Struct tlspuffin::tls::rustls::sign::CertifiedKey

pub struct CertifiedKey {
    pub cert: Vec<Certificate>,
    pub key: Arc<dyn SigningKey>,
    pub ocsp: Option<Vec<u8>>,
    pub sct_list: Option<Vec<u8>>,
}

A packaged-together certificate chain, matching SigningKey and optional stapled OCSP response and/or SCT list.

Fields

cert: Vec<Certificate>

The certificate chain.

key: Arc<dyn SigningKey>

The certified key.

ocsp: Option<Vec<u8>>

An optional OCSP response from the certificate issuer, attesting to its continued validity.

sct_list: Option<Vec<u8>>

An optional collection of SCTs from CT logs, proving the certificate is included on those logs. This must be a SignedCertificateTimestampList encoding; see RFC6962.

Implementations

impl CertifiedKey

pub fn new(cert: Vec<Certificate>, key: Arc<dyn SigningKey>) -> Self

Make a new CertifiedKey, with the given chain and key.

The cert chain must not be empty. The first certificate in the chain must be the end-entity certificate.

pub fn end_entity_cert(&self) -> Result<&Certificate, SignError>

The end-entity certificate.

pub fn cross_check_end_entity_cert( &self, name: Option<DnsNameRef<'_>>, ) -> Result<(), Error>

Check the certificate chain for validity:

• it should be non-empty list
• the first certificate should be parsable as a x509v3,
• the first certificate should quote the given server name (if provided)

These checks are not security-sensitive. They are the server attempting to detect accidental misconfiguration.

Trait Implementations

impl Clone for CertifiedKey

fn clone(&self) -> CertifiedKey

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.