Struct CertifiedKey 

#[non_exhaustive]
pub struct CertifiedKey {
    pub cert_chain: Vec<CertificateDer<'static>>,
    pub key: Arc<dyn SigningKey>,
    pub ocsp: Option<Vec<u8>>,
}

A packaged-together certificate chain, matching SigningKey and optional stapled OCSP response.

Note: this struct is also used to represent an RFC 7250 raw public key, when the client/server is configured to use raw public keys instead of certificates.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

cert_chain: Vec<CertificateDer<'static>>

The certificate chain or raw public key.

key: Arc<dyn SigningKey>

The certified key.

ocsp: Option<Vec<u8>>

An optional OCSP response from the certificate issuer, attesting to its continued validity.

Implementations

impl CertifiedKey

pub fn from_der( cert_chain: Vec<CertificateDer<'static>>, key: PrivateKeyDer<'static>, provider: &CryptoProvider, ) -> Result<Self, Error>

Create a new CertifiedKey from a certificate chain and DER-encoded private key.

Attempt to parse the private key with the given CryptoProvider’s KeyProvider and verify that it matches the public key in the first certificate of the cert_chain if possible.

pub fn new( cert_chain: Vec<CertificateDer<'static>>, key: Arc<dyn SigningKey>, ) -> Result<Self, Error>

Make a new CertifiedKey, with the given chain and key.

The cert chain must not be empty. The first certificate in the chain must be the end-entity certificate. The end-entity certificate’s subject public key info must match that of the key’s public key. If the key does not have a public key, this will return an InconsistentKeys::Unknown error.

This constructor should be used with all SigningKey implementations that can provide a public key, including those provided by rustls itself.

pub fn new_unchecked( cert_chain: Vec<CertificateDer<'static>>, key: Arc<dyn SigningKey>, ) -> Self

Make a new CertifiedKey from a raw private key.

Unlike CertifiedKey::new(), this does not check that the end-entity certificate’s subject key matches key’s public key.

This avoids parsing the end-entity certificate, which is useful when using client certificates that are not fully standards compliant, but known to usable by the peer.

pub fn keys_match(&self) -> Result<(), Error>

Verify the consistency of this CertifiedKey’s public and private keys. This is done by performing a comparison of SubjectPublicKeyInfo bytes.

pub fn end_entity_cert(&self) -> Result<&CertificateDer<'_>, Error>

The end-entity certificate.

Trait Implementations

impl Clone for CertifiedKey

fn clone(&self) -> CertifiedKey

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CertifiedKey

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl From<CertifiedKey> for SingleCertAndKey

fn from(certified_key: CertifiedKey) -> Self

Converts to this type from the input type.