Struct WebPkiServerVerifier

pub struct WebPkiServerVerifier { /* private fields */ }

Default ServerCertVerifier, see the trait impl for more information.

Implementations

impl WebPkiServerVerifier

pub fn builder(roots: Arc<RootCertStore>) -> ServerCertVerifierBuilder

Create a builder for the webpki server certificate verifier configuration using the process-default CryptoProvider.

Server certificates will be verified using the trust anchors found in the provided roots.

Use Self::builder_with_provider if you wish to specify an explicit provider.

For more information, see the ServerCertVerifierBuilder documentation.

pub fn builder_with_provider( roots: Arc<RootCertStore>, provider: Arc<CryptoProvider>, ) -> ServerCertVerifierBuilder

Create a builder for the webpki server certificate verifier configuration using a specified CryptoProvider.

Server certificates will be verified using the trust anchors found in the provided roots.

The cryptography used comes from the specified CryptoProvider.

For more information, see the ServerCertVerifierBuilder documentation.

Trait Implementations

impl Debug for WebPkiServerVerifier

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl ServerCertVerifier for WebPkiServerVerifier

fn verify_server_cert( &self, end_entity: &CertificateDer<'_>, intermediates: &[CertificateDer<'_>], server_name: &ServerName<'_>, ocsp_response: &[u8], now: UnixTime, ) -> Result<ServerCertVerified, Error>

Will verify the certificate is valid in the following ways:

• Signed by a trusted RootCertStore CA
• Not Expired
• Valid for DNS entry
• Valid revocation status (if applicable).

Depending on the verifier’s configuration revocation status checking may be performed for each certificate in the chain to a root CA (excluding the root itself), or only the end entity certificate. Similarly, unknown revocation status may be treated as an error or allowed based on configuration.

fn verify_tls12_signature( &self, message: &[u8], cert: &CertificateDer<'_>, dss: &DigitallySignedStruct, ) -> Result<HandshakeSignatureValid, Error>

Verify a signature allegedly by the given server certificate.

fn verify_tls13_signature( &self, message: &[u8], cert: &CertificateDer<'_>, dss: &DigitallySignedStruct, ) -> Result<HandshakeSignatureValid, Error>

Verify a signature allegedly by the given server certificate.

fn supported_verify_schemes(&self) -> Vec<SignatureScheme>

Return the list of SignatureSchemes that this verifier will handle, in verify_tls12_signature and verify_tls13_signature calls.

fn requires_raw_public_keys(&self) -> bool

Returns whether this verifier requires raw public keys as defined in RFC 7250.

fn root_hint_subjects(&self) -> Option<&[DistinguishedName]>

Return the DistinguishedNames of certificate authorities that this verifier trusts.