Struct CrlSet 

#[non_exhaustive]
pub struct CrlSet {
    pub cache: RwLock<HashMap<String, CachedCrl>>,
    pub roots: Arc<RootCertStore>,
    pub config: MtlsConfig,
    pub discover_tx: UnboundedSender<String>,
    /* private fields */
}

Shared CRL state backing the dynamic mTLS verifier.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

cache: RwLock<HashMap<String, CachedCrl>>

👎Deprecated since 3.8.0:

mutating the CRL cache out of band is detected and denies handshakes; this field becomes private in 4.0

Cached CRLs keyed by URL.

⚠️ Deprecated

Writing through this field bypasses the atomic commit path and desynchronises the published coverage hint from the live verifier. Since 3.8 such a write is detected and fails the handshake closed rather than silently admitting a certificate whose revocation status cannot be enforced. Reads remain safe but are not part of the supported surface. The field becomes private in 4.0.

roots: Arc<RootCertStore>

Immutable client-auth root store.

config: MtlsConfig

mTLS CRL configuration.

discover_tx: UnboundedSender<String>

Fire-and-forget discovery channel for newly-seen CDP URLs.

Implementations

impl CrlSet

pub async fn force_refresh(&self) -> Result<(), RmcpServerKitError>

Force an immediate refresh of all currently known CRL URLs.

Errors

Returns an error if rebuilding the inner verifier fails.