Struct X509Certificate 

pub struct X509Certificate<'a> {
    pub tbs_certificate: TbsCertificate<'a>,
    pub signature_algorithm: AlgorithmIdentifier<'a>,
    pub signature_value: BitString<'a>,
    /* private fields */
}

Available on crate feature crypto only.

An X.509 v3 Certificate.

X.509 v3 certificates are defined in RFC5280, section 4.1. This object uses the same structure for content, so for ex the subject can be accessed using the path x509.tbs_certificate.subject.

X509Certificate also contains convenience methods to access the most common fields (subject, issuer, etc.). These are provided using Deref<Target = TbsCertificate>, so documentation for these methods can be found in the TbsCertificate object.

A X509Certificate is a zero-copy view over a buffer, so the lifetime is the same as the buffer containing the binary representation.

fn display_x509_info(x509: &X509Certificate<'_>) {
     let subject = x509.subject();
     let issuer = x509.issuer();
     println!("X.509 Subject: {}", subject);
     println!("X.509 Issuer: {}", issuer);
     println!("X.509 serial: {}", x509.tbs_certificate.raw_serial_as_string());
}

Fields

tbs_certificate: TbsCertificate<'a>

signature_algorithm: AlgorithmIdentifier<'a>

signature_value: BitString<'a>

Implementations

impl<'a> X509Certificate<'a>

pub fn as_raw(&self) -> &'a [u8]

Available on (crate features rustls or boring or acme) and crate feature rustls only.

Return the raw ASN.1 DER content of the complete signed certificate that was parsed.

This includes the to-be-signed (TBS) certificate, the signature algorithm, and the signature. If you want just the ASN.1 DER of the TBS certificate, prefer TbsCertificate::as_ref().

We avoid the AsRef trait in this instance to ensure the full lifetime of the X509Certificate is used.

pub fn verify_signature( &self, public_key: Option<&SubjectPublicKeyInfo<'_>>, ) -> Result<(), X509Error>

Available on (crate features rustls or boring or acme) and crate feature rustls and crate feature verify only.

Verify the cryptographic signature of this certificate

public_key is the public key of the signer. For a self-signed certificate, (for ex. a public root certificate authority), this is the key from the certificate, so you can use None.

For a leaf certificate, this is the public key of the certificate that signed it. It is usually an intermediate authority.

Not all algorithms are supported, this function is limited to what ring supports.

impl X509Certificate<'_>

pub fn walk<V>(&self, visitor: &mut V)

where V: X509CertificateVisitor,

Available on (crate features rustls or boring or acme) and crate feature rustls only.

Run the provided X509CertificateVisitor over the X.509 Certificate (self)

Methods from Deref<Target = TbsCertificate<'a>>

pub fn version(&self) -> X509Version

Available on (crate features rustls or boring or acme) and crate feature rustls only.

Get the version of the encoded certificate

pub fn subject(&self) -> &X509Name<'_>

Available on (crate features rustls or boring or acme) and crate feature rustls only.

Get the certificate subject.

pub fn issuer(&self) -> &X509Name<'_>

Available on (crate features rustls or boring or acme) and crate feature rustls only.

Get the certificate issuer.

pub fn validity(&self) -> &Validity

Available on (crate features rustls or boring or acme) and crate feature rustls only.

Get the certificate validity.

pub fn public_key(&self) -> &SubjectPublicKeyInfo<'_>

Available on (crate features rustls or boring or acme) and crate feature rustls only.

Get the certificate public key information.

pub fn extensions(&self) -> &[X509Extension<'a>]

Available on (crate features rustls or boring or acme) and crate feature rustls only.

Returns the certificate extensions

pub fn iter_extensions(&self) -> impl Iterator<Item = &X509Extension<'a>>

Available on (crate features rustls or boring or acme) and crate feature rustls only.

Returns an iterator over the certificate extensions

pub fn get_extension_unique( &self, oid: &Oid<'_>, ) -> Result<Option<&X509Extension<'a>>, X509Error>

Available on (crate features rustls or boring or acme) and crate feature rustls only.

