Struct DigServerCertVerifier 

pub struct DigServerCertVerifier { /* private fields */ }

Client-side verifier: verifies the SERVER’s leaf, pins its peer_id, and checks the BLS binding.

Two modes, selected at construction:

• Self::new (default) additionally requires the leaf to chain to the shipped DigNetwork CA — the trust-DOMAIN marker for a fully-migrated DIG network.
• Self::new_spki_pinned DROPS that CA-chain requirement (see the type-level note on require_ca_chain) while keeping every real authentication check. Used because live DIG peers present self-signed / chia-ssl leaves today (#1378 CA-everywhere migration deferred), so the CA-requiring path rejects every legit peer with UnknownIssuer (#1422).

Implementations

impl DigServerCertVerifier

pub fn new( expected: Option<PeerId>, captured: CapturedPeerId, binding_policy: BindingPolicy, captured_bls: CapturedBlsPub, ) -> Self

Build a verifier that REQUIRES the server leaf to chain to the DigNetwork CA, pins expected (or accepts any such peer when None), captures the derived id + BLS pubkey, and applies binding_policy.

pub fn new_spki_pinned( expected: Option<PeerId>, captured: CapturedPeerId, binding_policy: BindingPolicy, captured_bls: CapturedBlsPub, ) -> Self

Build a SPKI-PINNED verifier: identical to Self::new except it does NOT require the server leaf to chain to the DigNetwork CA. Authentication still rests on the peer_id pin + rustls proof-of-possession + the #1204 BLS binding (see require_ca_chain). Use this to dial the self-signed peers on the live network (#1422); the CA-requiring Self::new stays for the deferred #1378 DIG-CA-everywhere migration.

SAFETY / USAGE CONTRACT: Unlike CA mode (where accept-any at least enforces the DIG trust domain), SPKI-pinned mode drops the CA check, so passing expected: None together with a non-Required BindingPolicy authenticates NOTHING about which peer answered — any peer presenting any self-signed leaf is accepted, and an active MITM is undetectable. A dialer MUST pass expected: Some(peer_id) (or use BindingPolicy::Required) to authenticate the specific peer. See #1422 / #1371.

Trait Implementations

impl Debug for DigServerCertVerifier

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl ServerCertVerifier for DigServerCertVerifier

fn verify_server_cert( &self, end_entity: &CertificateDer<'_>, intermediates: &[CertificateDer<'_>], _server_name: &ServerName<'_>, _ocsp_response: &[u8], now: UnixTime, ) -> Result<ServerCertVerified, TlsError>

Verify the end-entity certificate end_entity is valid for the hostname dns_name and chains to at least one trust anchor.

fn verify_tls12_signature( &self, message: &[u8], cert: &CertificateDer<'_>, dss: &DigitallySignedStruct, ) -> Result<HandshakeSignatureValid, TlsError>

Verify a signature allegedly by the given server certificate.

fn verify_tls13_signature( &self, message: &[u8], cert: &CertificateDer<'_>, dss: &DigitallySignedStruct, ) -> Result<HandshakeSignatureValid, TlsError>

Verify a signature allegedly by the given server certificate.

fn supported_verify_schemes(&self) -> Vec<SignatureScheme>

Return the list of SignatureSchemes that this verifier will handle, in verify_tls12_signature and verify_tls13_signature calls.

fn requires_raw_public_keys(&self) -> bool

Returns whether this verifier requires raw public keys as defined in RFC 7250.

fn root_hint_subjects(&self) -> Option<&[DistinguishedName]>

Return the DistinguishedNames of certificate authorities that this verifier trusts.