Struct ClientCertificateDer 

pub struct ClientCertificateDer(pub Vec<u8>);

The DER-encoded bytes of a client certificate presented on the current connection.

Neither authkestra-op nor authkestra-resource terminates TLS itself, so nothing in this crate family populates a ClientCertificateDer automatically. A host application — or the mTLS-terminating layer it runs in front of/alongside its service (a reverse proxy, an axum-server/actix-web rustls acceptor configured to require and expose client certificates, etc.) — is responsible for extracting the peer certificate and handing its DER bytes to this crate:

• On the OP side, authkestra-axum’s axum_token_handler reads one back out of an axum::Extension<ClientCertificateDer> (so a host inserts it as a request extension via its own middleware/acceptor), and authkestra-actix’s actix_token_handler reads one out of the actix request’s own extension map the same way. Both then forward the DER bytes into handle_token_with_client_cert.
• On the resource-server side, JwtStrategy::authenticate looks one up in the http::request::Parts extension map it is handed, when ValidationConfig::require_cert_binding is set.

If nothing ever inserts one, callers simply see None throughout, and client_credentials tokens are issued as plain (unbound) bearer tokens, same as before this existed.

The source of these bytes is the entire security boundary

Inserting a ClientCertificateDer from a source that has not cryptographically verified the certificate — i.e. actually terminated mTLS and validated the chain — provides no security benefit and a false sense of one.

Nothing here parses X.509, validates a chain, or checks that these bytes are even DER; x5t_s256_thumbprint hashes whatever it is handed. So a binding built from, say, a reverse-proxy header that relays a client-supplied value the proxy never verified degrades to “proof that the caller knows a byte string the caller chose” — while looking identical to a real RFC 8705 binding: a cnf.x5t#S256 claim is present and require_cert_binding accepts it. Issuance and verification trust the same extension, so both fail together, and silently.

Tuple Fields

0: Vec<u8>

Trait Implementations

impl Clone for ClientCertificateDer

fn clone(&self) -> ClientCertificateDer

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ClientCertificateDer

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for ClientCertificateDer

impl PartialEq for ClientCertificateDer

fn eq(&self, other: &ClientCertificateDer) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for ClientCertificateDer