rustls · cpu · Sep 25, 2026 · Sep 25, 2026 · Sep 25, 2026 · Sep 25, 2026
diff --git a/.github/workflows/artifacts.yaml b/.github/workflows/artifacts.yaml
@@ -23,6 +23,8 @@ jobs:
       - name: Install stable Rust
         uses: dtolnay/rust-toolchain@stable
 
+      - uses: Swatinem/rust-cache@v2
+
       - name: Install cargo-c
         shell: pwsh
         env:
@@ -57,6 +59,8 @@ jobs:
       - name: Install stable Rust
         uses: dtolnay/rust-toolchain@stable
 
+      - uses: Swatinem/rust-cache@v2
+
       - name: Install cargo-c
         env:
           LINK: https://github.com/lu-zero/cargo-c/releases/latest/download
@@ -77,6 +81,39 @@ jobs:
           name: rustls-ffi-x86_64-linux-gnu
           path: dist
 
+  linux-arm64-binaries:
+    name: Linux (arm64 GNU)
+    runs-on: ubuntu-22.04-arm
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Install stable Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - uses: Swatinem/rust-cache@v2
+
+      - name: Install cargo-c
+        env:
+          LINK: https://github.com/lu-zero/cargo-c/releases/latest/download
+          CARGO_C_FILE: cargo-c-aarch64-unknown-linux-musl.tar.gz
+        run: |
+          curl -L $LINK/$CARGO_C_FILE | tar xz -C ~/.cargo/bin
+
+      - name: Build rustls-ffi
+        run: |
+          cargo cinstall --locked --target aarch64-unknown-linux-gnu --features cert_compression --release --prefix dist
+
+      - name: Copy in LICENSE files
+        run: cp LICENSE* dist
+
+      - name: Upload binaries
+        uses: actions/upload-artifact@v7
+        with:
+          name: rustls-ffi-arm64-linux-gnu
+          path: dist
+
   linux-deb:
     name: Linux (x86-64 GNU Deb)
     runs-on: ubuntu-22.04 # x86_64.
@@ -90,6 +127,8 @@ jobs:
       - name: Install stable Rust
         uses: dtolnay/rust-toolchain@stable
 
+      - uses: Swatinem/rust-cache@v2
+
       - name: Install cargo-c
         env:
           LINK: https://github.com/lu-zero/cargo-c/releases/latest/download
@@ -126,13 +165,15 @@ jobs:
           # Install both the arm64 and x86_64 targets.
           targets: aarch64-apple-darwin, x86_64-apple-darwin
 
+      - uses: Swatinem/rust-cache@v2
+
       - name: Install cargo-c
         env:
           LINK: https://github.com/lu-zero/cargo-c/releases/latest/download
           CARGO_C_FILE: cargo-c-macos.zip
         run: |
           curl -L $LINK/$CARGO_C_FILE -o cargo-c-macos.zip
-          unzip cargo-c-macos.zip -d ~/.cargo/bin
+          unzip -o cargo-c-macos.zip -d ~/.cargo/bin
 
       - name: Build rustls-ffi (arm64)
         run: |
@@ -171,14 +212,16 @@ jobs:
   test-archives:
     name: "Test (${{ matrix.os }})"
     runs-on: ${{ matrix.os }}
-    needs: [ windows-binaries, linux-binaries, macos-binaries ]
+    needs: [ windows-binaries, linux-binaries, linux-arm64-binaries, macos-binaries ]
     strategy:
       matrix:
         include:
           - os: windows-latest
             artifact: rustls-ffi-x86_64-windows
           - os: ubuntu-latest
             artifact: rustls-ffi-x86_64-linux-gnu
+          - os: ubuntu-22.04-arm
+            artifact: rustls-ffi-arm64-linux-gnu
           - os: macos-15
             artifact: rustls-ffi-arm64-macos
           - os: macos-15-intel

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,27 @@
 # Changelog
 
+## 0.15.4 (2026-09-25)
+
+This is a minor release with one security fix. It also updates `rustls` to
+[0.23.45](https://github.com/rustls/rustls/releases/tag/v%2F0.23.45).
+
+### Security
+
+This update addresses
+[GHSA-2mjx-qc3c-rqvc](https://github.com/rustls/rustls/security/advisories/GHSA-2mjx-qc3c-rqvc),
+a security issue affecting TLS 1.3 handshake message processing that could allow
+a broken peer to send plaintext handshake messages where an encrypted one is
+expected without rustls rejecting the connection.
+
+### Added
+
+* ML-DSA certificate signature support when using the `aws-lc-rs` cryptography
+  provider, inherited from the upstream `rustls`
+  [0.23.44 release](https://github.com/rustls/rustls/releases/tag/v%2F0.23.44).
+  This includes ML-DSA-44, ML-DSA-65, and ML-DSA-87, and is independent of the
+  `prefer-post-quantum` feature that controls `X25519MLKEM768` key-exchange
+  priority.
+
 ## 0.15.3 (2026-04-22)
 
 This is a minor release with one security fix. It also updates `rustls` to

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/README.md b/README.md
@@ -98,15 +98,28 @@ platforms see the upstream documentation:
 [`*ring*`]: https://crates.io/crates/ring
 [`*ring*` supported platforms]: https://github.com/briansmith/ring/blob/2e8363b433fa3b3962c877d9ed2e9145612f3160/include/ring-core/target.h#L18-L64
 
-#### Post-Quantum X25519MLKEM768 Key Exchange
+#### Post-Quantum Support
 
-Post-quantum-secure key exchange using [X25519MLKEM768][] is supported when using the `aws-lc-rs` 
-cryptography provider and offered by default at the highest priority.
+The `aws-lc-rs` cryptography provider supports post-quantum-secure key exchange
+and certificate signatures. These algorithms are not supported by the `ring`
+provider.
 
