diff --git a/.cargo/config.toml b/.cargo/config.toml
index 09921cf1..d16a066e 100644
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@@ -8,7 +8,7 @@ ci-check-web = "hack check --package xitca-web --each-feature --no-dev-deps"
 ci-check-client-exclude-io-uring = "hack check --package xitca-client --each-feature --no-dev-deps --exclude-features=io-uring"
 ci-check-client = "hack check --package xitca-client --each-feature --no-dev-deps"
 
-ci-check-other-exclude-io-uring = "hack check --workspace --exclude xitca-http --exclude xitca-client --exclude xitca-web --feature-powerset --exclude-features=io-uring,tokio-uring,runtime-uring,rustls-uring"
+ci-check-other-exclude-io-uring = "hack check --workspace --exclude xitca-http --exclude xitca-client --exclude xitca-web --feature-powerset --exclude-features=io-uring,tokio-uring,runtime-uring,rustls-uring,rustls-uring-no-crypto"
 ci-check-other = "hack check --workspace --exclude xitca-http --exclude xitca-client --exclude xitca-web --feature-powerset"
 
 ci-test-exclude-io-uring = "hack test --workspace --feature-powerset --exclude-features=io-uring --no-fail-fast -- --nocapture"
diff --git a/client/Cargo.toml b/client/Cargo.toml
index 5a585bd8..854ae95d 100644
--- a/client/Cargo.toml
+++ b/client/Cargo.toml
@@ -4,13 +4,13 @@ version = "0.1.0"
 edition = "2021"
 
 [features]
-# default feature includes http/1 clear text client.
+# default feature includes http/1 clear text client
 default = ["http1"]
-# http/1 clear text  client
+# http/1 clear text client
 http1 = ["httparse", "xitca-http/http1"]
 # http/2 client(tls enabled by default. see `dangerous` feature for clear text http/2)
 http2 = ["h2", "itoa", "xitca-http/http2"]
-# htt/3 client(tls always enabled with rustls)
+# http/3 client(tls always enabled with rustls)
 http3 = ["h3", "h3-quinn", "quinn/tls-rustls", "itoa", "async-stream", "rustls_0dot21", "webpki_roots_0dot25"]
 # openssl as http/1 and http/2 tls handler.
 openssl = ["xitca-tls/openssl"]
@@ -24,7 +24,6 @@ compress = ["http-encoding"]
 json = ["serde", "serde_json"]
 # websocket support
 websocket = ["http-ws"]
-
 # feature for testing niche client side usage and correctness of server implemenation:
 # - http/2 clear text over plain tcp connection
 # - http/3 connection to server with self signed certificates.
@@ -57,7 +56,7 @@ async-stream = { version = "0.3", optional = true }
 itoa = { version = "1", optional = true }
 
 # tls shared
-xitca-tls = { version = "0.2.2", optional = true }
+xitca-tls = { version = "0.2.3", optional = true }
 
 # rustls, http3 and dangerous features shared
 webpki-roots = { version = "0.26", optional = true }
diff --git a/client/src/builder.rs b/client/src/builder.rs
index 376cb93d..5bf8a7b4 100644
--- a/client/src/builder.rs
+++ b/client/src/builder.rs
@@ -15,7 +15,7 @@ use crate::{
     timeout::TimeoutConfig,
     tls::{
         connector::{self, Connector},
-        stream::TlsStream,
+        TlsStream,
     },
 };
 
diff --git a/client/src/client.rs b/client/src/client.rs
index 041ce8fb..ef01d358 100644
--- a/client/src/client.rs
+++ b/client/src/client.rs
@@ -11,7 +11,7 @@ use crate::{
     connect::Connect,
     connection::{ConnectionExclusive, ConnectionKey, ConnectionShared},
     date::DateTimeService,
-    error::{Error, TimeoutError},
+    error::{Error, ResolveError, TimeoutError},
     http::{self, uri, Method, Version},
     http_tunnel::HttpTunnelRequest,
     pool,
@@ -316,7 +316,7 @@ impl Client {
     async fn make_tcp_inner(&self, connect: &Connect<'_>) -> Result<TcpStream, Error> {
         let mut iter = connect.addrs();
 
-        let mut addr = iter.next().ok_or(Error::Resolve)?;
+        let mut addr = iter.next().ok_or_else(|| ResolveError::new(connect.hostname()))?;
 
