Struct rcgen::CertificateParams
source · #[non_exhaustive]pub struct CertificateParams {Show 13 fields
pub not_before: OffsetDateTime,
pub not_after: OffsetDateTime,
pub serial_number: Option<SerialNumber>,
pub subject_alt_names: Vec<SanType>,
pub distinguished_name: DistinguishedName,
pub is_ca: IsCa,
pub key_usages: Vec<KeyUsagePurpose>,
pub extended_key_usages: Vec<ExtendedKeyUsagePurpose>,
pub name_constraints: Option<NameConstraints>,
pub crl_distribution_points: Vec<CrlDistributionPoint>,
pub custom_extensions: Vec<CustomExtension>,
pub use_authority_key_identifier_extension: bool,
pub key_identifier_method: KeyIdMethod,
}
Expand description
Parameters used for certificate generation
Fields (Non-exhaustive)§
This struct is marked as non-exhaustive
Struct { .. }
syntax; cannot be matched against without a wildcard ..
; and struct update syntax will not work.not_before: OffsetDateTime
§not_after: OffsetDateTime
§serial_number: Option<SerialNumber>
§subject_alt_names: Vec<SanType>
§distinguished_name: DistinguishedName
§is_ca: IsCa
§key_usages: Vec<KeyUsagePurpose>
§extended_key_usages: Vec<ExtendedKeyUsagePurpose>
§name_constraints: Option<NameConstraints>
§crl_distribution_points: Vec<CrlDistributionPoint>
An optional list of certificate revocation list (CRL) distribution points as described in RFC 5280 Section 4.2.1.131. Each distribution point contains one or more URIs where an up-to-date CRL with scope including this certificate can be retrieved.
custom_extensions: Vec<CustomExtension>
If true
, the ‘Authority Key Identifier’ extension will be added to the generated cert
key_identifier_method: KeyIdMethod
Method to generate key identifiers from public keys
Defaults to a truncated SHA-256 digest. See KeyIdMethod
for more information.
Implementations§
source§impl CertificateParams
impl CertificateParams
sourcepub fn new(subject_alt_names: impl Into<Vec<String>>) -> Result<Self, Error>
pub fn new(subject_alt_names: impl Into<Vec<String>>) -> Result<Self, Error>
Generate certificate parameters with reasonable defaults
sourcepub fn signed_by(
self,
key_pair: &KeyPair,
issuer: &Certificate,
issuer_key: &KeyPair
) -> Result<Certificate, Error>
pub fn signed_by( self, key_pair: &KeyPair, issuer: &Certificate, issuer_key: &KeyPair ) -> Result<Certificate, Error>
Generate a new certificate from the given parameters, signed by the provided issuer.
The returned certificate will have its issuer field set to the subject of the
provided issuer
, and the authority key identifier extension will be populated using
the subject public key of issuer
. It will be signed by issuer_key
.
Note that no validation of the issuer
certificate is performed. Rcgen will not require
the certificate to be a CA certificate, or have key usage extensions that allow signing.
The returned Certificate
may be serialized using Certificate::der
and
Certificate::pem
.
sourcepub fn self_signed(self, key_pair: &KeyPair) -> Result<Certificate, Error>
pub fn self_signed(self, key_pair: &KeyPair) -> Result<Certificate, Error>
Generates a new self-signed certificate from the given parameters.
The returned Certificate
may be serialized using Certificate::der
and
Certificate::pem
.
sourcepub fn from_ca_cert_pem(pem_str: &str) -> Result<Self, Error>
Available on crate features pem
and x509-parser
only.
pub fn from_ca_cert_pem(pem_str: &str) -> Result<Self, Error>
pem
and x509-parser
only.Parses an existing ca certificate from the ASCII PEM format.
See from_ca_cert_der
for more details.
sourcepub fn from_ca_cert_der(ca_cert: &CertificateDer<'_>) -> Result<Self, Error>
Available on crate feature x509-parser
only.
pub fn from_ca_cert_der(ca_cert: &CertificateDer<'_>) -> Result<Self, Error>
x509-parser
only.Parses an existing ca certificate from the DER format.
This function is only of use if you have an existing CA certificate
you would like to use to sign a certificate generated by rcgen
.
By providing the constructed CertificateParams
and the KeyPair
associated with your existing ca_cert
you can use CertificateParams::signed_by()
or crate::CertificateSigningRequestParams::signed_by()
to issue new certificates
using the CA cert.
In general this function only extracts the information needed for signing.
Other attributes of the Certificate
may be left as defaults.
This function assumes the provided certificate is a CA. It will not check
for the presence of the BasicConstraints
extension, or perform any other
validation.
rustls_pemfile::certs()
is often used to obtain a CertificateDer
from PEM input.
If you already have a byte slice containing DER, it can trivially be converted into
CertificateDer
using the Into
trait.
sourcepub fn serialize_request(
&self,
subject_key: &KeyPair
) -> Result<CertificateSigningRequest, Error>
pub fn serialize_request( &self, subject_key: &KeyPair ) -> Result<CertificateSigningRequest, Error>
Generate and serialize a certificate signing request (CSR).
The constructed CSR will contain attributes based on the certificate parameters,
and include the subject public key information from subject_key
. Additionally,
the CSR will be self-signed using the subject key.
Note that subsequent invocations of serialize_request()
will not produce the exact
same output.
Trait Implementations§
source§impl Clone for CertificateParams
impl Clone for CertificateParams
source§fn clone(&self) -> CertificateParams
fn clone(&self) -> CertificateParams
1.0.0 · source§fn clone_from(&mut self, source: &Self)
fn clone_from(&mut self, source: &Self)
source
. Read more