Struct SniCertResolver 

pub struct SniCertResolver { /* private fields */ }

Resolves a certificate from the store by the SNI name of the handshake.

Implementations

impl SniCertResolver

pub fn new(fallback: Option<Arc<CertifiedKey>>) -> Self

Build a resolver holding nothing but the fallback.

Call refresh to populate it from the store.

pub fn certified_key( cert_pem: &[u8], key_pem: &[u8], ) -> ProxyResult<Arc<CertifiedKey>>

Build the fallback from the statically configured PEM pair.

pub async fn refresh(&self, store: &CertificateStore) -> ProxyResult<usize>

Reload every certificate the store holds.

Returns how many are now being served. A certificate that will not parse is logged and skipped rather than failing the refresh: one bad row must not take every other tenant’s TLS down with it.

Trait Implementations

impl Debug for SniCertResolver

Names the domains held, never the keys. A private key that reaches a log is a private key that has to be rotated.

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl ResolvesServerCert for SniCertResolver

fn resolve(&self, client_hello: ClientHello<'_>) -> Option<Arc<CertifiedKey>>

Choose a certificate chain and matching key given simplified ClientHello information.

fn only_raw_public_keys(&self) -> bool

Return true when the server only supports raw public keys.