         // try to connect with all addresses resolved by dns resolver.
         // return the last error when all are fail to be connected.
diff --git a/client/src/connection.rs b/client/src/connection.rs
index 94e51968..1e25237f 100644
--- a/client/src/connection.rs
+++ b/client/src/connection.rs
@@ -15,7 +15,7 @@ use xitca_io::{
 #[cfg(unix)]
 use xitca_io::net::UnixStream;
 
-use crate::{tls::stream::TlsStream, uri::Uri};
+use super::{tls::TlsStream, uri::Uri};
 
 #[cfg(feature = "http1")]
 /// A convince type alias for typing connection without interacting with pool.
diff --git a/client/src/error.rs b/client/src/error.rs
index 5c8431be..57e7cb08 100644
--- a/client/src/error.rs
+++ b/client/src/error.rs
@@ -10,9 +10,6 @@ pub enum Error {
     Io(io::Error),
     Std(Box<dyn error::Error + Send + Sync>),
     InvalidUri(InvalidUri),
-    Resolve,
-    Timeout(TimeoutError),
-    TlsNotEnabled,
     #[cfg(feature = "http1")]
     H1(crate::h1::Error),
     #[cfg(feature = "http2")]
@@ -95,9 +92,48 @@ pub enum TimeoutError {
     Response,
 }
 
+impl fmt::Display for TimeoutError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Resolve => f.write_str("dns look up timeout"),
+            Self::Connect => f.write_str("socket connect timeout"),
+            Self::TlsHandshake => f.write_str("tls handshake timeout"),
+            Self::Request => f.write_str("request sending timeout"),
+            Self::Response => f.write_str("response receiving timeout"),
+        }
+    }
+}
+
+impl error::Error for TimeoutError {}
+
 impl From<TimeoutError> for Error {
     fn from(e: TimeoutError) -> Self {
-        Self::Timeout(e)
+        Self::Std(Box::new(e))
+    }
+}
+
+#[derive(Debug)]
+pub struct ResolveError {
+    domain: String,
+}
+
+impl ResolveError {
+    pub(crate) fn new(domain: impl Into<String>) -> Self {
+        Self { domain: domain.into() }
+    }
+}
+
+impl fmt::Display for ResolveError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "domain: {} can't be resolved to socket address", self.domain)
+    }
+}
+
+impl error::Error for ResolveError {}
+
+impl From<ResolveError> for Error {
+    fn from(e: ResolveError) -> Self {
+        Self::Std(Box::new(e))
     }
 }
 
@@ -222,6 +258,7 @@ pub enum FeatureError {
     Http1NotEnabled,
     Http2NotEnabled,
     Http3NotEnabled,
+    TlsNotEnabled,
 }
 
 impl fmt::Display for FeatureError {
@@ -230,6 +267,7 @@ impl fmt::Display for FeatureError {
             Self::Http1NotEnabled => f.write_str("http1")?,
             Self::Http2NotEnabled => f.write_str("http2")?,
             Self::Http3NotEnabled => f.write_str("http3")?,
+            Self::TlsNotEnabled => f.write_str("openssl or rustls")?,
         };
         f.write_str(" crate feature is not enabled")
     }
diff --git a/client/src/lib.rs b/client/src/lib.rs
index 227b40b1..074d2ce7 100644
--- a/client/src/lib.rs
+++ b/client/src/lib.rs
@@ -68,7 +68,7 @@ pub use self::request::RequestBuilder;
 pub use self::response::Response;
 pub use self::service::{HttpService, Service, ServiceRequest};
 pub use self::timeout::TimeoutConfig;
-pub use self::tls::{connector::Connector, stream::TlsStream};
+pub use self::tls::{connector::Connector, TlsStream};
 
 // re-export http crate.
 pub use xitca_http::http;
diff --git a/client/src/service.rs b/client/src/service.rs
index a8b8e37a..ddefd065 100644
--- a/client/src/service.rs
+++ b/client/src/service.rs
@@ -152,7 +152,15 @@ pub(crate) fn base_service() -> HttpService {
                                     {
                                         _spawner.spawned(conn.into());
                                     } else {
-                                        version = Version::HTTP_2;
+                                        #[cfg(feature = "http2")]
+                                        {
+                                            version = Version::HTTP_2;
+                                        }
+
+                                        #[cfg(not(feature = "http2"))]
+                                        {
+                                            version = Version::HTTP_11;
+                                        }
                                     }
                                 }
 
diff --git a/client/src/tls/connector.rs b/client/src/tls/connector.rs
index b6a288af..9fad6100 100644
--- a/client/src/tls/connector.rs
+++ b/client/src/tls/connector.rs
@@ -4,7 +4,7 @@ use crate::{
     service::{Service, ServiceDyn},
 };
 
