Struct NodeCert 

pub struct NodeCert { /* private fields */ }

A peer’s mTLS identity certificate + private key, plus its derived peer_id.

The private key is held in Zeroizing so every clone/drop scrubs the plaintext PKCS#8 bytes from freed heap. NodeCert deliberately does not derive Clone for the same reason — pass a reference.

Implementations

impl NodeCert

pub fn generate_signed(bls_sk: &SecretKey) -> Result<NodeCert, DigTlsError>

Generate a new node cert signed by the shipped, public DigNetwork CA (the common path).

pub fn generate_signed_by( ca: &DigCa, bls_sk: &SecretKey, now: OffsetDateTime, ) -> Result<NodeCert, DigTlsError>

Generate a new node cert signed by an explicit CA at an explicit issuance time (used by tests with a throwaway CA, and internally by Self::generate_signed).

pub fn load_or_generate( dir: impl AsRef<Path>, bls_sk: &SecretKey, ) -> Result<NodeCert, DigTlsError>

Load a persisted node cert + key from dir, or generate + persist a new one signed by the shipped DigNetwork CA if either file is absent. Keeps a peer’s peer_id stable across restarts.

pub fn from_pem(cert_pem: &str, key_pem: &str) -> Result<NodeCert, DigTlsError>

Reconstruct a NodeCert from persisted PEM (its cert + private key).

pub fn peer_id(&self) -> PeerId

This peer’s transport identity, peer_id = SHA-256(SPKI DER).

pub fn spki_der(&self) -> &[u8]

The leaf’s SubjectPublicKeyInfo DER (what peer_id is the SHA-256 of).

pub fn cert_der(&self) -> &[u8]

The leaf certificate in DER form.

pub fn cert_pem(&self) -> &str

The leaf certificate, PEM-encoded (for persistence / inspection).

pub fn key_pem(&self) -> &str

The private key, PEM-encoded. Handle with care — this is secret-ADJACENT (the key authorizes the peer’s identity, though the DigNetwork CA itself is public).

pub fn rustls_cert_chain(&self) -> Vec<CertificateDer<'static>>

The rustls certificate chain to present in a handshake (just the leaf — the DigNetwork CA is a well-known trust anchor every peer already embeds, so it is not sent on the wire).

pub fn rustls_private_key(&self) -> PrivateKeyDer<'static>

The rustls private key for the handshake.

Trait Implementations

impl Debug for NodeCert

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Never renders the private key material.