pub struct KeyPair { /* private fields */ }Expand description
A key pair used to sign certificates and CSRs
Note that ring, the underlying library to handle RSA keys
requires them to be in a special format, meaning that
openssl genrsa doesn’t work. See ring’s documentation
for how to generate RSA keys in the wanted format
and conversion between the formats.
Implementations§
source§impl KeyPair
impl KeyPair
sourcepub fn generate() -> Result<KeyPair, Error>
Available on crate feature crypto only.
pub fn generate() -> Result<KeyPair, Error>
crypto only.Generate a new random PKCS_ECDSA_P256_SHA256 key pair
sourcepub fn generate_for(alg: &'static SignatureAlgorithm) -> Result<KeyPair, Error>
Available on crate feature crypto only.
pub fn generate_for(alg: &'static SignatureAlgorithm) -> Result<KeyPair, Error>
crypto only.Generate a new random key pair for the specified signature algorithm
If you’re not sure which algorithm to use, PKCS_ECDSA_P256_SHA256 is a good choice.
If passed an RSA signature algorithm, it depends on the backend whether we return
a generated key or an error for key generation being unavailable.
Currently, only aws-lc-rs supports RSA key generation.
sourcepub fn algorithm(&self) -> &'static SignatureAlgorithm
pub fn algorithm(&self) -> &'static SignatureAlgorithm
Returns the key pair’s signature algorithm
sourcepub fn from_pem(pem_str: &str) -> Result<KeyPair, Error>
Available on crate features pem and crypto only.
pub fn from_pem(pem_str: &str) -> Result<KeyPair, Error>
pem and crypto only.Parses the key pair from the ASCII PEM format
If aws_lc_rs feature is used, then the key must be a DER-encoded plaintext private key; as specified in PKCS #8/RFC 5958, SEC1/RFC 5915, or PKCS#1/RFC 3447;
Appears as “PRIVATE KEY”, “RSA PRIVATE KEY”, or “EC PRIVATE KEY” in PEM files.
Otherwise if the ring feature is used, then the key must be a DER-encoded plaintext private key; as specified in PKCS #8/RFC 5958;
Appears as “PRIVATE KEY” in PEM files.
sourcepub fn from_remote(
key_pair: Box<dyn RemoteKeyPair + Sync + Send>,
) -> Result<KeyPair, Error>
pub fn from_remote( key_pair: Box<dyn RemoteKeyPair + Sync + Send>, ) -> Result<KeyPair, Error>
Obtains the key pair from a raw public key and a remote private key
sourcepub fn from_pkcs8_pem_and_sign_algo(
pem_str: &str,
alg: &'static SignatureAlgorithm,
) -> Result<KeyPair, Error>
Available on crate features pem and crypto only.
pub fn from_pkcs8_pem_and_sign_algo( pem_str: &str, alg: &'static SignatureAlgorithm, ) -> Result<KeyPair, Error>
pem and crypto only.Obtains the key pair from a DER formatted key
using the specified SignatureAlgorithm
The key must be a DER-encoded plaintext private key; as specified in PKCS #8/RFC 5958;
Appears as “PRIVATE KEY” in PEM files Same as from_pkcs8_pem_and_sign_algo.
sourcepub fn from_pkcs8_der_and_sign_algo(
pkcs8: &PrivatePkcs8KeyDer<'_>,
alg: &'static SignatureAlgorithm,
) -> Result<KeyPair, Error>
Available on crate feature crypto only.
pub fn from_pkcs8_der_and_sign_algo( pkcs8: &PrivatePkcs8KeyDer<'_>, alg: &'static SignatureAlgorithm, ) -> Result<KeyPair, Error>
crypto only.Obtains the key pair from a DER formatted key using the specified SignatureAlgorithm
If you have a PrivatePkcs8KeyDer, you can usually rely on the TryFrom implementation
to obtain a KeyPair – it will determine the correct SignatureAlgorithm for you.
However, sometimes multiple signature algorithms fit for the same DER key. In those instances,
you can use this function to precisely specify the SignatureAlgorithm.
rustls_pemfile::private_key() is often used to obtain a PrivateKeyDer from PEM
input. If the obtained PrivateKeyDer is a Pkcs8 variant, you can use its contents
as input for this function. Alternatively, if you already have a byte slice containing DER,
it can trivially be converted into PrivatePkcs8KeyDer using the Into trait.
sourcepub fn from_pem_and_sign_algo(
pem_str: &str,
alg: &'static SignatureAlgorithm,
) -> Result<KeyPair, Error>
Available on crate features pem and crypto only.
pub fn from_pem_and_sign_algo( pem_str: &str, alg: &'static SignatureAlgorithm, ) -> Result<KeyPair, Error>
pem and crypto only.Obtains the key pair from a PEM formatted key
using the specified SignatureAlgorithm
If aws_lc_rs feature is used, then the key must be a DER-encoded plaintext private key; as specified in PKCS #8/RFC 5958, SEC1/RFC 5915, or PKCS#1/RFC 3447;
Appears as “PRIVATE KEY”, “RSA PRIVATE KEY”, or “EC PRIVATE KEY” in PEM files.
