Struct CertCache 

pub struct CertCache { /* private fields */ }

Per-hostname leaf certificate cache backed by the session’s EphemeralCa.

Implementations

impl CertCache

pub fn new(ca: Arc<EphemeralCa>) -> Self

Construct a new cache backed by ca.

pub fn get_or_mint(&self, hostname: &str) -> Result<Arc<CertifiedKey>>

Look up or mint a leaf certificate for hostname.

Used by tests; production code goes through ResolvesServerCert.

Trait Implementations

impl Debug for CertCache

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl ResolvesServerCert for CertCache

fn resolve(&self, client_hello: ClientHello<'_>) -> Option<Arc<CertifiedKey>>

rustls invokes this synchronously during the server-side handshake. We extract the SNI hostname, look up (or mint) a leaf, and return it. On failure — empty SNI, mint error, mutex poison — we return None, causing rustls to fail the handshake. That’s what we want: the agent sees a TLS error, the CONNECT handler records the failure, no silent fallback occurs.

fn only_raw_public_keys(&self) -> bool

Return true when the server only supports raw public keys.