Add rustls support

[Geal]

let's do it: https://docs.rs/rustls/

first thing should be to replace openssl usage in the command library. AFAIK, it is only used to generate the SHA256 fingerprint of certificates.

There is apparently no method to obtain the fingerprint of a certificate, but it could be added: https://docs.rs/rustls/0.5.8/rustls/struct.Certificate.html

[Geal]

depends on #254

[Geal]

ok, now let's do it

[Geal]

we'll probably need a way to transform something like openssl's ciphersuite string to https://docs.rs/rustls/0.11.0/rustls/struct.SupportedCipherSuite.html

[Geal]

Current work is available at https://github.com/sozu-proxy/sozu/tree/rustls
I'm a bit stuck on how to get the names from a certificate: rustls/rustls#140
I also see that rustls only supports RSA for now. I'm not too fond of DSA, but elliptic curves might be useful. Relevant issues:

• in rustls: X448 / Ed448 / Ed25519 support rustls/rustls#52
• in ring: Ed448 support briansmith/ring#463

[Geal]

next task is figuring out the common name and subject alternative names from a certificate in there, so we can use them to match in the SNI resolver: https://github.com/sozu-proxy/sozu/blob/rustls/lib/src/network/https_rustls/resolver.rs#L35-L39

[Geal]

work in progress, waiting on briansmith/webpki#65 to be merged, then I'll replace that code: https://github.com/sozu-proxy/sozu/blob/rustls/lib/src/network/https_rustls/resolver.rs#L35-L44

Alternative solution if the PR is not merged soon: add a list of names to the ADD_CERTIFICATE message, to tell the workers for which DNS names (wildcard or not) this certificate will be valid. With that, no need to parse the certificate in the worker to get the names, the configuration agent has to take care of it.
This would also require that the configuration file get a list of names for a certificate, and probably we'll keep a way to get the names from inside the worker if the list is empty. That feature is not complex, but there's a lot of small work here and there.

[briansmith]

I also see that rustls only supports RSA for now. I'm not too fond of DSA, but elliptic curves might be useful.

Rustls supports ECDSA too. Previously it only supported verification, however in the latest git master it has ECDSA signing support too.