pub struct CertifiedKey {
pub der_bytes: Vec<u8>,
pub subject_public_key: [u8; 32],
pub fingerprint: [u8; 32],
pub expires_at: DateTime<Utc>,
pub issuer_public_key: [u8; 32],
}Expand description
A certificate issued over a subject key its holder presented and proved possession of.
Produced by
CertificateAuthority::issue_certificate_for_request.
Carries no private material: the subject’s signing key stays with the
holder and was never present in this process. That is what makes this
certificate meaningful to a third party — it binds a key someone
demonstrably controls, rather than one the authority minted.
Fields§
§der_bytes: Vec<u8>The signed certificate in DER encoding.
subject_public_key: [u8; 32]The subject’s 32-byte Ed25519 public key, as carried in the
certificate’s subjectPublicKeyInfo and proved possessed at issuance.
fingerprint: [u8; 32]SHA-256 fingerprint of Self::der_bytes.
expires_at: DateTime<Utc>Instant after which the certificate is no longer valid.
issuer_public_key: [u8; 32]The 32-byte Ed25519 public key of the issuing authority.
Implementations§
Source§impl CertifiedKey
impl CertifiedKey
Sourcepub fn from_der_and_public_key(
der_bytes: Vec<u8>,
subject_public_key: &[u8; 32],
expires_at: DateTime<Utc>,
issuer_public_key: [u8; 32],
) -> TrustResult<Self>
pub fn from_der_and_public_key( der_bytes: Vec<u8>, subject_public_key: &[u8; 32], expires_at: DateTime<Utc>, issuer_public_key: [u8; 32], ) -> TrustResult<Self>
Builds a CertifiedKey from signed DER and the presented subject key.
Computes the SHA-256 fingerprint over der_bytes and confirms that the
certificate actually binds subject_public_key — see
assert_der_binds_subject_key.
§Errors
Returns TrustError::CertificateGeneration if the certificate cannot
be parsed back, does not carry an Ed25519 subject key, or binds a key
other than subject_public_key.