Struct RemoteSigner

pub struct RemoteSigner {
    pub endpoint: Url,
    pub address: Address,
    pub client_cert: Option<ClientCert>,
    pub ca_cert: Option<PathBuf>,
    pub headers: HeaderMap,
}

Configuration for the remote signer client

This configuration supports various TLS/certificate scenarios:

1. Basic HTTPS: Only endpoint and address are required.
2. Custom CA: Provide ca_cert to verify servers with custom/self-signed certificates.
3. Mutual TLS (mTLS): Provide both client_cert and client_key for client authentication.
4. Full mTLS with custom CA: Combine all certificate options for maximum security.

Certificate formats supported:

• PEM format for all certificates and keys
• Certificates should be provided as file paths.

By default, the process will watch for changes in the client certificate files and reload the client automatically.

Fields

endpoint: Url

The URL of the remote signer endpoint

address: Address

The address of the signer.

client_cert: Option<ClientCert>

Optional client certificate for mTLS (PEM format)

ca_cert: Option<PathBuf>

Optional CA certificate for server verification (PEM format)

headers: HeaderMap

Headers to pass to the remote signer.

Implementations

impl RemoteSigner

pub async fn start(self) -> Result<RemoteSignerHandler, RemoteSignerStartError>

Creates a new remote signer with the given configuration

If client certificates are configured, this will automatically start a certificate watcher that monitors the certificate files for changes. When certificates are updated (e.g., by cert-manager in Kubernetes), the TLS client will be automatically reloaded with the new certificates without requiring a restart.

Certificate Watching

The certificate watcher monitors:

• Client certificate file (if mTLS is configured)
• Client private key file (if mTLS is configured)
• CA certificate file (if custom CA is configured)

When any of these files are modified, the watcher will:

1. Log the certificate change event
2. Reload the certificate files from disk
3. Rebuild the HTTP client with the new TLS configuration
4. Replace the existing client atomically

This enables zero-downtime certificate rotation in production environments.

Trait Implementations

impl Clone for RemoteSigner

fn clone(&self) -> RemoteSigner

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RemoteSigner

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl From<RemoteSigner> for BlockSigner

fn from(value: RemoteSigner) -> Self

Converts to this type from the input type.