Certstream server in Rust for real-time CT log streaming
Drop-in replacement for certstream-server and certstream-server-go. Stream certificates via WebSocket, SSE, and TCP. Monitor 60+ Certificate Transparency logs with 50K+ concurrent clients.
docker run -d -p 8080:8080 reloading01/certstream-server-rust:latest
What you get
Built for security teams, researchers, and developers who need reliable CT monitoring
Multi-protocol streaming
WebSocket, SSE (Server-Sent Events), and raw TCP. Pick the protocol that fits your stack. SSE for browsers, TCP for pipelines.
State persistence
Resume from last position after restart. No certificate loss during maintenance or updates. Configurable state file.
Connection limiting
Per-IP and total connection limits. Production-ready protection against abuse.
Token authentication
Bearer token based auth for API access control. Multiple tokens supported. Configurable header name.
Hot reload config
Config changes apply without restart. File watcher detects updates. Zero-downtime configuration.
CT log health
Automatic retry with exponential backoff. Circuit breaker for unhealthy logs. Configurable health thresholds.
Prometheus metrics
Built-in /metrics endpoint. Connection counts per protocol, message throughput, CT log health.
Performance
Load tested with 500 concurrent WebSocket clients, 60 seconds (2 CPU cores, 2GB RAM per container)
Rust vs Elixir: 8.5x less memory, 2.5x higher throughput. Rust vs Go: 1.6x less memory, 1.8x higher throughput.