Module certificate

rtc::peer_connection

Module certificate 

Source
Expand description

X.509 certificate management for WebRTC DTLS authentication.

This module provides certificate generation, serialization, and management functionality required for securing WebRTC peer-to-peer connections via DTLS (Datagram Transport Layer Security).

§Overview

WebRTC uses DTLS to encrypt media and data channels. Each peer must have an X.509 certificate to establish secure connections. This module handles:

  • Certificate Generation - Create self-signed certificates with various key types
  • Certificate Persistence - Serialize/deserialize certificates in PEM format
  • Fingerprint Calculation - Generate SHA-256 fingerprints for SDP signaling
  • Identity Management - Maintain consistent identity across sessions

§Certificate Types

Three cryptographic algorithms are supported:

AlgorithmPerformanceSecurityRecommendation
ECDSA P-256FastStrong✅ Recommended for most cases
Ed25519FastestStrongest✅ Best for security-critical apps
RSA-2048SlowStrong⚠️ Generation not available

§Examples

§Quick Start - Generate and Use Certificate

use rtc::peer_connection::RTCPeerConnection;
use rtc::peer_connection::configuration::RTCConfigurationBuilder;
use rtc::peer_connection::certificate::RTCCertificate;
use rcgen::KeyPair;

// Generate ECDSA certificate (recommended)
let key_pair = KeyPair::generate_for(&rcgen::PKCS_ECDSA_P256_SHA256)?;
let certificate = RTCCertificate::from_key_pair(key_pair)?;

// Use in peer connection
let config = RTCConfigurationBuilder::new()
    .with_certificates(vec![certificate])
    .build();

let peer_connection = RTCPeerConnection::new(config)?;

§Generate Certificate with Ed25519 (Highest Security)

use rtc::peer_connection::certificate::RTCCertificate;
use rcgen::KeyPair;

// Ed25519 provides the best security with excellent performance
let key_pair = KeyPair::generate_for(&rcgen::PKCS_ED25519)?;
let certificate = RTCCertificate::from_key_pair(key_pair)?;

// Get fingerprint for SDP signaling
let fingerprints = certificate.get_fingerprints();
println!("Fingerprint: {}", fingerprints[0].value);

§Persist Certificate Across Sessions

use rtc::peer_connection::certificate::RTCCertificate;
use rcgen::KeyPair;
use std::fs;

// First run: Generate and save certificate
let key_pair = KeyPair::generate_for(&rcgen::PKCS_ECDSA_P256_SHA256)?;
let certificate = RTCCertificate::from_key_pair(key_pair)?;
let pem_data = certificate.serialize_pem();
fs::write("my_cert.pem", pem_data)?;

// Later runs: Load existing certificate
let pem_data = fs::read_to_string("my_cert.pem")?;
let certificate = RTCCertificate::from_pem(&pem_data)?;
// Same identity maintained across restarts!

§Extract Fingerprints for SDP Signaling

use rtc::peer_connection::certificate::RTCCertificate;
use rcgen::KeyPair;

let key_pair = KeyPair::generate_for(&rcgen::PKCS_ECDSA_P256_SHA256)?;
let certificate = RTCCertificate::from_key_pair(key_pair)?;

// Get fingerprints for SDP offer/answer
let fingerprints = certificate.get_fingerprints();
for fp in fingerprints {
    // Format for SDP: a=fingerprint:sha-256 XX:XX:XX:...
    println!("a=fingerprint:{} {}", fp.algorithm, fp.value);
}

§Compare Certificate Algorithms

use rtc::peer_connection::certificate::RTCCertificate;
use rcgen::KeyPair;
use std::time::Instant;

// ECDSA P-256: Good balance of speed and security
let start = Instant::now();
let ecdsa_kp = KeyPair::generate_for(&rcgen::PKCS_ECDSA_P256_SHA256)?;
let _ecdsa_cert = RTCCertificate::from_key_pair(ecdsa_kp)?;
println!("ECDSA generation: {:?}", start.elapsed());

// Ed25519: Fastest and most secure
let start = Instant::now();
let ed_kp = KeyPair::generate_for(&rcgen::PKCS_ED25519)?;
let _ed_cert = RTCCertificate::from_key_pair(ed_kp)?;
println!("Ed25519 generation: {:?}", start.elapsed());

§Using External Certificate

use rtc::peer_connection::certificate::RTCCertificate;
use std::time::{SystemTime, Duration};

// Use certificate from hardware security module or external source
let expires = SystemTime::now() + Duration::from_secs(365 * 86400); // 1 year
let certificate = RTCCertificate::from_existing(dtls_cert, expires);

// Certificate is ready to use in WebRTC connections

§Security Considerations

§Private Key Protection

  • Never transmit private keys over the network
  • Store serialized certificates securely (encrypted storage recommended)
  • Use appropriate file permissions when saving to disk (0600 on Unix)
  • Consider using platform keystores for production applications

§Certificate Expiration

  • Default expiration is platform-dependent
  • On ARM platforms, certificates expire after 48 hours (workaround for overflow bug)
  • Check certificate validity before each connection
  • Regenerate certificates before they expire

§Fingerprint Verification

  • Always verify remote fingerprints via trusted signaling channel
  • Mismatched fingerprints indicate MITM attack - abort connection
  • Use out-of-band verification for high-security scenarios

§Feature Flags

  • pem - Enable PEM serialization/deserialization (enabled by default)

§Specifications

Structs§

RTCCertificate
X.509 certificate used to authenticate WebRTC peer-to-peer communications.