
+    "pingora-cache?/rustls",
+    "pingora-load-balancing?/rustls",
+    "any_tls",
+]
+openssl_derived = ["any_tls"]
+any_tls = []
diff --git a/pingora/examples/server.rs b/pingora/examples/server.rs
index a2a092e..ff25151 100644
--- a/pingora/examples/server.rs
+++ b/pingora/examples/server.rs
@@ -15,6 +15,7 @@
 #[global_allocator]
 static GLOBAL: jemallocator::Jemalloc = jemallocator::Jemalloc;
 
+use pingora::listeners::tls::TlsSettings;
 use pingora::protocols::TcpKeepalive;
 use pingora::server::configuration::Opt;
 use pingora::server::{Server, ShutdownWatch};
@@ -49,31 +50,35 @@ impl BackgroundService for ExampleBackgroundService {
         }
     }
 }
+#[cfg(feature = "openssl_derived")]
+mod boringssl_openssl {
+    use super::*;
+    use pingora::tls::pkey::{PKey, Private};
+    use pingora::tls::x509::X509;
+
+    pub(super) struct DynamicCert {
+        cert: X509,
+        key: PKey<Private>,
+    }
 
-use pingora::tls::pkey::{PKey, Private};
-use pingora::tls::x509::X509;
-struct DynamicCert {
-    cert: X509,
-    key: PKey<Private>,
-}
-
-impl DynamicCert {
-    fn new(cert: &str, key: &str) -> Box<Self> {
-        let cert_bytes = std::fs::read(cert).unwrap();
-        let cert = X509::from_pem(&cert_bytes).unwrap();
+    impl DynamicCert {
+        pub(super) fn new(cert: &str, key: &str) -> Box<Self> {
+            let cert_bytes = std::fs::read(cert).unwrap();
+            let cert = X509::from_pem(&cert_bytes).unwrap();
 
-        let key_bytes = std::fs::read(key).unwrap();
-        let key = PKey::private_key_from_pem(&key_bytes).unwrap();
-        Box::new(DynamicCert { cert, key })
+            let key_bytes = std::fs::read(key).unwrap();
+            let key = PKey::private_key_from_pem(&key_bytes).unwrap();
+            Box::new(DynamicCert { cert, key })
+        }
     }
-}
 
-#[async_trait]
-impl pingora::listeners::TlsAccept for DynamicCert {
-    async fn certificate_callback(&self, ssl: &mut pingora::tls::ssl::SslRef) {
-        use pingora::tls::ext;
-        ext::ssl_use_certificate(ssl, &self.cert).unwrap();
-        ext::ssl_use_private_key(ssl, &self.key).unwrap();
+    #[async_trait]
+    impl pingora::listeners::TlsAccept for DynamicCert {
+        async fn certificate_callback(&self, ssl: &mut pingora::tls::ssl::SslRef) {
+            use pingora::tls::ext;
+            ext::ssl_use_certificate(ssl, &self.cert).unwrap();
+            ext::ssl_use_private_key(ssl, &self.key).unwrap();
+        }
     }
 }
 
@@ -132,12 +137,32 @@ pub fn main() {
     echo_service_http.add_tcp_with_settings("0.0.0.0:6145", options);
     echo_service_http.add_uds("/tmp/echo.sock", None);
 
-    let dynamic_cert = DynamicCert::new(&cert_path, &key_path);
-    let mut tls_settings = pingora::listeners::TlsSettings::with_callbacks(dynamic_cert).unwrap();
-    // by default intermediate supports both TLS 1.2 and 1.3. We force to tls 1.2 just for the demo
-    tls_settings
-        .set_max_proto_version(Some(pingora::tls::ssl::SslVersion::TLS1_2))
-        .unwrap();
+    let mut tls_settings;
+
+    // NOTE: dynamic certificate callback is only supported with BoringSSL/OpenSSL
+    #[cfg(feature = "openssl_derived")]
+    {
+        use std::ops::DerefMut;
+
+        let dynamic_cert = boringssl_openssl::DynamicCert::new(&cert_path, &key_path);
+        tls_settings = TlsSettings::with_callbacks(dynamic_cert).unwrap();
+        // by default intermediate supports both TLS 1.2 and 1.3. We force to tls 1.2 just for the demo
+
+        tls_settings
+            .deref_mut()
+            .deref_mut()
+            .set_max_proto_version(Some(pingora::tls::ssl::SslVersion::TLS1_2))
+            .unwrap();
+    }
+    #[cfg(feature = "rustls")]
+    {
+        tls_settings = TlsSettings::intermediate(&cert_path, &key_path).unwrap();
+    }
+    #[cfg(not(feature = "any_tls"))]
+    {
+        tls_settings = TlsSettings;
+    }
+
     tls_settings.enable_h2();
     echo_service_http.add_tls_with_settings("0.0.0.0:6148", None, tls_settings);