Struct CertificateResolver 

pub struct CertificateResolver {
    pub domains: TrieNode<Fingerprint>,
    /* private fields */
}

Parses and stores TLS certificates, makes them available to Rustls for TLS handshakes

the domains TrieNode is an addressing system to resolve a certificate for a given domain name. Certificates are stored in a hashmap that may contain unreachable certificates if no domain name points to it. Clone lets an HTTPS listener added next to a sibling on the same address take over its certificates (HttpsProxy::add_listener, lib/src/https.rs).

Fields

domains: TrieNode<Fingerprint>

routing one domain name to one certificate for fast resolving

Implementations

impl CertificateResolver

pub fn get_certificate( &self, fingerprint: &Fingerprint, ) -> Option<CertifiedKeyWrapper>

return the certificate in the Rustls-usable form

pub fn add_certificate( &mut self, add: &AddCertificate, ) -> Result<Fingerprint, CertificateResolverError>

persist a certificate, after ensuring validity, and checking if it can replace another certificate. return the certificate fingerprint regardless of having inserted it or not

pub fn remove_certificate( &mut self, fingerprint: &Fingerprint, ) -> Result<(), CertificateResolverError>

Delete a certificate from the resolver. May fail if there is no alternative for

pub fn replace_certificate( &mut self, replace: &ReplaceCertificate, ) -> Result<Fingerprint, CertificateResolverError>

Add the new certificate first, then remove the old one. This ordering ensures that the old certificate remains available if adding the new one fails.

pub fn domain_lookup( &self, domain: &[u8], accept_wildcard: bool, ) -> Option<&KeyValue<Key, Fingerprint>>

pub fn names_for_sni(&self, domain: &[u8]) -> Option<Vec<String>>

Resolve the SAN set Sōzu would serve for domain (the same trie lookup rustls uses, wildcard-aware via domain_lookup). Returns the certificate’s names exactly as stored — wildcards retain their leading *. so the caller can apply RFC 6125 §6.4.3 matching. None when no cert covers domain (rustls would fall back to DEFAULT_CERTIFICATE).

Mirrors MutexCertificateResolver::resolve minus the rustls glue, so the SAN snapshot taken at handshake matches the certificate the peer actually validated (RFC 7540 §9.1.1 / RFC 9113 §9.1.1 connection reuse).

Trait Implementations

impl Clone for CertificateResolver

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CertificateResolver

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for CertificateResolver

fn default() -> Self

Returns the “default value” for a type.