docs(tls): install a rustls crypto provider when both backends are linked

When an application links both the ring and aws-lc-rs rustls backends,
rustls cannot pick a process default and the first TLS connection
panics. Document calling install_default at startup, in the README and
on TlsConfig.

Closes #212.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: yeoleobun

README.md

@@ -156,6 +156,23 @@ transport_layer.add_transport(tcp_listener.into());
 To add TLS or WebSocket listeners, construct a `TlsListenerConnection` or
 `WebSocketListenerConnection` and register it with `transport_layer.add_transport(...)`.
 
+> **rustls crypto provider.** rsipstack's TLS uses rustls's process-wide crypto
+> provider and builds rustls with `ring`. If your application also links the
+> `aws-lc-rs` backend (for example through `reqwest`'s default rustls setup),
+> rustls cannot pick one on its own and the first TLS connection panics with
+> *"Could not automatically determine the process-level CryptoProvider"*.
+> Install a provider once at startup, before creating any TLS transport:
+>
+> ```rust
+> rustls::crypto::ring::default_provider()
+>     .install_default()
+>     .expect("install rustls crypto provider");
+> // or: rustls::crypto::aws_lc_rs::default_provider().install_default()
+> ```
+>
+> The installed provider is used for every rustls user in the process,
+> rsipstack included, so it is also where to restrict cipher suites.
+
 The raw `TransportEvent` stream is an internal API consumed by `Endpoint::serve`.
 To process incoming SIP messages, build an `Endpoint` around the transport layer and
 drive it with `endpoint.serve()` while consuming transactions via

src/transport/tls.rs

@@ -222,7 +222,18 @@ impl Clone for ReloadableCertResolver {
     }
 }
 
-// TLS configuration
+/// TLS configuration.
+///
+/// TLS uses rustls's process-wide crypto provider. When the application links
+/// both the `ring` and `aws-lc-rs` backends (e.g. through another crate's
+/// rustls features), rustls cannot pick one and the first TLS connection
+/// panics; install one at startup, before creating any TLS transport:
+///
+/// ```ignore
+/// rustls::crypto::ring::default_provider()
+///     .install_default()
+///     .expect("install rustls crypto provider");
+/// ```
 #[derive(Clone, Debug, Default)]
 pub struct TlsConfig {
     // Server certificate in PEM format