Skip to main content

TlsServerCertChainPolicy

rama::tls::client

Trait TlsServerCertChainPolicy 

pub trait TlsServerCertChainPolicy:
    Debug
    + Send
    + Sync
    + 'static {
    // Required method
    fn check(
        &self,
        chain: &ServerCertChain<'_>,
    ) -> Result<(), Box<dyn Error + Send + Sync>>;
}
Available on crate feature tls only.
Expand description

A reject-only check of the server certificate chain.

The policy runs after the certificate verifier accepted the chain, for every ServerTrustSource, and also when server verification is disabled. It can therefore only reject a connection, never accept a chain the verifier refused.

A resumed session is bound to the policy it was established under. The BoringSSL backend checks the session’s stored chain against the policy again on resumption; the rustls backend resumes without a new check, as TLS does for verification in general.

Required Methods§

fn check( &self, chain: &ServerCertChain<'_>, ) -> Result<(), Box<dyn Error + Send + Sync>>

Return an error to reject chain.

Dyn Compatibility§

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors§