Struct LocalCaConfig 

pub struct LocalCaConfig {
    pub cert_path: String,
    pub key_path: String,
    pub key_type: String,
    pub leaf_validity_days: u64,
    pub crl_path: String,
    pub crl_distribution_points: Vec<String>,
    pub ca_issuer_urls: Vec<String>,
    pub subject: LocalCaSubjectConfig,
    pub key_source: String,
    pub pkcs11: Pkcs11Config,
}

Configuration for the persistent local-CA signer backend.

Fields

cert_path: String

key_path: String

key_type: String

leaf_validity_days: u64

crl_path: String

crl_distribution_points: Vec<String>

Where a relying party can fetch the CRL, written into every issued leaf as cRLDistributionPoints (RFC 5280 §4.2.1.13). Empty (the default) emits no extension at all.

Not derived from server.base_url: the value is frozen into every certificate signed while it is set, so a base_url change or a profile rename would silently break certificates already issued — and the per-profile /crl sits behind that profile’s filter chain, which an address-based policy will refuse to a relying party. Several entries mean one CRL reachable at several places, not several CRLs.

Validated (and encoded) in LocalCa::load_or_generate, not here: the list-key round-trip test feeds placeholder values through every entry of LIST_KEYS.

ca_issuer_urls: Vec<String>

Where a relying party can fetch this CA’s own certificate, written into every issued leaf as authorityInfoAccess / caIssuers (RFC 5280 §4.2.2.1). Empty (the default) emits no extension at all. Same “operator names it, nothing derives it” reasoning as crl_distribution_points above.

subject: LocalCaSubjectConfig

Overrides for the autogenerated CA’s own X.509 Subject. Read only when the CA is generated (no existing cert_path/key_path) — an already-on-disk CA’s Subject is whatever it already has, re-signing nothing.

key_source: String

Where the issuing private key lives: "file" (the default, and the only behaviour that existed before this key) or "pkcs11".

A selector string rather than a pkcs11.enabled flag, matching signer.backend and signer.relay.challenge_strategy: it makes “both configured” unrepresentable instead of a precedence rule.

pkcs11: Pkcs11Config

The token to sign with when key_source = "pkcs11". Ignored otherwise — Config cannot tell an unset table from a defaulted one, so validation lives in LocalCa::load_or_generate, where the selector that makes these fields required is also in scope.

Trait Implementations

impl Clone for LocalCaConfig

fn clone(&self) -> LocalCaConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for LocalCaConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for LocalCaConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for LocalCaConfig

where LocalCaConfig: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.