Searches for an extension with the given Oid.

Return Ok(Some(extension)) if exactly one was found, Ok(None) if none was found, or an error DuplicateExtensions if the extension is present twice or more.

pub fn find_extension(&self, oid: &Oid<'_>) -> Option<&X509Extension<'a>>

👎Deprecated since 0.13.0: Do not use this function (duplicate extensions are not checked), use get_extension_unique

Available on (crate features rustls or boring or acme) and crate feature rustls only.

Searches for an extension with the given Oid.

Duplicate extensions

Note: if there are several extensions with the same Oid, the first one is returned, masking other values.

RFC5280 forbids having duplicate extensions, but does not specify how errors should be handled.

Because of this, the find_extension method is not safe and should not be used! The get_extension_unique method checks for duplicate extensions and should be preferred.

pub fn extensions_map( &self, ) -> Result<HashMap<Oid<'_>, &X509Extension<'a>>, X509Error>

Available on (crate features rustls or boring or acme) and crate feature rustls only.

Builds and returns a map of extensions.

If an extension is present twice, this will fail and return DuplicateExtensions.

pub fn basic_constraints( &self, ) -> Result<Option<BasicExtension<&BasicConstraints>>, X509Error>

Available on (crate features rustls or boring or acme) and crate feature rustls only.

Attempt to get the certificate Basic Constraints extension

Return Ok(Some(extension)) if exactly one was found, Ok(None) if none was found, or an error if the extension is present twice or more.

pub fn key_usage(&self) -> Result<Option<BasicExtension<&KeyUsage>>, X509Error>

Available on (crate features rustls or boring or acme) and crate feature rustls only.

Attempt to get the certificate Key Usage extension

Return Ok(Some(extension)) if exactly one was found, Ok(None) if none was found, or an error if the extension is invalid, or is present twice or more.

pub fn extended_key_usage( &self, ) -> Result<Option<BasicExtension<&ExtendedKeyUsage<'_>>>, X509Error>

Available on (crate features rustls or boring or acme) and crate feature rustls only.

Attempt to get the certificate Extended Key Usage extension

Return Ok(Some(extension)) if exactly one was found, Ok(None) if none was found, or an error if the extension is invalid, or is present twice or more.

pub fn policy_constraints( &self, ) -> Result<Option<BasicExtension<&PolicyConstraints>>, X509Error>

Available on (crate features rustls or boring or acme) and crate feature rustls only.

Attempt to get the certificate Policy Constraints extension

Return Ok(Some(extension)) if exactly one was found, Ok(None) if none was found, or an error if the extension is invalid, or is present twice or more.

pub fn inhibit_anypolicy( &self, ) -> Result<Option<BasicExtension<&InhibitAnyPolicy>>, X509Error>

Available on (crate features rustls or boring or acme) and crate feature rustls only.

Attempt to get the certificate Policy Constraints extension

Return Ok(Some(extension)) if exactly one was found, Ok(None) if none was found, or an error if the extension is invalid, or is present twice or more.

pub fn policy_mappings( &self, ) -> Result<Option<BasicExtension<&PolicyMappings<'_>>>, X509Error>

Available on (crate features rustls or boring or acme) and crate feature rustls only.

Attempt to get the certificate Policy Mappings extension

Return Ok(Some(extension)) if exactly one was found, Ok(None) if none was found, or an error if the extension is invalid, or is present twice or more.

pub fn subject_alternative_name( &self, ) -> Result<Option<BasicExtension<&SubjectAlternativeName<'a>>>, X509Error>

Available on (crate features rustls or boring or acme) and crate feature rustls only.

Attempt to get the certificate Subject Alternative Name extension

Return Ok(Some(extension)) if exactly one was found, Ok(None) if none was found, or an error if the extension is invalid, or is present twice or more.

pub fn name_constraints( &self, ) -> Result<Option<BasicExtension<&NameConstraints<'_>>>, X509Error>

Available on (crate features rustls or boring or acme) and crate feature rustls only.

