Module node_cert 

The per-peer node certificate — generated locally at first run, signed by the DigNetwork CA.

Every DIG peer mints ONE leaf certificate (mirroring Chia’s create_all_ssl): a fresh ECDSA P-256 TLS key pair, a leaf signed by the shipped crate::ca::DigCa, carrying the #1204 BLS-G1 binding (crate::binding). The leaf’s peer_id = SHA-256(SPKI DER) is the peer’s transport identity. The cert serves BOTH directions of mutual TLS (it has serverAuth + clientAuth EKUs), so the same NodeCert is presented whether the peer dials out or accepts a dial.

The cert + key are persisted PEM under a caller-chosen directory and regenerated only if absent, so a peer keeps a stable peer_id across restarts.

Structs

NodeCert

A peer’s mTLS identity certificate + private key, plus its derived peer_id.

RotatedNodeCert

The outcome of a machine-key rotation (NodeCert::rotate): the retiring previous identity and the freshly minted current one.

Constants

LEAF_LIFETIME

Leaf validity window: 10 years. A DIG peer’s identity is its peer_id + BLS binding, not the cert’s lifetime, so a long-lived leaf keeps the identity stable without any renewal machinery at this foundation layer. (A future consumer MAY rotate by deleting the persisted pair.)

Functions

load_previous

Load the RETIRING (previous) identity persisted by NodeCert::rotate, if a .prev slot exists.

retire_previous

Retire the previous identity: ZEROIZE the in-memory copy of the old key and delete both .prev files. Call this only AFTER the caller’s re-announce of the new peer_id has converged, since it makes the old identity permanently unrecoverable. A no-op (returns Ok(())) when no .prev slot exists, so it is safe to call unconditionally.