Module cert 

Small X.509 helpers shared by the certificate revocation paths: the ACME POST /revokeCert handler (handlers::post_revoke_cert) and the order revoke admin CLI command (admin::revoke_order). Both need to pull a certificate’s serial/public key out of raw DER, and pull the leaf back out of a stored leaf + CA PEM chain, so the parsing lives here once rather than twice.

Structs

AriCertId

The two halves of an ACME Renewal Information certID (RFC 9773 §4.1), decoded: base64url(AKI keyIdentifier) "." base64url(serial).

Constants

ALLOWED_REVOCATION_REASONS

RFC 5280 §5.3.1 CRLReason codes RFC 8555 §7.6 permits in a revocation request’s reason — every value except the reserved 7. Shared with rcgen::RevocationReason’s own numbering (see signer::local_ca).

Functions

ari_cert_id

The ACME Renewal Information certificate identifier (RFC 9773 §4.1) for a DER-encoded certificate: base64url(AKI keyIdentifier) || "." || base64url(serial), both unpadded.

ari_cert_id_parts

The raw (AKI keyIdentifier, serial) bytes behind ari_cert_id, for callers that want to compare the halves rather than the rendered string.

cert_serial_and_spki

Extracts a single certificate’s serial (hex-encoded, no separators) and the DER encoding of its SubjectPublicKeyInfo from raw X.509 DER bytes.

cert_validity

Extracts the validity period (notBefore, notAfter) from a DER-encoded certificate as UNIX timestamps (seconds since epoch).

is_valid_revocation_reason

Whether reason is one of the CRLReason codes RFC 8555 §7.6 permits.

issuer_id

The identity a local CA’s revocation state is stored under: lowercase hex SHA-256 of the CA certificate’s SubjectPublicKeyInfo DER.

leaf_der_from_chain

Extracts the leaf certificate’s DER bytes from a leaf + CA PEM chain (the shape SignerBackend::issue returns and orders.certificate stores) — the first CERTIFICATE block, mirroring crate::pemfile::read_certificates’s label-agnostic PEM iterator.

normalize_serial

Folds an operator-supplied certificate serial into the form the column holds: lowercase hex, no separators.

parse_ari_cert_id

Parses an inbound certID (RFC 9773 §4.1).

subject_key_identifier

A certificate’s SubjectKeyIdentifier extension, when it carries one.