Struct CertResolver 

pub struct CertResolver { /* private fields */ }

A certificate resolver that supports hot-swapping certificates.

Implements ResolvesServerCert so it can be used with rustls::ServerConfig. The inner RwLock allows updating the certificate without restarting the TLS acceptor.

Uses std::sync::RwLock (not tokio::sync::RwLock) because ResolvesServerCert::resolve is synchronous. A tokio RwLock required try_read() which returns None during certificate updates, causing TLS handshake failures. A std RwLock blocks briefly during the (very fast) pointer swap, so resolve never returns None.

Implementations

impl CertResolver

pub fn new(key: CertifiedKey) -> Self

Create a new resolver with the given certified key.

pub fn update(&self, key: CertifiedKey)

Update the certificate. Subsequent TLS handshakes will use the new certificate.

This acquires a std RwLock write guard, which blocks briefly but is safe because the critical section is a single pointer swap.

If the lock is poisoned (prior panic during a write), we recover by clearing the poison — the old Arc<CertifiedKey> is still valid and we are replacing it with a fresh one anyway.

Trait Implementations

impl Debug for CertResolver

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl ResolvesServerCert for CertResolver

fn resolve(&self, _client_hello: ClientHello<'_>) -> Option<Arc<CertifiedKey>>

Choose a certificate chain and matching key given simplified ClientHello information.

fn only_raw_public_keys(&self) -> bool

Return true when the server only supports raw public keys.