-use super::stream::TlsStream;
+use super::TlsStream;
 
 /// Connector for tls connections.
 ///
@@ -23,7 +23,7 @@ pub(crate) fn nop() -> Connector {
         async fn call(&self, (_, _io): (&'n str, TlsStream)) -> Result<Self::Response, Self::Error> {
             #[cfg(not(feature = "dangerous"))]
             {
-                Err(Error::TlsNotEnabled)
+                Err(crate::error::FeatureError::TlsNotEnabled.into())
             }
 
             #[cfg(feature = "dangerous")]
diff --git a/client/src/tls/mod.rs b/client/src/tls/mod.rs
index e392961b..dcd7c0cc 100644
--- a/client/src/tls/mod.rs
+++ b/client/src/tls/mod.rs
@@ -1,2 +1,3 @@
 pub(crate) mod connector;
-pub(crate) mod stream;
+
+pub type TlsStream = Box<dyn xitca_io::io::AsyncIoDyn + Send + Sync>;
diff --git a/http/CHANGES.md b/http/CHANGES.md
index 8777c65e..5bceb947 100644
--- a/http/CHANGES.md
+++ b/http/CHANGES.md
@@ -1,7 +1,11 @@
 # unreleased 0.4.1
+## Fix
+- fix panic when using `rustls/ring` feature together with `xitca-http/rustls`
+- fix panic when using `rustls/ring` feature together with `xitca-http/rustls-uring`
+
 ## Change
-- update `xitca-io` to `0.2.1`.
-- update `xitca-tls` to `0.2.2`.
+- update `xitca-io` to `0.2.1`
+- update `xitca-tls` to `0.2.3`
 
 # 0.4.0
 ## Add
diff --git a/http/Cargo.toml b/http/Cargo.toml
index 9b88d960..a8743c51 100644
--- a/http/Cargo.toml
+++ b/http/Cargo.toml
@@ -21,9 +21,9 @@ http3 = ["xitca-io/http3", "futures-util/alloc", "h3", "h3-quinn", "runtime"]
 # openssl as server side tls.
 openssl = ["xitca-tls/openssl", "runtime"]
 # rustls as server side tls.
-rustls = ["xitca-tls/rustls", "runtime"]
+rustls = ["xitca-tls/rustls-no-crypto", "runtime"]
 # rustls as server side tls.
-rustls-uring = ["rustls", "xitca-tls/rustls-uring", "xitca-io/runtime-uring"]
+rustls-uring = ["rustls", "xitca-tls/rustls-uring-no-crypto", "xitca-io/runtime-uring"]
 # rustls as server side tls.
 native-tls = ["dep:native-tls", "runtime"]
 # async runtime feature.
@@ -48,7 +48,7 @@ tracing = { version = "0.1.40", default-features = false }
 native-tls = { version = "0.2.7", features = ["alpn"], optional = true }
 
 # tls support shared
-xitca-tls = { version = "0.2.2", optional = true }
+xitca-tls = { version = "0.2.3", optional = true }
 
 # http/1 support
 httparse = { version = "1.8", optional = true }
diff --git a/tls/CHANGES.md b/tls/CHANGES.md
index 84ad4e3a..b784976a 100644
--- a/tls/CHANGES.md
+++ b/tls/CHANGES.md
@@ -1,5 +1,10 @@
 # unreleased
 
+# 0.2.3
+## Add
+- `rustls-no-crypto` feature
+- `rustls-uring-no-crypto` feature
+
 # 0.2.2
 ## Add
 - `rustls-ring-crypto` feature
diff --git a/tls/Cargo.toml b/tls/Cargo.toml
index 9f4c4fdd..7321104b 100644
--- a/tls/Cargo.toml
+++ b/tls/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "xitca-tls"
-version = "0.2.2"
+version = "0.2.3"
 edition = "2021"
 license = "Apache-2.0"
 description = "tls utility for xitca"
@@ -11,12 +11,19 @@ readme= "README.md"
 
