Struct Revocation 

pub struct Revocation {
    pub issuer: String,
    pub serial: String,
    pub revoked_at: i64,
    pub reason: Option<u32>,
    pub not_after: Option<i64>,
}

One revoked certificate.

Fields

issuer: String

The CA that issued it: hex SHA-256 of that CA’s SubjectPublicKeyInfo.

serial: String

The certificate’s serial, hex, as orders.cert_serial stores it.

revoked_at: i64

Epoch seconds.

reason: Option<u32>

RFC 5280 §5.3.1 CRLReason code.

not_after: Option<i64>

The certificate’s own notAfter, epoch seconds. None is never pruned.

Implementations

impl Revocation

pub async fn insert_if_absent<'e>( &self, executor: impl Into<Exec<'e>>, ) -> Result<bool, Error>

Records the revocation unless this serial is already revoked under this issuer, answering whether a row was written.

The first revocation wins: a repeat changes neither its time nor its reason, the rule the file-backed ledger’s merge kept too.

pub async fn list_for_issuer<'e>( issuer: &str, executor: impl Into<Exec<'e>>, ) -> Result<Vec<Self>, Error>

Every revocation recorded under issuer, oldest first.

pub async fn count_expired( issuer: &str, cutoff: i64, listed_before: i64, database: &Database, ) -> Result<u64, Error>

How many revocations under issuer Self::prune_expired would delete for the same pair of bounds.

pub async fn prune_expired<'e>( issuer: &str, cutoff: i64, listed_before: i64, executor: impl Into<Exec<'e>>, ) -> Result<u64, Error>

Deletes the revocations under issuer whose certificates expired before cutoff, and which a CRL issued at or after listed_before already carried (RFC 5280 §3.3), returning how many went.

A row with no not_after is never deleted: an unknown expiry is not an expired one. The caller backdates cutoff by the clock-skew allowance.

listed_before is the stored CRL’s thisUpdate, and the second bound is what §3.3 actually asks for: an entry “MUST NOT be removed from the CRL until it appears on one regularly scheduled CRL issued beyond the revoked certificate’s validity period”. A certificate that expired an hour ago has not yet appeared on any such CRL, so dropping it here would leave a relying party holding the last CRL that listed it — signed before the expiry — with nothing to replace it.

The revoked_at bound is inclusive: the CRL is signed from the rows as they stand when it is built, so an entry stamped in the same second is one it carries. An entry recorded in that second but after the snapshot could be dropped without having been listed, and only if it is also already expired — a revocation of a certificate nothing would honour anyway.

Trait Implementations

impl Clone for Revocation

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Revocation

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for Revocation

impl PartialEq for Revocation

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for Revocation