Struct RemoteCertStore 

pub struct RemoteCertStore<B> { /* private fields */ }

Complete resources live in a blob service; certificate/key/metadata refs live in the supplied coordinator. Use a unique namespace for each remote location/account/bucket/mount, identically configured on every node.

Guarded operations retain the coordinator’s fencing guarantees. Legacy save/remove remain administrative, unfenced operations. Private-key moves remove the current key reference, not immutable/history bytes; retention and garbage collection require a separate explicit operational policy.

Implementations

impl<B: ImmutableBlobStore> RemoteCertStore<B>

pub fn new( backend: B, coordinator: Arc<dyn Storage>, namespace: impl Into<String>, ) -> Result<Arc<Self>>

Bind a remote object location to its authoritative manifest namespace. Passing a different location under the same namespace is a deployment configuration error. This constructor performs no network operations.

pub async fn load_archived_private_key( &self, destination: &str, ) -> Result<Option<Vec<u8>>>

Resolve a logical archive destination and return only its private key. Immutable historical blobs remain retained separately from live refs.

Trait Implementations

impl<B: ImmutableBlobStore> CertStore for RemoteCertStore<B>

fn validate_write_guard(&self, guard: &LockGuard) -> Result<()>

Check whether this destination can honor an acquisition’s write fence. Config calls this before CA work. Custom stores default to refusing fenced guards; accepting one requires atomic guarded implementations.

fn load<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, issuer: &'life1 str, domain: &'life2 str, ) -> Pin<Box<dyn Future<Output = Result<Option<CertificateResource>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Load a resource, returning Ok(None) when the complete resource is absent.

fn save<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, issuer: &'life1 str, domain: &'life2 str, resource: &'life3 CertificateResource, ) -> Pin<Box<dyn Future<Output = Result<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

Save certificate PEM, private key PEM and metadata for a domain.

fn save_with_lock<'life0, 'life1, 'life2, 'life3, 'life4, 'async_trait>( &'life0 self, issuer: &'life1 str, domain: &'life2 str, resource: &'life3 CertificateResource, guard: &'life4 LockGuard, ) -> Pin<Box<dyn Future<Output = Result<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait, 'life4: 'async_trait,

Publish a complete resource while atomically validating ownership when the guard requires it. The default only supports unfenced guards.

fn has<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, issuer: &'life1 str, domain: &'life2 str, ) -> Pin<Box<dyn Future<Output = Result<bool>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Return whether a complete resource exists.

fn remove<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, issuer: &'life1 str, domain: &'life2 str, ) -> Pin<Box<dyn Future<Output = Result<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Remove the complete resource. Missing resources are not an error.

fn move_private_key<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, issuer: &'life1 str, domain: &'life2 str, destination: &'life3 str, ) -> Pin<Box<dyn Future<Output = Result<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

Move only the private key to destination_key, removing the source key. Existing destination values must not be overwritten. A canonical self move is a no-op; descendants of the source must remain untouched.

fn move_private_key_with_lock<'life0, 'life1, 'life2, 'life3, 'life4, 'async_trait>( &'life0 self, issuer: &'life1 str, domain: &'life2 str, destination: &'life3 str, guard: &'life4 LockGuard, ) -> Pin<Box<dyn Future<Output = Result<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait, 'life4: 'async_trait,

Archive/remove a compromised private key under the same ownership contract as publication. The default only supports unfenced guards.

impl<B: ImmutableBlobStore> Debug for RemoteCertStore<B>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.