Crate rustls_crl_refresh 

Process-wide CRL cache plus refreshable rustls verifiers.

See the crate-level README for the design rationale. The short version: rustls’s WebPkiClientVerifier / WebPkiServerVerifier bake the CRL list into the verifier at construction time, so refreshing CRL bytes requires rebuilding the surrounding ServerConfig / ClientConfig. Long-running servers that keep Arc-identity-keyed connection pools (hyper-util’s legacy::Client, quinn::Endpoint, …) pay a real cost when those configs churn. This crate keeps the configs stable: a CrlCache holds the latest bytes per source, and RefreshableClientCertVerifier / RefreshableServerCertVerifier reconstruct the inner WebPkiVerifier per handshake against the fresh snapshot.

Structs

CrlCache

Process-wide CRL cache.

RefreshableClientCertVerifier

Listener-side wrapper that defers to a WebPkiClientVerifier rebuilt only when the cached CRL snapshot’s Arc identity changes, against the latest CRL bytes pulled from the cache.

RefreshableServerCertVerifier

Upstream-side counterpart. Reuses a cached WebPkiServerVerifier across handshakes when the CRL snapshot’s Arc identity is unchanged; rebuilds only after a refresh swaps the underlying bytes.

Enums

CrlFetchFailure

Per-source policy on what to do when a CRL becomes unavailable.

CrlSourceId

Source identity used as the cache key. The fingerprint hashes the path / URL string, not the fetched bytes — so refresh cycles never invalidate downstream caches keyed off this identity.

Traits

CrlFetcher

Pluggable transport. Production wires up an HTTP / tokio::fs fetcher; tests substitute in-memory mocks to drive failure paths and rotation.

Functions

dedupe_crl_sources

Dedupe a CRL source list by CrlSourceId, keeping the strictest policy (CrlFetchFailure::Reject wins over CrlFetchFailure::Tolerate) when the same source appears multiple times. Order in the result is the first-seen order.

read_crl_file

Read a CRL file from disk and return raw DER bytes. PEM-armoured inputs are decoded; non-PEM inputs pass through unchanged. Useful for CrlFetcher implementations that back CrlSourceId::File.