 [features]
 openssl = ["dep:openssl"]
+# rustls with no default crypto provider
+rustls-no-crypto = ["rustls_crate"]
+# rustls with aws-lc as crypto provider (default provider from `rustls` crate)
 rustls = ["rustls_crate/aws-lc-rs"]
+# rustls with ring as crypto provider
 rustls-ring-crypto = ["rustls_crate/ring"]
-rustls-uring = ["rustls_crate/default", "xitca-io/runtime-uring"]
+# rustls with no crypto provider for xitca-io io-uring traits
+rustls-uring-no-crypto = ["rustls_crate", "xitca-io/runtime-uring"]
+# rustls with aws-lc as crypto provider for xitca-io io-uring trait (default provider from `rustls` crate)
+rustls-uring = ["rustls_crate/aws-lc-rs", "xitca-io/runtime-uring"]
 
 [dependencies]
 xitca-io = { version = "0.2.1", features = ["runtime"] }
 
-rustls_crate = { package = "rustls", version = "0.23", default-features = false, features = ["logging", "std", "tls12"], optional = true }
 openssl = { version = "0.10", optional = true }
+rustls_crate = { package = "rustls", version = "0.23", default-features = false, features = ["logging", "std", "tls12"], optional = true }
diff --git a/tls/src/lib.rs b/tls/src/lib.rs
index 0b204b14..771c1479 100644
--- a/tls/src/lib.rs
+++ b/tls/src/lib.rs
@@ -1,6 +1,6 @@
 #[cfg(feature = "openssl")]
 pub mod openssl;
-#[cfg(any(feature = "rustls", feature = "rustls-ring-crypto"))]
+#[cfg(any(feature = "rustls", feature = "rustls-ring-crypto", feature = "rustls-no-crypto"))]
 pub mod rustls;
-#[cfg(feature = "rustls-uring")]
+#[cfg(any(feature = "rustls-uring", feature = "rustls-uring-no-crypto"))]
 pub mod rustls_uring;
diff --git a/web/CHANGES.md b/web/CHANGES.md
index 9773da5d..9b67fd22 100644
--- a/web/CHANGES.md
+++ b/web/CHANGES.md
@@ -1,4 +1,9 @@
-# unreleased
+# unreleased 0.4.1
+## Fix
+- fix panic when using `rustls/ring` feature together with `xitca-web/rustls`
+
+## Change
+- remove direct dependent on `openssl` and `rustls` crates
 
 # 0.4.0
 ## Add
diff --git a/web/Cargo.toml b/web/Cargo.toml
index e74fd042..1cafb303 100644
--- a/web/Cargo.toml
+++ b/web/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "xitca-web"
-version = "0.4.0"
+version = "0.4.1"
 edition = "2021"
 license = "Apache-2.0"
 description = "an async web framework"
@@ -22,7 +22,7 @@ io-uring = ["__server", "xitca-server/io-uring"]
 
 # tls transport layer
 openssl = ["__server", "xitca-http/openssl", "xitca-tls/openssl"]
-rustls = ["__server", "xitca-http/rustls", "xitca-tls/rustls"]
+rustls = ["__server", "xitca-http/rustls", "xitca-tls/rustls-no-crypto"]
 
 # params type extractor
 params = ["serde"]
@@ -76,9 +76,9 @@ serde = ["dep:serde"]
 __server = ["xitca-http/runtime", "xitca-server"]
 
 [dependencies]
-xitca-http = { version = "0.4.0", features = ["router"], default-features = false }
+xitca-http = { version = "0.4.1", features = ["router"], default-features = false }
 xitca-service = { version = "0.1", features = ["alloc", "std"] }
-xitca-unsafe-collection = "0.1"
+xitca-unsafe-collection = "0.1.1"
 
 futures-core = "0.3"
 pin-project-lite = "0.2.9"
@@ -88,7 +88,7 @@ tokio = { version = "1", features = ["rt", "sync"] }
 xitca-server = { version = "0.2", optional = true }
 
 # tls
-xitca-tls = { version = "0.2.2", optional = true }
+xitca-tls = { version = "0.2.3", optional = true }
 
 # (de)serialization shared.
 serde = { version = "1", optional = true }