Struct rustls::client::WebPkiVerifier

pub struct WebPkiVerifier { /* private fields */ }

Default ServerCertVerifier, see the trait impl for more information.

Implementations

impl WebPkiVerifier

pub fn new(
    roots: RootCertStore,
    ct_policy: Option<CertificateTransparencyPolicy>
) -> Self

Constructs a new WebPkiVerifier.

roots is the set of trust anchors to trust for issuing server certs.

ct_logs is the list of logs that are trusted for Certificate Transparency. Currently CT log enforcement is opportunistic; see https://github.com/rustls/rustls/issues/479.

pub fn verification_schemes() -> Vec<SignatureScheme>

Returns the signature verification methods supported by webpki.

Trait Implementations

impl ServerCertVerifier for WebPkiVerifier

fn verify_server_cert(
    &self,
    end_entity: &Certificate,
    intermediates: &[Certificate],
    server_name: &ServerName,
    scts: &mut dyn Iterator<Item = &[u8]>,
    ocsp_response: &[u8],
    now: SystemTime
) -> Result<ServerCertVerified, Error>

Will verify the certificate is valid in the following ways:

• Signed by a trusted RootCertStore CA
• Not Expired
• Valid for DNS entry

fn verify_tls12_signature(
    &self,
    message: &[u8],
    cert: &Certificate,
    dss: &DigitallySignedStruct
) -> Result<HandshakeSignatureValid, Error>

Verify a signature allegedly by the given server certificate.

fn verify_tls13_signature(
    &self,
    message: &[u8],
    cert: &Certificate,
    dss: &DigitallySignedStruct
) -> Result<HandshakeSignatureValid, Error>

Verify a signature allegedly by the given server certificate.

fn supported_verify_schemes(&self) -> Vec<SignatureScheme>

Return the list of SignatureSchemes that this verifier will handle, in verify_tls12_signature and verify_tls13_signature calls.

fn request_scts(&self) -> bool

Returns true if Rustls should ask the server to send SCTs.