Struct rcgen::CertificateParams

#[non_exhaustive]
pub struct CertificateParams {

    pub not_before: OffsetDateTime,
    pub not_after: OffsetDateTime,
    pub serial_number: Option<SerialNumber>,
    pub subject_alt_names: Vec<SanType>,
    pub distinguished_name: DistinguishedName,
    pub is_ca: IsCa,
    pub key_usages: Vec<KeyUsagePurpose>,
    pub extended_key_usages: Vec<ExtendedKeyUsagePurpose>,
    pub name_constraints: Option<NameConstraints>,
    pub crl_distribution_points: Vec<CrlDistributionPoint>,
    pub custom_extensions: Vec<CustomExtension>,
    pub use_authority_key_identifier_extension: bool,
    pub key_identifier_method: KeyIdMethod,
}

Parameters used for certificate generation

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

not_before: OffsetDateTime

not_after: OffsetDateTime

serial_number: Option<SerialNumber>

subject_alt_names: Vec<SanType>

distinguished_name: DistinguishedName

is_ca: IsCa

key_usages: Vec<KeyUsagePurpose>

extended_key_usages: Vec<ExtendedKeyUsagePurpose>

name_constraints: Option<NameConstraints>

crl_distribution_points: Vec<CrlDistributionPoint>

An optional list of certificate revocation list (CRL) distribution points as described in RFC 5280 Section 4.2.1.13¹. Each distribution point contains one or more URIs where an up-to-date CRL with scope including this certificate can be retrieved.

---

1. https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.13 ↩

custom_extensions: Vec<CustomExtension>

use_authority_key_identifier_extension: bool

If true, the ‘Authority Key Identifier’ extension will be added to the generated cert

key_identifier_method: KeyIdMethod

Method to generate key identifiers from public keys

Defaults to a truncated SHA-256 digest. See KeyIdMethod for more information.

Implementations

impl CertificateParams

pub fn new(subject_alt_names: impl Into<Vec<String>>) -> Result<Self, Error>

Generate certificate parameters with reasonable defaults

pub fn signed_by( self, key_pair: &KeyPair, issuer: &Certificate, issuer_key: &KeyPair ) -> Result<Certificate, Error>

Generate a new certificate from the given parameters, signed by the provided issuer.

The returned certificate will have its issuer field set to the subject of the provided issuer, and the authority key identifier extension will be populated using the subject public key of issuer. It will be signed by issuer_key.

Note that no validation of the issuer certificate is performed. Rcgen will not require the certificate to be a CA certificate, or have key usage extensions that allow signing.

The returned Certificate may be serialized using Certificate::der and Certificate::pem.

pub fn self_signed(self, key_pair: &KeyPair) -> Result<Certificate, Error>

Generates a new self-signed certificate from the given parameters.

The returned Certificate may be serialized using Certificate::der and Certificate::pem.

pub fn from_ca_cert_pem(pem_str: &str) -> Result<Self, Error>

Available on crate features pem and x509-parser only.

Parses an existing ca certificate from the ASCII PEM format.

See from_ca_cert_der for more details.

pub fn from_ca_cert_der(ca_cert: &CertificateDer<'_>) -> Result<Self, Error>

Available on crate feature x509-parser only.

Parses an existing ca certificate from the DER format.

This function is only of use if you have an existing CA certificate you would like to use to sign a certificate generated by rcgen. By providing the constructed CertificateParams and the KeyPair associated with your existing ca_cert you can use CertificateParams::signed_by() or crate::CertificateSigningRequestParams::signed_by() to issue new certificates using the CA cert.

In general this function only extracts the information needed for signing. Other attributes of the Certificate may be left as defaults.

This function assumes the provided certificate is a CA. It will not check for the presence of the BasicConstraints extension, or perform any other validation.

rustls_pemfile::certs() is often used to obtain a CertificateDer from PEM input. If you already have a byte slice containing DER, it can trivially be converted into CertificateDer using the Into trait.

pub fn serialize_request( &self, subject_key: &KeyPair ) -> Result<CertificateSigningRequest, Error>

Generate and serialize a certificate signing request (CSR).

The constructed CSR will contain attributes based on the certificate parameters, and include the subject public key information from subject_key. Additionally, the CSR will be self-signed using the subject key.

Note that subsequent invocations of serialize_request() will not produce the exact same output.

Trait Implementations

impl Clone for CertificateParams

fn clone(&self) -> CertificateParams

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Default for CertificateParams

fn default() -> Self

Returns the “default value” for a type.