Struct PinnedServerCertVerifier

pub struct PinnedServerCertVerifier<T>
where
    T: AsRef<[Certificate]> + Send + Sync,
{ /* private fields */ }

A struct for TLS clients to verify the server’s certificate. Implements certificate pinning. It accepts the server’s certificate if it is identical to any of the certificates in the struct.

The rustls library has an open issue to add something like this: “Implement support for certificate pinning” https://github.com/ctz/rustls/issues/227

Example

use std::net::TcpStream;
use std::sync::Arc;
use rustls_pin::{
    arbitrary_dns_name,
    PinnedServerCertVerifier
};
let mut tcp_stream =
    TcpStream::connect(addr).unwrap();
let mut config = rustls::ClientConfig::new();
config.dangerous().set_certificate_verifier(
    Arc::new(
        PinnedServerCertVerifier::new(vec![
            server_cert1,
            server_cert2
        ]),
    )
);
let mut session = rustls::ClientSession::new(
    &Arc::new(config),
    arbitrary_dns_name().as_ref()
);
let mut stream = rustls::Stream::new(
    &mut session, &mut tcp_stream);

Implementations

impl<T> PinnedServerCertVerifier<T>

where T: AsRef<[Certificate]> + Send + Sync,

pub fn new(certs: T) -> Self

Trait Implementations

impl<T> ServerCertVerifier for PinnedServerCertVerifier<T>

where T: AsRef<[Certificate]> + Send + Sync,

fn verify_server_cert( &self, _roots: &RootCertStore, presented_certs: &[Certificate], _dns_name: DNSNameRef<'_>, _ocsp_response: &[u8], ) -> Result<ServerCertVerified, TLSError>

Verify a the certificate chain presented_certs against the roots configured in roots. Make sure that dns_name is quoted by the top certificate in the chain.

fn verify_tls12_signature( &self, message: &[u8], cert: &Certificate, dss: &DigitallySignedStruct, ) -> Result<HandshakeSignatureValid, TLSError>

Verify a signature allegedly by the given server certificate.

fn verify_tls13_signature( &self, message: &[u8], cert: &Certificate, dss: &DigitallySignedStruct, ) -> Result<HandshakeSignatureValid, TLSError>

Verify a signature allegedly by the given server certificate.

fn supported_verify_schemes(&self) -> Vec<SignatureScheme>

Return the list of SignatureSchemes that this verifier will handle, in verify_tls12_signature and verify_tls13_signature calls.