Struct CertificateParams

#[non_exhaustive]
pub struct CertificateParams {

    pub not_before: OffsetDateTime,
    pub not_after: OffsetDateTime,
    pub serial_number: Option<SerialNumber>,
    pub subject_alt_names: Vec<SanType>,
    pub distinguished_name: DistinguishedName,
    pub is_ca: IsCa,
    pub key_usages: Vec<KeyUsagePurpose>,
    pub extended_key_usages: Vec<ExtendedKeyUsagePurpose>,
    pub name_constraints: Option<NameConstraints>,
    pub crl_distribution_points: Vec<CrlDistributionPoint>,
    pub custom_extensions: Vec<CustomExtension>,
    pub use_authority_key_identifier_extension: bool,
    pub key_identifier_method: KeyIdMethod,
}

Parameters used for certificate generation

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

not_before: OffsetDateTime

not_after: OffsetDateTime

serial_number: Option<SerialNumber>

subject_alt_names: Vec<SanType>

distinguished_name: DistinguishedName

is_ca: IsCa

key_usages: Vec<KeyUsagePurpose>

extended_key_usages: Vec<ExtendedKeyUsagePurpose>

name_constraints: Option<NameConstraints>

crl_distribution_points: Vec<CrlDistributionPoint>

An optional list of certificate revocation list (CRL) distribution points as described in RFC 5280 Section 4.2.1.13¹. Each distribution point contains one or more URIs where an up-to-date CRL with scope including this certificate can be retrieved.

---

1. https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.13 ↩

custom_extensions: Vec<CustomExtension>

use_authority_key_identifier_extension: bool

If true, the ‘Authority Key Identifier’ extension will be added to the generated cert

key_identifier_method: KeyIdMethod

Method to generate key identifiers from public keys

Defaults to a truncated SHA-256 digest. See KeyIdMethod for more information.

Implementations

impl CertificateParams

pub fn new( subject_alt_names: impl Into<Vec<String>>, ) -> Result<CertificateParams, Error>

Generate certificate parameters with reasonable defaults

pub fn signed_by( &self, public_key: &impl PublicKeyData, issuer: &Issuer<'_, impl SigningKey>, ) -> Result<Certificate, Error>

Generate a new certificate from the given parameters, signed by the provided issuer.

The returned certificate will have its issuer field set to the subject of the provided issuer, and the authority key identifier extension will be populated using the subject public key of issuer (typically either a CertificateParams or Certificate). It will be signed by issuer_key.

Note that no validation of the issuer certificate is performed. Rcgen will not require the certificate to be a CA certificate, or have key usage extensions that allow signing.

The returned Certificate may be serialized using Certificate::der and Certificate::pem.

pub fn self_signed( &self, signing_key: &impl SigningKey, ) -> Result<Certificate, Error>

Generates a new self-signed certificate from the given parameters.

The returned Certificate may be serialized using Certificate::der and Certificate::pem.

pub fn key_identifier(&self, key: &impl PublicKeyData) -> Vec<u8>

Calculates a subject key identifier for the certificate subject’s public key. This key identifier is used in the SubjectKeyIdentifier X.509v3 extension.

pub fn serialize_request( &self, subject_key: &impl SigningKey, ) -> Result<CertificateSigningRequest, Error>

Generate and serialize a certificate signing request (CSR).

The constructed CSR will contain attributes based on the certificate parameters, and include the subject public key information from subject_key. Additionally, the CSR will be signed using the subject key.

Note that subsequent invocations of serialize_request() will not produce the exact same output.

pub fn serialize_request_with_attributes( &self, subject_key: &impl SigningKey, attrs: Vec<Attribute>, ) -> Result<CertificateSigningRequest, Error>

Generate and serialize a certificate signing request (CSR) with custom PKCS #10 attributes. as defined in RFC 2986.

The constructed CSR will contain attributes based on the certificate parameters, and include the subject public key information from subject_key. Additionally, the CSR will be self-signed using the subject key.

Note that subsequent invocations of serialize_request_with_attributes() will not produce the exact same output.

pub fn insert_extended_key_usage(&mut self, eku: ExtendedKeyUsagePurpose)

Insert an extended key usage (EKU) into the parameters if it does not already exist

Trait Implementations

impl AsRef<CertificateParams> for CertificateParams

fn as_ref(&self) -> &CertificateParams

Converts this type into a shared reference of the (usually inferred) input type.

impl Clone for CertificateParams

fn clone(&self) -> CertificateParams

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CertificateParams

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for CertificateParams

fn default() -> CertificateParams

Returns the “default value” for a type.

impl PartialEq for CertificateParams

fn eq(&self, other: &CertificateParams) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Eq for CertificateParams

impl StructuralPartialEq for CertificateParams