-By disabling the `prefer-post-quantum` feature flag the `X25519MLKEM768` key exchange will be
-offered at a lower negotiation priority.
+##### X25519MLKEM768 Key Exchange
 
-[X25519MLKEM768]: https://datatracker.ietf.org/doc/draft-kwiatkowski-tls-ecdhe-mlkem
+Post-quantum-secure key exchange using [X25519MLKEM768][] is offered by default
+at the highest priority.
+
+The `prefer-post-quantum` Cargo feature is enabled by default. Disabling it
+keeps `X25519MLKEM768` available, but at a lower negotiation priority. Note that
+this feature only controls key-exchange priority. It doesn't affect ML-DSA
+support.
+
+[X25519MLKEM768]: https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-mlkem/
+
+##### ML-DSA Certificate Signatures
+
+Certificates and private keys using the ML-DSA-44, ML-DSA-65, and ML-DSA-87
+signature schemes are supported. This is principally useful with private PKIs.
 
 #### Certificate Compression
 

diff --git a/librustls/Cargo.toml b/librustls/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "rustls-ffi"
 # Keep in sync with defines in cbindgen.toml
-version = "0.15.3"
+version = "0.15.4"
 license = "Apache-2.0 OR ISC OR MIT"
 readme = "../README-crates.io.md"
 description = "Rustls bindings for non-Rust languages"
@@ -30,7 +30,7 @@ prefer-post-quantum = ["aws-lc-rs", "rustls/prefer-post-quantum"]
 
 [dependencies]
 # Keep in sync with RUSTLS_CRATE_VERSION in build.rs
-rustls = { version = "=0.23.42", default-features = false, features = ["std", "tls12"] }
+rustls = { version = "=0.23.45", default-features = false, features = ["std", "tls12"] }
 webpki  = { workspace = true }
 libc = { workspace = true }
 log = { workspace = true }

diff --git a/librustls/build.rs b/librustls/build.rs
@@ -37,4 +37,4 @@ fn main() {
 // because doing so would require a heavy-weight deserialization lib dependency
 // (and it couldn't be a _dev_ dep for use in a build script) or doing brittle
 // by-hand parsing.
-const RUSTLS_CRATE_VERSION: &str = "0.23.42";
+const RUSTLS_CRATE_VERSION: &str = "0.23.45";
diff --git a/librustls/cbindgen.toml b/librustls/cbindgen.toml
@@ -5,15 +5,15 @@ after_includes = """
 
 #define RUSTLS_VERSION_MAJOR 0
 #define RUSTLS_VERSION_MINOR 15
-#define RUSTLS_VERSION_PATCH 3
+#define RUSTLS_VERSION_PATCH 4
 
 /**
  * This gives each version part 8 bits, and leaves the 8 least significant bits
  * empty for future additions, for example pre-release versions.
  */
 #define RUSTLS_VERSION_NUMBER ((RUSTLS_VERSION_MAJOR << 24)   \\
                                |(RUSTLS_VERSION_MINOR << 16)  \\
-                               |(RUSTLS_VERSION_MINOR << 8))
+                               |(RUSTLS_VERSION_PATCH << 8))
 
 #if defined(__clang__) || defined(__GNUC__)
 # define DEPRECATED_FUNC(why) __attribute__((deprecated(why)))

diff --git a/librustls/src/acceptor.rs b/librustls/src/acceptor.rs
@@ -775,8 +775,13 @@ mod tests {
             SignatureScheme::RSA_PSS_SHA512,
             SignatureScheme::ED25519,
         ];
-        #[cfg(feature = "aws-lc-rs")] // aws-lc-rs also includes P-521.
-        expected_schemes.push(SignatureScheme::ECDSA_NISTP521_SHA512);
+        #[cfg(feature = "aws-lc-rs")]
+        expected_schemes.extend([
+            SignatureScheme::ECDSA_NISTP521_SHA512,
+            SignatureScheme::ML_DSA_44,
+            SignatureScheme::ML_DSA_65,
+            SignatureScheme::ML_DSA_87,
+        ]);
 
         let mut expected_schemes = expected_schemes
             .into_iter()

diff --git a/librustls/src/rustls.h b/librustls/src/rustls.h
@@ -9,15 +9,15 @@
 
 #define RUSTLS_VERSION_MAJOR 0
 #define RUSTLS_VERSION_MINOR 15
-#define RUSTLS_VERSION_PATCH 3
+#define RUSTLS_VERSION_PATCH 4
 
 /**
  * This gives each version part 8 bits, and leaves the 8 least significant bits
  * empty for future additions, for example pre-release versions.
  */
 #define RUSTLS_VERSION_NUMBER ((RUSTLS_VERSION_MAJOR << 24)   \
                                |(RUSTLS_VERSION_MINOR << 16)  \
-                               |(RUSTLS_VERSION_MINOR << 8))
+                               |(RUSTLS_VERSION_PATCH << 8))
 
 #if defined(__clang__) || defined(__GNUC__)
 # define DEPRECATED_FUNC(why) __attribute__((deprecated(why)))