Module x509 

X.509 certificate validity (notBefore/notAfter) and the RFC 9773 ARI certificate id, read with a minimal DER walker — shared by ACME renewal and the TLS certificate-expiry metric, so it isn’t behind a feature. Certificate bytes may come from a CA or a file: every length is checked, nothing panics on malformed input.

Structs

CertInfo

What renewal needs from the leaf certificate: its validity window (Unix seconds) and its ACME Renewal Information certificate identifier (RFC 9773 §4.1), when it has an Authority Key Identifier.

Enums

SubjectAltName

A subjectAltName entry rws can match.

Functions

base64_decode_std

base64url

cert_info_from_der

CertInfo from a DER certificate. CA-supplied bytes: every length is checked by read_tlv, nothing panics on malformed input.

cert_info_from_pem

CertInfo of the first certificate in the PEM file at cert_path; None when it can’t be read or parsed. CertInfo of the first certificate in PEM text.

days_since_epoch

read_cert_info

subject_alt_names

The DNS and URI names of a DER certificate’s subjectAltName extension (OID 2.5.29.17); None when the certificate can’t be read. Backend certificates are untrusted input: loops only, every read bounded.