pub struct PreloadedCa {
pub key_der: Zeroizing<Vec<u8>>,
pub cert_pem: String,
}Expand description
Pre-generated CA key material for cross-session CA reuse.
Used by --trust-proxy-ca on macOS: the CLI persists the CA in Keychain
and passes it to the proxy so all sessions within the CA’s validity window
share the same signing key (and the same trusted cert in the system store).
§Security note
The Keychain item’s access control depends on the binary’s code-signing identity. Release-signed builds get per-app isolation; unsigned dev builds allow any local process to read the key.
Because the CA is trusted user-wide during its validity window, any
same-user process that can read the Keychain item could mint certificates
trusted by macOS trust consumers. Release-signed builds are expected to
receive stronger Keychain access isolation than unsigned development builds.
The configurable CA validity (--proxy-ca-validity) limits exposure.
Fields§
§key_der: Zeroizing<Vec<u8>>PKCS#8 DER-encoded private key for the CA. Zeroized on drop.
cert_pem: StringPEM-encoded CA certificate (public).
Trait Implementations§
Source§impl Clone for PreloadedCa
impl Clone for PreloadedCa
Source§fn clone(&self) -> PreloadedCa
fn clone(&self) -> PreloadedCa
1.0.0 (const: unstable) · Source§fn clone_from(&mut self, source: &Self)
fn clone_from(&mut self, source: &Self)
source. Read more