Struct CertificateStore 

pub struct CertificateStore { /* private fields */ }

Certificate store with database metadata and file caching.

Implementations

impl CertificateStore

pub async fn new(pool: PgPool, cache_dir: impl AsRef<Path>) -> ProxyResult<Self>

Create a new certificate store.

The cache directory holds private keys, so it is created owner-only (0700) and every key in it is kept at 0600. A directory that already exists is left as it is – cert_dir might be a shared path, and tightening it could break whatever else uses it – but a warning says so if others can read it, and key files written by earlier versions, which were left at the umask’s default (typically world-readable), are tightened.

pub async fn get(&self, domain: &str) -> Option<Certificate>

Get a certificate for a domain.

None for a name that is not a valid lowercase DNS name: see [check_domain].

pub async fn save(&self, cert: Certificate) -> ProxyResult<()>

Save a certificate.

Refused unless cert.domain is a valid lowercase DNS name: see [check_domain].

pub async fn remove(&self, domain: &str) -> ProxyResult<()>

Remove a certificate.

Refused unless domain is a valid lowercase DNS name: see [check_domain].

pub async fn list_domains(&self) -> ProxyResult<Vec<String>>

List all stored domains.

pub async fn load_all(&self) -> ProxyResult<Vec<Certificate>>

Read every certificate from the database, ignoring both caches.

get answers from memory once a domain has been read once, which is right for a handshake and wrong for a refresh: a certificate renewed by another instance would never be noticed, and this proxy would go on serving the old one until it was restarted. The database is the authority, so a refresh asks it.

The in-memory cache is replaced with what was read, so the two do not then disagree.