x509/
x509.rs

1//! X.509 example — build a self-signed certificate and inspect its fields.
2//!
3//! Run with: cargo run --example x509 -p native-ossl
4
5use native_ossl::pkey::KeygenCtx;
6use native_ossl::x509::{X509Builder, X509NameOwned};
7
8fn main() -> Result<(), Box<dyn std::error::Error>> {
9    // ── Generate an Ed25519 key pair ──────────────────────────────────────────
10
11    let mut kgen = KeygenCtx::new(c"ED25519")?;
12    let priv_key = kgen.generate()?;
13    let pub_key = native_ossl::pkey::Pkey::<native_ossl::pkey::Public>::from(priv_key.clone());
14
15    // ── Build a self-signed certificate ──────────────────────────────────────
16
17    let mut name = X509NameOwned::new()?;
18    name.add_entry_by_txt(c"CN", b"example.com")?;
19    name.add_entry_by_txt(c"O", b"Example Org")?;
20    name.add_entry_by_txt(c"C", b"US")?;
21
22    let cert = X509Builder::new()?
23        .set_version(2)? // X.509 v3
24        .set_serial_number(42)?
25        .set_not_before_offset(0)? // valid from now
26        .set_not_after_offset(365 * 86400)? // valid for 1 year
27        .set_subject_name(&name)?
28        .set_issuer_name(&name)? // self-signed
29        .set_public_key(&pub_key)?
30        .sign(&priv_key, None)? // Ed25519 (no explicit digest needed)
31        .build();
32
33    // ── Inspect fields ────────────────────────────────────────────────────────
34
35    if let Some(subject) = cert.subject_name().to_string() {
36        println!("Subject:  {subject}");
37    }
38    if let Some(issuer) = cert.issuer_name().to_string() {
39        println!("Issuer:   {issuer}");
40    }
41    if let Some(serial) = cert.serial_number() {
42        println!("Serial:   {serial}");
43    }
44    if let Some(nb) = cert.not_before_str() {
45        println!("NotBefore: {nb}");
46    }
47    if let Some(na) = cert.not_after_str() {
48        println!("NotAfter:  {na}");
49    }
50    println!("Valid now: {}", cert.is_valid_now());
51    println!("Self-signed: {}", cert.is_self_signed());
52
53    // ── DER round-trip ────────────────────────────────────────────────────────
54
55    let der = cert.to_der()?;
56    let reloaded = native_ossl::x509::X509::from_der(&der)?;
57    assert_eq!(cert.to_der()?, reloaded.to_der()?);
58    println!("DER round-trip: OK ({} bytes)", der.len());
59
60    // ── PEM output ────────────────────────────────────────────────────────────
61
62    let pem = cert.to_pem()?;
63    println!("\nPEM certificate:\n{}", std::str::from_utf8(&pem)?);
64
65    // ── Signature verification ────────────────────────────────────────────────
66
67    cert.verify(&pub_key)?;
68    println!("Signature verification: OK");
69
70    Ok(())
71}
x509/x509.rs

x509/
x509.rs
