Struct ServerCertVerifierBuilder

pub struct ServerCertVerifierBuilder { /* private fields */ }

A builder for configuring a webpki server certificate verifier.

For more information, see the WebPkiServerVerifier documentation.

Implementations

impl ServerCertVerifierBuilder

pub fn with_crls( self, crls: impl IntoIterator<Item = CertificateRevocationListDer<'static>>, ) -> Self

Verify the revocation state of presented client certificates against the provided certificate revocation lists (CRLs). Calling with_crls multiple times appends the given CRLs to the existing collection.

pub fn only_check_end_entity_revocation(self) -> Self

Only check the end entity certificate revocation status when using CRLs.

If CRLs are provided using with_crls only check the end entity certificate’s revocation status. Overrides the default behavior of checking revocation status for each certificate in the verified chain built to a trust anchor (excluding the trust anchor itself).

If no CRLs are provided then this setting has no effect. Neither the end entity certificate or any intermediates will have revocation status checked.

pub fn allow_unknown_revocation_status(self) -> Self

Allow unknown certificate revocation status when using CRLs.

If CRLs are provided with with_crls and it isn’t possible to determine the revocation status of a certificate, do not treat it as an error condition. Overrides the default behavior where unknown revocation status is considered an error.

If no CRLs are provided then this setting has no effect as revocation status checks are not performed.

pub fn enforce_revocation_expiration(self) -> Self

Enforce the CRL nextUpdate field (i.e. expiration)

If CRLs are provided with with_crls and the verification time is beyond the time in the CRL nextUpdate field, it is expired and treated as an error condition. Overrides the default behavior where expired CRLs are not treated as an error condition.

If no CRLs are provided then this setting has no effect as revocation status checks are not performed.

pub fn build(self) -> Result<Arc<WebPkiServerVerifier>, VerifierBuilderError>

Build a server certificate verifier, allowing control over the root certificates to use as trust anchors, and to control how server certificate revocation checking is performed.

If with_signature_verification_algorithms was not called on the builder, a default set of signature verification algorithms is used, controlled by the selected crypto::CryptoProvider.

Once built, the provided Arc<dyn ServerCertVerifier> can be used with a Rustls ServerConfig to configure client certificate validation using with_client_cert_verifier.

Errors

This function will return a VerifierBuilderError if:

1. No trust anchors have been provided.
2. DER encoded CRLs have been provided that can not be parsed successfully.

Trait Implementations

impl Clone for ServerCertVerifierBuilder

fn clone(&self) -> ServerCertVerifierBuilder

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ServerCertVerifierBuilder

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

Layout

Note: Most layout information is completely unstable and may even differ between compilations. The only exception is types with certain repr(...) attributes. Please see the Rust Reference's “Type Layout” chapter for details on type layout guarantees.

Size: 72 bytes