Struct MtlsClientVerifier 

pub struct MtlsClientVerifier { /* private fields */ }

Custom client certificate verifier with revocation checking

Implementations

impl MtlsClientVerifier

pub fn new(roots: RootCertStore) -> Self

Create a new client verifier

pub fn with_mapper(self, mapper: Arc<dyn PrincipalMapper>) -> Self

Set the principal mapper

pub fn with_revocation(self, checker: Arc<dyn RevocationChecker>) -> Self

Set the revocation checker

pub fn optional_auth(self) -> Self

Make client authentication optional

pub fn allow_principal(self, pattern: impl Into<String>) -> Self

Add allowed principal pattern

Trait Implementations

impl ClientCertVerifier for MtlsClientVerifier

fn root_hint_subjects(&self) -> &[DistinguishedName]

Returns the DistinguishedName subjects that the server will hint to clients to identify acceptable authentication trust anchors.

fn verify_client_cert( &self, end_entity: &CertificateDer<'_>, _intermediates: &[CertificateDer<'_>], _now: UnixTime, ) -> Result<ClientCertVerified, Error>

Verify the end-entity certificate end_entity is valid, acceptable, and chains to at least one of the trust anchors trusted by this verifier.

fn verify_tls12_signature( &self, _message: &[u8], _cert: &CertificateDer<'_>, _dss: &DigitallySignedStruct, ) -> Result<HandshakeSignatureValid, Error>

Verify a signature allegedly by the given client certificate.

fn verify_tls13_signature( &self, _message: &[u8], _cert: &CertificateDer<'_>, _dss: &DigitallySignedStruct, ) -> Result<HandshakeSignatureValid, Error>

Verify a signature allegedly by the given client certificate.

fn supported_verify_schemes(&self) -> Vec<SignatureScheme>

Return the list of SignatureSchemes that this verifier will handle, in verify_tls12_signature and verify_tls13_signature calls.

fn client_auth_mandatory(&self) -> bool

Return true to require a client certificate and false to make client authentication optional. Defaults to self.offer_client_auth().

fn offer_client_auth(&self) -> bool

Returns true to enable the server to request a client certificate and false to skip requesting a client certificate. Defaults to true.

fn requires_raw_public_keys(&self) -> bool

Returns whether this verifier requires raw public keys as defined in RFC 7250.

impl Debug for MtlsClientVerifier

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.