Struct PKCS11ClientCertResolver 

pub struct PKCS11ClientCertResolver { /* private fields */ }

Implementations

impl PKCS11ClientCertResolver

pub fn new(pin: Option<&str>, path: &OsStr) -> Result<Self, Box<dyn Error>>

Create a new PKCS11ClientCertResolver.

Arguments

• pin - An optional &str of the pin that unlocks the device. Set to None if device does not need a pin to unlock.
• path - Absolute filepath to the PKCS11 library of your device.

Examples

let pin = Some("123456");
let tls = rustls::ClientConfig::builder()
   .with_root_certificates(root_certs)
   .with_client_cert_resolver(Arc::new(
       PKCS11ClientCertResolver::new(pin, "/usr/lib/opensc-pkcs11.so")?
   ));

Errors

Authenticator devices are complicated things. A lot can go wrong along the way. To alleviate this, most checks happen at instantiation time here, therefore errors yielded here can have a plethora of reasons:

• the PKCS11 library could not be loaded under the file path.
• the pin is missing or incorrect.
• the authenticator device is not present or inaccessible.
• the PKCS11 library has problems communicating with the authenticator device.
• the authenticator device cannot read an appropriate certificate from the relevant slot.
• the authenticator device’s certificate signature scheme is not supported.

Trait Implementations

impl Debug for PKCS11ClientCertResolver

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl ResolvesClientCert for PKCS11ClientCertResolver

fn resolve( &self, _acceptable_issuers: &[&[u8]], _sigschemes: &[SignatureScheme], ) -> Option<Arc<CertifiedKey>>

Resolve a client certificate chain/private key to use as the client’s identity.

fn has_certs(&self) -> bool

Return true if any certificates at all are available.

fn only_raw_public_keys(&self) -> bool

Return true if the client only supports raw public keys.