Trait rustls::server::ClientCertVerifier
source · [−]pub trait ClientCertVerifier: Send + Sync {
fn client_auth_root_subjects(&self) -> Option<DistinguishedNames>;
fn verify_client_cert(
&self,
end_entity: &Certificate,
intermediates: &[Certificate],
now: SystemTime
) -> Result<ClientCertVerified, Error>;
fn offer_client_auth(&self) -> bool { ... }
fn client_auth_mandatory(&self) -> Option<bool> { ... }
fn verify_tls12_signature(
&self,
message: &[u8],
cert: &Certificate,
dss: &DigitallySignedStruct
) -> Result<HandshakeSignatureValid, Error> { ... }
fn verify_tls13_signature(
&self,
message: &[u8],
cert: &Certificate,
dss: &DigitallySignedStruct
) -> Result<HandshakeSignatureValid, Error> { ... }
fn supported_verify_schemes(&self) -> Vec<SignatureScheme> { ... }
}
Expand description
Something that can verify a client certificate chain
Required methods
fn client_auth_root_subjects(&self) -> Option<DistinguishedNames>
fn client_auth_root_subjects(&self) -> Option<DistinguishedNames>
Returns the subject names of the client authentication trust anchors to share with the client when requesting client authentication.
Return None
to abort the connection. Return an empty Vec
to continue
the handshake without passing a list of CA DNs.
fn verify_client_cert(
&self,
end_entity: &Certificate,
intermediates: &[Certificate],
now: SystemTime
) -> Result<ClientCertVerified, Error>
fn verify_client_cert(
&self,
end_entity: &Certificate,
intermediates: &[Certificate],
now: SystemTime
) -> Result<ClientCertVerified, Error>
Verify the end-entity certificate end_entity
is valid for the
and chains to at least one of the trust anchors in roots
.
intermediates
contains the intermediate certificates the
client sent along with the end-entity certificate; it is in the same
order that the peer sent them and may be empty.
Provided methods
fn offer_client_auth(&self) -> bool
fn offer_client_auth(&self) -> bool
Returns true
to enable the server to request a client certificate and
false
to skip requesting a client certificate. Defaults to true
.
fn client_auth_mandatory(&self) -> Option<bool>
fn client_auth_mandatory(&self) -> Option<bool>
Return Some(true)
to require a client certificate and Some(false)
to make
client authentication optional. Return None
to abort the connection.
Defaults to Some(self.offer_client_auth())
.
fn verify_tls12_signature(
&self,
message: &[u8],
cert: &Certificate,
dss: &DigitallySignedStruct
) -> Result<HandshakeSignatureValid, Error>
fn verify_tls12_signature(
&self,
message: &[u8],
cert: &Certificate,
dss: &DigitallySignedStruct
) -> Result<HandshakeSignatureValid, Error>
Verify a signature allegedly by the given server certificate.
message
is not hashed, and needs hashing during the verification.
The signature and algorithm are within dss
. cert
contains the
public key to use.
cert
is the same certificate that was previously validated by a
call to verify_server_cert
.
If and only if the signature is valid, return HandshakeSignatureValid. Otherwise, return an error – rustls will send an alert and abort the connection.
This method is only called for TLS1.2 handshakes. Note that, in TLS1.2,
SignatureSchemes such as SignatureScheme::ECDSA_NISTP256_SHA256
are not
in fact bound to the specific curve implied in their name.
This trait method has a default implementation that uses webpki to verify the signature.
fn verify_tls13_signature(
&self,
message: &[u8],
cert: &Certificate,
dss: &DigitallySignedStruct
) -> Result<HandshakeSignatureValid, Error>
fn verify_tls13_signature(
&self,
message: &[u8],
cert: &Certificate,
dss: &DigitallySignedStruct
) -> Result<HandshakeSignatureValid, Error>
Verify a signature allegedly by the given server certificate.
This method is only called for TLS1.3 handshakes.
This method is very similar to verify_tls12_signature
: but note the
tighter ECDSA SignatureScheme semantics – e.g. SignatureScheme::ECDSA_NISTP256_SHA256
must only validate signatures using public keys on the right curve –
rustls does not enforce this requirement for you.
This trait method has a default implementation that uses webpki to verify the signature.
fn supported_verify_schemes(&self) -> Vec<SignatureScheme>
fn supported_verify_schemes(&self) -> Vec<SignatureScheme>
Return the list of SignatureSchemes that this verifier will handle,
in verify_tls12_signature
and verify_tls13_signature
calls.
This should be in priority order, with the most preferred first.
This trait method has a default implementation that reflects the schemes supported by webpki.