Otherwise if the ring feature is used, then the key must be a DER-encoded plaintext private key; as specified in PKCS #8/RFC 5958;
Appears as “PRIVATE KEY” in PEM files.
Same as from_pem_and_sign_algo.
sourcepub fn from_der_and_sign_algo(
key: &PrivateKeyDer<'_>,
alg: &'static SignatureAlgorithm,
) -> Result<KeyPair, Error>
Available on crate feature crypto only.
pub fn from_der_and_sign_algo( key: &PrivateKeyDer<'_>, alg: &'static SignatureAlgorithm, ) -> Result<KeyPair, Error>
crypto only.Obtains the key pair from a DER formatted key
using the specified SignatureAlgorithm
Note that using the ring feature, this function only support PrivateKeyDer::Pkcs8 variant.
Consider using the aws_lc_rs features to support PrivateKeyDer fully.
If you have a PrivateKeyDer, you can usually rely on the TryFrom implementation
to obtain a KeyPair – it will determine the correct SignatureAlgorithm for you.
However, sometimes multiple signature algorithms fit for the same DER key. In those instances,
you can use this function to precisely specify the SignatureAlgorithm.
You can use rustls_pemfile::private_key to get the key input. If
you have already a byte slice, just calling try_into() will convert it to a PrivateKeyDer.
sourcepub fn public_key_raw(&self) -> &[u8] ⓘ
pub fn public_key_raw(&self) -> &[u8] ⓘ
Get the raw public key of this key pair
The key is in raw format, as how ring::signature::KeyPair::public_key
would output, and how ring::signature::UnparsedPublicKey::verify
would accept.
sourcepub fn is_compatible(&self, signature_algorithm: &SignatureAlgorithm) -> bool
pub fn is_compatible(&self, signature_algorithm: &SignatureAlgorithm) -> bool
Check if this key pair can be used with the given signature algorithm
sourcepub fn compatible_algs(
&self,
) -> impl Iterator<Item = &'static SignatureAlgorithm>
pub fn compatible_algs( &self, ) -> impl Iterator<Item = &'static SignatureAlgorithm>
Returns (possibly multiple) compatible SignatureAlgorithm’s
that the key can be used with
sourcepub fn public_key_der(&self) -> Vec<u8>
pub fn public_key_der(&self) -> Vec<u8>
Return the key pair’s public key in DER format
The key is formatted according to the SubjectPublicKeyInfo struct of X.509. See RFC 5280 section 4.1.
sourcepub fn public_key_pem(&self) -> String
Available on crate feature pem only.
pub fn public_key_pem(&self) -> String
pem only.Return the key pair’s public key in PEM format
The returned string can be interpreted with openssl pkey --inform PEM -pubout -pubin -text
sourcepub fn serialize_der(&self) -> Vec<u8>
pub fn serialize_der(&self) -> Vec<u8>
Serializes the key pair (including the private key) in PKCS#8 format in DER
Panics if called on a remote key pair.
sourcepub fn serialized_der(&self) -> &[u8] ⓘ
pub fn serialized_der(&self) -> &[u8] ⓘ
Returns a reference to the serialized key pair (including the private key) in PKCS#8 format in DER
Panics if called on a remote key pair.
sourcepub fn as_remote(&self) -> Option<&(dyn RemoteKeyPair + Sync + Send)>
pub fn as_remote(&self) -> Option<&(dyn RemoteKeyPair + Sync + Send)>
Access the remote key pair if it is a remote one
sourcepub fn serialize_pem(&self) -> String
Available on crate feature pem only.
pub fn serialize_pem(&self) -> String
pem only.Serializes the key pair (including the private key) in PKCS#8 format in PEM
Trait Implementations§
source§impl TryFrom<&PrivateKeyDer<'_>> for KeyPair
Available on crate feature crypto only.
impl TryFrom<&PrivateKeyDer<'_>> for KeyPair
crypto only.source§impl TryFrom<&PrivatePkcs8KeyDer<'_>> for KeyPair
Available on crate feature crypto only.
impl TryFrom<&PrivatePkcs8KeyDer<'_>> for KeyPair
crypto only.