Crate cacrt 

cacrt — curated, no_std/no-alloc access to DER-encoded CA root certificates by their OpenSSL subject hash.

The crate embeds a curated set of trusted root CA certificates (see CURATION.md for the acceptance rules) and exposes a tiny, allocation-free API to look them up and iterate over them. All parsing, hashing and curation happen at build time; at runtime this crate is pure &'static data and integer comparisons.

OpenSSL hash names

Certificates are addressable by the same name OpenSSL’s c_rehash/openssl rehash uses for files in a hash directory, e.g. "062cdee6.0". The eight hex digits are the subject-name hash (SHA-1 over the canonicalized subject, first four bytes little-endian) and the trailing number disambiguates certificates that share a subject hash.

// Look one up by its OpenSSL hash name.
if let Some(ca) = cacrt::lookup("062cdee6.0") {
    assert_eq!(ca.subject_hash(), 0x062cdee6);
    let _der: &[u8] = ca.der();
}

// Iterate over every embedded CA.
for ca in cacrt::all() {
    let _ = (ca.subject_hash(), ca.label());
}

Building certificate chains

To find the issuer of a certificate without hashing at runtime, match the issuer’s raw DER Name against each CA’s subject with find_by_subject.

Blocklist

Some certificates must never be trusted, even when another trust store (the operating system’s, say) still contains them: intermediates whose private keys were compromised, and roots that cacrt has disabled. blocked lists them, keyed by the SHA-256 of the certificate and of its SubjectPublicKeyInfo.

Your verifier must check every certificate in the chain, including the root, against it, after building and verifying the path. Checking the root is what protects you when it comes from another store: a root cacrt has disabled is still blocked, even if the OS still trusts it. Match on the key (blocked_by_spki) rather than only the certificate: a compromised key is usually certified more than once (cross-signs, reissues).

// SHA-256 of the DER `SubjectPublicKeyInfo`, computed by your TLS library.
if let Some(b) = cacrt::blocked_by_spki(&spki_sha256) {
    panic!("blocked: {} ({})", b.label(), b.reason());
}

Structs

Blocked

A certificate that must not be trusted, wherever it is found.

Cert

A single embedded CA root certificate.

HashName

The OpenSSL hash name of a certificate, formatted on demand as "%08x.%d".

Enums

BlockedKind

Whether a blocked certificate is a root (self-issued) or an intermediate.

Functions

all

All embedded CA certificates, sorted by subject hash then sequence number.

blocked

Every blocked certificate, sorted by SPKI SHA-256 then certificate SHA-256.

blocked_by_cert

The blocked entry for the certificate whose DER has this SHA-256, if any.

blocked_by_spki

The first blocked entry whose SubjectPublicKeyInfo has this SHA-256, if any. A match means the key itself is distrusted, so every certificate carrying it must be rejected, including ones not listed in blocked.

find_by_subject

All certificates whose subject Name exactly equals subject_der (the raw DER SEQUENCE). Useful for resolving an issuer during chain building without hashing at runtime.

len

Number of embedded CA certificates.

lookup

Look up a certificate by its OpenSSL hash name, e.g. "062cdee6.0".

lookup_by_hash

Every certificate sharing the given subject hash, as a contiguous slice (empty if none). Within the slice, entries are ordered by sequence number.