Crate lexe_tls

Expand description

Lexe TLS configs, certs, and utilities.

Modules§

attest_client: mTLS clients for verifying SGX remote attestations.
ed25519_ext: ed25519 key pair extension trait (PEM ser/de). Extension traits and types on lexe_crypto::ed25519, so it can integrate with TLS libraries like rustls and rcgen without adding a dependency on an entire TLS stack in a foundational crate like lexe_crypto.
lexe_ca: Certs and utilities related to Lexe’s CA. Certs and utilities related to Lexe’s CA.
p256: ECDSA P-256 key pairs for webpki TLS certs. ECDSA P-256 key pairs, used for webpki TLS certificates.
rustls: Re-export all of lexe_tls_core.
shared_seed: mTLS based on a shared RootSeed. mTLS based on a shared RootSeed. We’ll call this “shared seed” mTLS.
types: TLS newtypes, namely DER-encoded certs and cert keys. TLS newtypes.

DEFAULT_SUBJECT_ALT_NAMES: A safe default for rcgen::CertificateParams::subject_alt_names when there isn’t a specific value that makes sense. Used for client / CA certs.
LEXE_ALPN_PROTOCOLS: Re-export all of lexe_tls_core. Lexe default value for ClientConfig::alpn_protocols and ServerConfig::alpn_protocols: HTTP/1.1 and HTTP/2
LEXE_CRYPTO_PROVIDER: Re-export all of lexe_tls_core. Our rustls::crypto::CryptoProvider. Use this instead of rustls::crypto::ring::default_provider.
LEXE_SIGNATURE_ALGORITHMS: Re-export all of lexe_tls_core. Lexe signature algorithms: Only Ed25519. Pass this to rustls::crypto::verify_tls13_signature.
LEXE_SUPPORTED_VERIFY_SCHEMES: Re-export all of lexe_tls_core. The value to pass to ServerCertVerifier::supported_verify_schemes
LEXE_TLS_PROTOCOL_VERSIONS: Re-export all of lexe_tls_core. Lexe TLS protocol version: TLSv1.3

build_rcgen_cert_params: Build an rcgen::CertificateParams with Lexe presets and optional overrides.
cert_contains_dns: Whether the given DER-encoded cert is bound to the given DNS names.
cert_is_valid_for_at_least: Whether the given DER-encoded cert is currently valid and will be valid for at least buffer_days more days. buffer_days=0 can be used if you only wish to check whether the cert is currently valid. Does not validate anything other than expiry. Returns false if the cert failed to parse.
client_config_builder: Re-export all of lexe_tls_core. Helper to get a builder for a ClientConfig with Lexe’s presets. NOTE: Remember: Set alpn_protocols to LEXE_ALPN_PROTOCOLS afterwards!
lexe_distinguished_name: Build a Lexe Distinguished Name given a Common Name.
server_config_builder: Re-export all of lexe_tls_core. Helper to get a builder for a ServerConfig with Lexe’s presets. NOTE: Remember: Set alpn_protocols to LEXE_ALPN_PROTOCOLS afterwards!