Attempt to get the certificate Name Constraints extension

Return Ok(Some(extension)) if exactly one was found, Ok(None) if none was found, or an error if the extension is invalid, or is present twice or more.

pub fn is_ca(&self) -> bool

Available on (crate features rustls or boring or acme) and crate feature rustls only.

Returns true if certificate has basicConstraints CA:true

pub fn raw_serial(&self) -> &'a [u8]

Available on (crate features rustls or boring or acme) and crate feature rustls only.

Get the raw bytes of the certificate serial number

pub fn raw_serial_as_string(&self) -> String

Available on (crate features rustls or boring or acme) and crate feature rustls only.

Get a formatted string of the certificate serial number, separated by ‘:’

pub fn walk<V>(&self, visitor: &mut V)

where V: X509CertificateVisitor,

Available on (crate features rustls or boring or acme) and crate feature rustls only.

Run the provided visitor over the TbsCertificate object

Trait Implementations

impl<'a> AsRef<[u8]> for X509Certificate<'a>

fn as_ref(&self) -> &[u8]

Converts this type into a shared reference of the (usually inferred) input type.

impl<'a> Clone for X509Certificate<'a>

fn clone(&self) -> X509Certificate<'a>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<'a> Debug for X509Certificate<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl<'a> Deref for X509Certificate<'a>

type Target = TbsCertificate<'a>

The resulting type after dereferencing.

fn deref(&self) -> &<X509Certificate<'a> as Deref>::Target

Dereferences the value.

impl<'a> FromDer<'a, X509Error> for X509Certificate<'a>

fn from_der( i: &'a [u8], ) -> Result<(&'a [u8], X509Certificate<'a>), Err<X509Error>>

Parse a DER-encoded X.509 Certificate, and return the remaining of the input and the built object.

The returned object uses zero-copy, and so has the same lifetime as the input.

Note that only parsing is done, not validation.

Certificate  ::=  SEQUENCE  {
        tbsCertificate       TBSCertificate,
        signatureAlgorithm   AlgorithmIdentifier,
        signatureValue       BIT STRING  }

Example

To parse a certificate and print the subject and issuer:

let res = parse_x509_certificate(DER);
match res {
    Ok((_rem, x509)) => {
        let subject = x509.subject();
        let issuer = x509.issuer();
        println!("X.509 Subject: {}", subject);
        println!("X.509 Issuer: {}", issuer);
    },
    _ => panic!("x509 parsing failed: {:?}", res),
}

impl<'a> Parser<&'a [u8], X509Certificate<'a>, X509Error> for X509CertificateParser

fn parse( &mut self, input: &'a [u8], ) -> Result<(&'a [u8], X509Certificate<'a>), Err<X509Error>>

A parser takes in input type, and returns a Result containing either the remaining input and the output value, or an error

fn map<G, O2>(self, g: G) -> Map<Self, G, O>

where G: Fn(O) -> O2, Self: Sized,

Maps a function over the result of a parser

fn flat_map<G, H, O2>(self, g: G) -> FlatMap<Self, G, O>

where G: FnMut(O) -> H, H: Parser<I, O2, E>, Self: Sized,

Creates a second parser from the output of the first one, then apply over the rest of the input

fn and_then<G, O2>(self, g: G) -> AndThen<Self, G, O>

where G: Parser<O, O2, E>, Self: Sized,

Applies a second parser over the output of the first one

fn and<G, O2>(self, g: G) -> And<Self, G>

where G: Parser<I, O2, E>, Self: Sized,

Applies a second parser after the first one, return their results as a tuple

fn or<G>(self, g: G) -> Or<Self, G>

where G: Parser<I, O, E>, Self: Sized,

Applies a second parser over the input if the first one failed

fn into<O2, E2>(self) -> Into<Self, O, O2, E, E2>

where O2: From<O>, E2: From<E>, Self: Sized,

automatically converts the parser’s output and error values to another type, as long as they implement the From trait

impl<'a> PartialEq for X509Certificate<'a>

fn eq(&self, other: &X509Certificate<'a>) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl<'a> StructuralPartialEq for X509Certificate<'a>