Function host_matches 

pub fn host_matches(host_header: Option<&str>, domain: &str) -> bool

Whether a request’s Host header names domain.

The comparison has to be deliberate rather than ==, because a Host header is not a bare domain:

• it may carry a port (example.com:8443), which is not part of the name;
• it is case-insensitive, per RFC 9110 section 4.2.3;
• it may be an IPv6 literal in brackets ([::1]:8443), where the colons inside the brackets are not a port separator;
• it may carry a fully-qualified trailing dot (example.com.), which names the same host as example.com.

Both sides go through normalize_domain, the function every stored domain went through on the way in, so the comparison here cannot disagree with the uniqueness check about whether two spellings are one name. An IP literal never matches: no registered domain can be one.

Anything that does not parse as a host is not a match. Returning false on doubt is the safe direction: the caller uses this to decide whether to hand out a challenge secret.