Struct PinnedServerCertVerifier 

pub struct PinnedServerCertVerifier { /* private fields */ }

Verifies server certificates against an optional pinned SHA-256 fingerprint.

LocalSend peers use self-signed certificates without PKI CAs. Peer identity is defined by the uppercase-hex SHA-256 fingerprint of the DER certificate.

When expected_fingerprint is Some, any certificate whose fingerprint differs is immediately rejected with a descriptive error. When expected_fingerprint is None, any cryptographically valid self-signed / peer certificate is accepted (Trust On First Use, for discovery probes).

Implementations

impl PinnedServerCertVerifier

pub fn new( own_cert_pem: &str, expected_fingerprint: Option<String>, ) -> Result<Self>

Creates a new pinned server certificate verifier.

own_cert_pem is added to a local dummy root store so that the underlying signature validator initializes properly without an empty-root error. It is never used as a trust CA.

pub fn expected_fingerprint(&self) -> Option<&str>

Access the pinned fingerprint filter (if any).

Trait Implementations

impl Debug for PinnedServerCertVerifier

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl ServerCertVerifier for PinnedServerCertVerifier

fn verify_server_cert( &self, end_entity: &CertificateDer<'_>, _intermediates: &[CertificateDer<'_>], _server_name: &ServerName<'_>, _ocsp_response: &[u8], _now: UnixTime, ) -> Result<ServerCertVerified, Error>

Verify the end-entity certificate end_entity is valid for the hostname dns_name and chains to at least one trust anchor.

fn verify_tls12_signature( &self, message: &[u8], cert: &CertificateDer<'_>, dss: &DigitallySignedStruct, ) -> Result<HandshakeSignatureValid, Error>

Verify a signature allegedly by the given server certificate.

fn verify_tls13_signature( &self, message: &[u8], cert: &CertificateDer<'_>, dss: &DigitallySignedStruct, ) -> Result<HandshakeSignatureValid, Error>

Verify a signature allegedly by the given server certificate.

fn supported_verify_schemes(&self) -> Vec<SignatureScheme>

Return the list of SignatureSchemes that this verifier will handle, in verify_tls12_signature and verify_tls13_signature calls.

fn requires_raw_public_keys(&self) -> bool

Returns whether this verifier requires raw public keys as defined in RFC 7250.

fn root_hint_subjects(&self) -> Option<&[DistinguishedName]>

Return the DistinguishedNames of certificate authorities that this verifier trusts.