Struct tlspuffin::tls::rustls::verify::WebPkiVerifier

pub struct WebPkiVerifier {
    roots: RootCertStore,
    ct_policy: Option<CertificateTransparencyPolicy>,
}

Default ServerCertVerifier, see the trait impl for more information.

Fields

roots: RootCertStore

ct_policy: Option<CertificateTransparencyPolicy>

Implementations

impl WebPkiVerifier

pub fn new( roots: RootCertStore, ct_policy: Option<CertificateTransparencyPolicy>, ) -> Self

Constructs a new WebPkiVerifier.

roots is the set of trust anchors to trust for issuing server certs.

ct_logs is the list of logs that are trusted for Certificate Transparency. Currently CT log enforcement is opportunistic; see https://github.com/rustls/rustls/issues/479.

pub fn verification_schemes() -> Vec<SignatureScheme>

Returns the signature verification methods supported by webpki.

Trait Implementations

impl ServerCertVerifier for WebPkiVerifier

fn verify_server_cert( &self, end_entity: &Certificate, intermediates: &[Certificate], server_name: &ServerName, scts: &mut dyn Iterator<Item = &[u8]>, ocsp_response: &[u8], now: SystemTime, ) -> Result<ServerCertVerified, Error>

Will verify the certificate is valid in the following ways:

• Signed by a trusted RootCertStore CA
• Not Expired
• Valid for DNS entry

fn verify_tls12_signature( &self, message: &[u8], cert: &Certificate, dss: &DigitallySignedStruct, ) -> Result<HandshakeSignatureValid, Error>

Verify a signature allegedly by the given server certificate.

fn verify_tls13_signature( &self, message: &[u8], cert: &Certificate, dss: &DigitallySignedStruct, ) -> Result<HandshakeSignatureValid, Error>

Verify a signature allegedly by the given server certificate.

fn supported_verify_schemes(&self) -> Vec<SignatureScheme>

Return the list of SignatureSchemes that this verifier will handle, in verify_tls12_signature and verify_tls13_signature calls.

fn request_scts(&self) -> bool

Returns true if Rustls should ask the server to send SCTs.