Struct WebPkiServerVerifier

pub struct WebPkiServerVerifier {
    roots: Arc<RootCertStore>,
    crls: Vec<CertRevocationList<'static>>,
    revocation_check_depth: RevocationCheckDepth,
    unknown_revocation_policy: UnknownStatusPolicy,
    revocation_expiration_policy: ExpirationPolicy,
    supported: WebPkiSupportedAlgorithms,
}

Default ServerCertVerifier, see the trait impl for more information.

Fields

roots: Arc<RootCertStore>

crls: Vec<CertRevocationList<'static>>

revocation_check_depth: RevocationCheckDepth

unknown_revocation_policy: UnknownStatusPolicy

revocation_expiration_policy: ExpirationPolicy

supported: WebPkiSupportedAlgorithms

Implementations

impl WebPkiServerVerifier

pub fn builder(roots: Arc<RootCertStore>) -> ServerCertVerifierBuilder

Create a builder for the webpki server certificate verifier configuration using the process-default CryptoProvider.

Server certificates will be verified using the trust anchors found in the provided roots.

Use Self::builder_with_provider if you wish to specify an explicit provider.

For more information, see the ServerCertVerifierBuilder documentation.

pub fn builder_with_provider( roots: Arc<RootCertStore>, provider: Arc<CryptoProvider>, ) -> ServerCertVerifierBuilder

Create a builder for the webpki server certificate verifier configuration using a specified CryptoProvider.

Server certificates will be verified using the trust anchors found in the provided roots.

The cryptography used comes from the specified CryptoProvider.

For more information, see the ServerCertVerifierBuilder documentation.

pub(crate) fn new_without_revocation( roots: impl Into<Arc<RootCertStore>>, supported_algs: WebPkiSupportedAlgorithms, ) -> Self

Short-cut for creating a WebPkiServerVerifier that does not perform certificate revocation checking, avoiding the need to use a builder.

pub(crate) fn new( roots: impl Into<Arc<RootCertStore>>, crls: Vec<CertRevocationList<'static>>, revocation_check_depth: RevocationCheckDepth, unknown_revocation_policy: UnknownStatusPolicy, revocation_expiration_policy: ExpirationPolicy, supported: WebPkiSupportedAlgorithms, ) -> Self

Constructs a new WebPkiServerVerifier.

• roots is the set of trust anchors to trust for issuing server certs.
• crls are a vec of owned certificate revocation lists (CRLs) to use for client certificate validation.
• revocation_check_depth controls which certificates have their revocation status checked when crls are provided.
• unknown_revocation_policy controls how certificates with an unknown revocation status are handled when crls are provided.
• supported is the set of supported algorithms that will be used for certificate verification and TLS handshake signature verification.

Trait Implementations

impl Debug for WebPkiServerVerifier

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl ServerCertVerifier for WebPkiServerVerifier

fn verify_server_cert( &self, end_entity: &CertificateDer<'_>, intermediates: &[CertificateDer<'_>], server_name: &ServerName<'_>, ocsp_response: &[u8], now: UnixTime, ) -> Result<ServerCertVerified, Error>

Will verify the certificate is valid in the following ways:

• Signed by a trusted RootCertStore CA
• Not Expired
• Valid for DNS entry
• Valid revocation status (if applicable).

Depending on the verifier’s configuration revocation status checking may be performed for each certificate in the chain to a root CA (excluding the root itself), or only the end entity certificate. Similarly, unknown revocation status may be treated as an error or allowed based on configuration.

fn verify_tls12_signature( &self, message: &[u8], cert: &CertificateDer<'_>, dss: &DigitallySignedStruct, ) -> Result<HandshakeSignatureValid, Error>

Verify a signature allegedly by the given server certificate.

fn verify_tls13_signature( &self, message: &[u8], cert: &CertificateDer<'_>, dss: &DigitallySignedStruct, ) -> Result<HandshakeSignatureValid, Error>

Verify a signature allegedly by the given server certificate.

fn supported_verify_schemes(&self) -> Vec<SignatureScheme>

Return the list of SignatureSchemes that this verifier will handle, in verify_tls12_signature and verify_tls13_signature calls.

fn requires_raw_public_keys(&self) -> bool

Returns whether this verifier requires raw public keys as defined in RFC 7250.

fn root_hint_subjects(&self) -> Option<&[DistinguishedName]>

Return the DistinguishedNames of certificate authorities that this verifier trusts.