Crate pkix_path 

RFC 5280 X.509 certificate path validation — pure Rust, no_std.

Implements certificate path building and validation per RFC 5280 §6.

Architecture

Cryptographic signature verification is pluggable via SignatureVerifier. The default feature set (rustcrypto) wires in RustCrypto backends for RSA-PKCS1v15-SHA-256 (rsa feature) and ECDSA-P-256-SHA-256 (p256 feature). P-384 and Ed25519 are planned for v0.2. For FIPS-validated crypto, implement SignatureVerifier against wolfcrypt-rustcrypto and disable the rustcrypto feature.

Revocation checking is handled by pkix-revocation. This crate never touches the network — use pkix_chain::verify_chain for the combined API.

Limitations

v0.1 does not implement:

• NameConstraints (RFC 5280 §4.2.1.10)
• PolicyConstraints / certificate policy validation (§4.2.1.9, §6.1.5)
• Revocation (use pkix-revocation)
• Cross-certificate path building (RFC 4158)

These are tracked for v0.2+.

Structs

DefaultVerifierp256 or rsa

A SignatureVerifier that dispatches to available RustCrypto backends by OID.

EcdsaP256Verifierp256

ECDSA P-256 with SHA-256 signature verifier.

RsaPkcs1v15Sha256Verifierrsa

RSA with PKCS#1 v1.5 padding and SHA-256 signature verifier.

TrustAnchor

A trust anchor used to terminate path validation.

ValidatedPath

The result of a successful certificate path validation.

ValidationPolicy

Policy parameters controlling path validation.

Enums

Error

Errors returned by path validation.

Traits

SignatureVerifier

Pluggable signature verification backend.

Functions

names_match

Compare two distinguished names per RFC 4518 string prep rules.

validate_path

Validate a certificate chain from subject to a trust anchor.

Type Aliases

Result

Result alias for this crate.