pub struct NodeCert { /* private fields */ }Expand description
Implementations§
Source§impl NodeCert
impl NodeCert
Sourcepub fn generate_signed(bls_sk: &SecretKey) -> Result<Self>
pub fn generate_signed(bls_sk: &SecretKey) -> Result<Self>
Generate a new node cert signed by the shipped, public DigNetwork CA (the common path).
Sourcepub fn generate_signed_by(
ca: &DigCa,
bls_sk: &SecretKey,
now: OffsetDateTime,
) -> Result<Self>
pub fn generate_signed_by( ca: &DigCa, bls_sk: &SecretKey, now: OffsetDateTime, ) -> Result<Self>
Generate a new node cert signed by an explicit CA at an explicit issuance time (used by tests
with a throwaway CA, and internally by Self::generate_signed).
Sourcepub fn load_or_generate(
dir: impl AsRef<Path>,
bls_sk: &SecretKey,
) -> Result<Self>
pub fn load_or_generate( dir: impl AsRef<Path>, bls_sk: &SecretKey, ) -> Result<Self>
Load a persisted node cert + key from dir, or generate + persist a new one signed by the
shipped DigNetwork CA if either file is absent. Keeps a peer’s peer_id stable across restarts.
Sourcepub fn rotate(
dir: impl AsRef<Path>,
new_bls_sk: &SecretKey,
) -> Result<RotatedNodeCert>
pub fn rotate( dir: impl AsRef<Path>, new_bls_sk: &SecretKey, ) -> Result<RotatedNodeCert>
Rotate this peer’s machine key: mint a FRESH (TLS leaf, cert) bound to new_bls_sk, persist
it as the new current identity, and demote the existing on-disk pair to the additive .prev
slot — WITHOUT losing it — so the caller can dual-present during the overlap window.
The new leaf key means a new SPKI and therefore a new peer_id: rotation is an IDENTITY
CHANGE (see RotatedNodeCert). The caller mints the new BLS identity secret in dig-identity
and passes it in here; dig-tls never derives or stores a BLS key (mirroring
Self::generate_signed). Cert-EXPIRY renewal under the SAME key is a separate, cheaper path
— reissue with Self::generate_signed using the existing BLS secret; the peer_id is
preserved only when the SAME TLS leaf key is reused, which this rotation deliberately is NOT.
The existing dir MUST already hold a current cert + key (rotation replaces a live identity).
The persisted key files stay owner-only 0600 (see [write_key_file]).
Sourcepub fn from_pem(cert_pem: &str, key_pem: &str) -> Result<Self>
pub fn from_pem(cert_pem: &str, key_pem: &str) -> Result<Self>
Reconstruct a NodeCert from persisted PEM (its cert + private key).
Sourcepub fn spki_der(&self) -> &[u8] ⓘ
pub fn spki_der(&self) -> &[u8] ⓘ
The leaf’s SubjectPublicKeyInfo DER (what peer_id is the SHA-256 of).
Sourcepub fn cert_pem(&self) -> &str
pub fn cert_pem(&self) -> &str
The leaf certificate, PEM-encoded (for persistence / inspection).
Sourcepub fn key_pem(&self) -> &str
pub fn key_pem(&self) -> &str
The private key, PEM-encoded. Handle with care — this is secret-ADJACENT (the key authorizes the peer’s identity, though the DigNetwork CA itself is public).
Sourcepub fn rustls_cert_chain(&self) -> Vec<CertificateDer<'static>>
pub fn rustls_cert_chain(&self) -> Vec<CertificateDer<'static>>
The rustls certificate chain to present in a handshake (just the leaf — the DigNetwork CA is a well-known trust anchor every peer already embeds, so it is not sent on the wire).
Sourcepub fn rustls_private_key(&self) -> PrivateKeyDer<'static>
pub fn rustls_private_key(&self) -> PrivateKeyDer<'static>
The rustls private key for the handshake.