Struct Policy 

pub struct Policy {
    pub renewal_window_ratio: f64,
    pub key_type: KeyType,
    pub must_staple: bool,
    pub reuse_private_keys: bool,
    pub disable_ari: bool,
    pub issuer_policy: IssuerPolicy,
    pub ocsp: OcspConfig,
    pub default_server_name: Option<String>,
    pub fallback_server_name: Option<String>,
    pub disable_storage_check: bool,
    pub interactive: bool,
}

The settings that decide how certificates are obtained, renewed and served.

Every field is a value with a default. Construct it directly, or let CertManager::builder set the fields one at a time.

use certon::{KeyType, Policy};

let policy = Policy {
    // Renew once two thirds of the lifetime has gone.
    renewal_window_ratio: 1.0 / 3.0,
    key_type: KeyType::EcdsaP384,
    ..Policy::default()
};
assert_eq!(policy.key_type, KeyType::EcdsaP384);

Fields

renewal_window_ratio: f64

The fraction of a certificate’s lifetime that must remain before it is left alone. 1.0 / 3.0 means “renew when a third of the life is left”. Non-positive values select the default. Values must be finite and no greater than one; Self::validate checks external configuration.

key_type: KeyType

The kind of private key generated for a new certificate.

must_staple: bool

Ask for the OCSP Must-Staple extension on new certificates.

Only turn this on if stapling is reliable: a certificate with Must-Staple and no staple is rejected by clients that honour it.

reuse_private_keys: bool

Renew onto the existing private key instead of generating a new one.

Needed for HPKP-style pinning, and a liability otherwise: a key that is never rotated is a key that is compromised for longer.

disable_ari: bool

Ignore the ACME Renewal Information extension and renew on the ratio alone, even when the certificate authority has said when to come back.

issuer_policy: IssuerPolicy

How to choose among several issuers.

ocsp: OcspConfig

OCSP stapling.

default_server_name: Option<String>

The name to assume when a TLS client sends no SNI.

fallback_server_name: Option<String>

The name to fall back to when no certificate matches the SNI that was sent.

disable_storage_check: bool

Skip the storage health probe at start-up.

interactive: bool

Whether a person is waiting for the result.

This decides two things, and it is worth being explicit about both because the name only suggests one:

• A failure is returned straight away rather than retried with backoff. Somebody watching a terminal wants the error, not a wait.
• Checks that may ask a question, such as agreeing to a certificate authority’s terms, are permitted.

Leave it false in a server. A background renewal that gives up on the first network blip is worse than one that waits.

Implementations

impl Policy

pub fn validate(&self) -> Result<()>

Validate settings before starting certificate operations.

A non-positive renewal ratio selects the default. Positive ratios must be at most one, and all ratios must be finite.

Trait Implementations

impl Clone for Policy

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Policy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Policy

fn default() -> Self

Returns the “default value” for a type.

impl PartialEq for Policy

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for Policy