Crate matter_cert 

Matter protocol certificate format — parsing and serialisation.

Implements Matter Core Specification §6.5: a TLV-encoded variant of X.509 used for both attestation chains (DAC → PAI → PAA) and operational chains (NOC → ICAC → RCAC).

Scope

• Parse and serialise — MatterCertificate over the Matter TLV form, byte-exact on round-trip. Distinguished names including the Matter-specific OIDs (name) and the extension set (extensions: basic constraints, key usage, extended key usage, subject and authority key identifiers).
• Public keys and signatures — P-256 key extraction (public_key) and the raw r || s Matter signature form.
• X.509 DER conversion — real Matter signatures are made over the X.509 DER TBSCertificate, not over the TLV form, so MatterCertificate::verify_signed_by reconstructs it. Byte parity against matter.js’s asUnsignedDer() is the correctness gate.
• Chain validation — CertificateChain::validate against TrustedRoots, checking time bounds, the CA bit above the leaf, DN linkage, the path-length constraint, and each signature.
• Issuance — Builder constructs an UnsignedCertificate, and operational adds role-aware constructors that bake in the extension and DN profile the spec mandates for RCAC, ICAC, and NOC. Signing is a separate step, so it can happen in an HSM, an OS keychain, or an offline ceremony rather than in this process.

Cryptographic verification is delegated to ring. This crate never implements the underlying maths.

Re-exports

pub use builder::Builder;

pub use builder::UnsignedCertificate;

pub use certificate::MatterCertificate;

pub use chain::CertificateChain;

pub use chain::TrustAnchor;

pub use chain::TrustedRoots;

pub use error::Error;

pub use error::Result;

pub use extensions::BasicConstraints;

pub use extensions::Extensions;

pub use extensions::ExtensionsBuilder;

pub use extensions::KeyIdentifier;

pub use extensions::KeyUsage;

pub use name::DistinguishedName;

pub use name::DnAttribute;

pub use name::DnAttributeValue;

pub use public_key::PublicKey;

pub use signature::Signature;

pub use time::MatterTime;

Modules

builder

Public builder API for MatterCertificate.

certificate

Matter certificate parser and serialiser.

chain

Matter certificate chain validation.

error

Error type for matter-cert.

extensions

Matter certificate extensions.

name

Matter distinguished-name (DN) handling.

operational

Role-aware constructors for Matter operational-PKI certificates (spec §6.5.5): NOC, ICAC, RCAC.

public_key

Matter EC public key (P-256, uncompressed point).

signature

Matter ECDSA-P256 signature.

time

Matter time representation.