pub struct KeyPair { /* private fields */ }crypto only.Expand description
A key pair used to sign certificates and CSRs
Implementations§
Source§impl KeyPair
impl KeyPair
Sourcepub fn generate() -> Result<Self, Error>
pub fn generate() -> Result<Self, Error>
Generate a new random PKCS_ECDSA_P256_SHA256 key pair
Sourcepub fn generate_for(alg: &'static SignatureAlgorithm) -> Result<Self, Error>
pub fn generate_for(alg: &'static SignatureAlgorithm) -> Result<Self, Error>
Generate a new random key pair for the specified signature algorithm
If you’re not sure which algorithm to use, PKCS_ECDSA_P256_SHA256 is a good choice.
If passed an RSA signature algorithm, it depends on the backend whether we return
a generated key or an error for key generation being unavailable.
Currently, only aws-lc-rs supports RSA key generation.
Sourcepub fn algorithm(&self) -> &'static SignatureAlgorithm
pub fn algorithm(&self) -> &'static SignatureAlgorithm
Returns the key pair’s signature algorithm
Sourcepub fn from_pem(pem_str: &str) -> Result<Self, Error>
Available on crate feature pem only.
pub fn from_pem(pem_str: &str) -> Result<Self, Error>
pem only.Parses the key pair from the ASCII PEM format
If aws_lc_rs feature is used, then the key must be a DER-encoded plaintext private key; as specified in PKCS #8/RFC 5958, SEC1/RFC 5915, or PKCS#1/RFC 3447;
Appears as “PRIVATE KEY”, “RSA PRIVATE KEY”, or “EC PRIVATE KEY” in PEM files.
Otherwise if the ring feature is used, then the key must be a DER-encoded plaintext private key; as specified in PKCS #8/RFC 5958;
Appears as “PRIVATE KEY” in PEM files.
Sourcepub fn from_pkcs8_pem_and_sign_algo(
pem_str: &str,
alg: &'static SignatureAlgorithm,
) -> Result<Self, Error>
Available on crate feature pem only.
pub fn from_pkcs8_pem_and_sign_algo( pem_str: &str, alg: &'static SignatureAlgorithm, ) -> Result<Self, Error>
pem only.Obtains the key pair from a DER formatted key
using the specified SignatureAlgorithm
The key must be a DER-encoded plaintext private key; as specified in PKCS #8/RFC 5958;
Appears as “PRIVATE KEY” in PEM files Same as from_pkcs8_pem_and_sign_algo.
Sourcepub fn from_pkcs8_der_and_sign_algo(
pkcs8: &PrivatePkcs8KeyDer<'_>,
alg: &'static SignatureAlgorithm,
) -> Result<Self, Error>
pub fn from_pkcs8_der_and_sign_algo( pkcs8: &PrivatePkcs8KeyDer<'_>, alg: &'static SignatureAlgorithm, ) -> Result<Self, Error>
Obtains the key pair from a DER formatted key using the specified SignatureAlgorithm
If you have a PrivatePkcs8KeyDer, you can usually rely on the TryFrom implementation
to obtain a KeyPair – it will determine the correct SignatureAlgorithm for you.
However, sometimes multiple signature algorithms fit for the same DER key. In those instances,
you can use this function to precisely specify the SignatureAlgorithm.
rustls_pemfile::private_key() is often used to obtain a PrivateKeyDer from PEM
input. If the obtained PrivateKeyDer is a Pkcs8 variant, you can use its contents
as input for this function. Alternatively, if you already have a byte slice containing DER,
it can trivially be converted into PrivatePkcs8KeyDer using the Into trait.
Sourcepub fn from_pem_and_sign_algo(
pem_str: &str,
alg: &'static SignatureAlgorithm,
) -> Result<Self, Error>
Available on crate feature pem only.
pub fn from_pem_and_sign_algo( pem_str: &str, alg: &'static SignatureAlgorithm, ) -> Result<Self, Error>
pem only.Obtains the key pair from a PEM formatted key
using the specified SignatureAlgorithm
If aws_lc_rs feature is used, then the key must be a DER-encoded plaintext private key; as specified in PKCS #8/RFC 5958, SEC1/RFC 5915, or PKCS#1/RFC 3447;
Appears as “PRIVATE KEY”, “RSA PRIVATE KEY”, or “EC PRIVATE KEY” in PEM files.
Otherwise if the ring feature is used, then the key must be a DER-encoded plaintext private key; as specified in PKCS #8/RFC 5958;
Appears as “PRIVATE KEY” in PEM files.
Same as from_pem_and_sign_algo.
Sourcepub fn from_der_and_sign_algo(
key: &PrivateKeyDer<'_>,
alg: &'static SignatureAlgorithm,
) -> Result<Self, Error>
pub fn from_der_and_sign_algo( key: &PrivateKeyDer<'_>, alg: &'static SignatureAlgorithm, ) -> Result<Self, Error>
Obtains the key pair from a DER formatted key
using the specified SignatureAlgorithm
Note that using the ring feature, this function only support PrivateKeyDer::Pkcs8 variant.
Consider using the aws_lc_rs features to support PrivateKeyDer fully.
If you have a PrivateKeyDer, you can usually rely on the TryFrom implementation
to obtain a KeyPair – it will determine the correct SignatureAlgorithm for you.
However, sometimes multiple signature algorithms fit for the same DER key. In those instances,
you can use this function to precisely specify the SignatureAlgorithm.
You can use rustls_pemfile::private_key to get the key input. If
you have already a byte slice, just calling try_into() will convert it to a PrivateKeyDer.
Sourcepub fn public_key_raw(&self) -> &[u8] ⓘ
pub fn public_key_raw(&self) -> &[u8] ⓘ
Get the raw public key of this key pair
The key is in raw format, as how KeyPair::public_key()
would output, and how UnparsedPublicKey::verify()
would accept.
Sourcepub fn is_compatible(&self, signature_algorithm: &SignatureAlgorithm) -> bool
pub fn is_compatible(&self, signature_algorithm: &SignatureAlgorithm) -> bool
Check if this key pair can be used with the given signature algorithm
Sourcepub fn compatible_algs(
&self,
) -> impl Iterator<Item = &'static SignatureAlgorithm>
pub fn compatible_algs( &self, ) -> impl Iterator<Item = &'static SignatureAlgorithm>
Returns (possibly multiple) compatible SignatureAlgorithm’s
that the key can be used with
Sourcepub fn public_key_pem(&self) -> String
Available on crate feature pem only.
pub fn public_key_pem(&self) -> String
pem only.Return the key pair’s public key in PEM format
The returned string can be interpreted with openssl pkey --inform PEM -pubout -pubin -text
Sourcepub fn serialize_der(&self) -> Vec<u8> ⓘ
pub fn serialize_der(&self) -> Vec<u8> ⓘ
Serializes the key pair (including the private key) in PKCS#8 format in DER
Sourcepub fn serialized_der(&self) -> &[u8] ⓘ
pub fn serialized_der(&self) -> &[u8] ⓘ
Returns a reference to the serialized key pair (including the private key) in PKCS#8 format in DER
Sourcepub fn serialize_pem(&self) -> String
Available on crate feature pem only.
pub fn serialize_pem(&self) -> String
pem only.Serializes the key pair (including the private key) in PKCS#8 format in PEM