Module cert_binding 

RFC 8705 §3 certificate-bound access tokens.

This module computes the cnf.x5t#S256 confirmation value — the base64url (no padding) SHA-256 thumbprint of a client’s DER-encoded X.509 certificate — and nothing more. It does not parse X.509, does not terminate TLS, and does not validate a certificate chain: extracting the actual peer certificate presented on a live mTLS connection is a framework/deployment concern, deliberately left outside this framework-agnostic crate (see ClientCertificateDer’s doc comment for where that hand-off happens today).

Consumed by authkestra-op::handlers::token::handle_client_credentials (to stamp cnf.x5t#S256 at issuance) and by authkestra-resource::jwt::JwtStrategy (to verify a presented certificate against it) — see issue #224.

Structs

ClientCertificateDer

The DER-encoded bytes of a client certificate presented on the current connection.

Functions

constant_time_eq

Constant-time comparison of two x5t#S256 thumbprints (or any two strings) — a short, dependency-free byte-XOR loop rather than pulling in subtle for a single fixed-length string comparison. Mirrors authkestra_op::attestation::constant_time_eq, used for the analogous cnf.jkt device-attestation check.

x5t_s256_thumbprint

Computes the RFC 8705 §3 x5t#S256 confirmation value: base64url (no padding) of the SHA-256 digest of the DER-encoded certificate.