Struct Authority 

pub struct Authority { /* private fields */ }

The authority’s certificate and the key that signs with it.

Implementations

impl Authority

pub fn create(suffix: &str) -> Result<Self>

Create an authority permitted to vouch for suffix and nothing else.

pub fn certificate_pem(&self) -> &str

The authority’s certificate, as PEM. The half that is safe to hand out.

pub fn suffix(&self) -> &str

pub fn leaf_for(&self, name: &str) -> Result<Leaf>

A certificate for one name under the suffix.

One concrete name, not a wildcard, and that is a measured decision rather than a preference. *.ssh-browser is refused by Chromium with ERR_CERT_COMMON_NAME_INVALID: the suffix is not a known registry, so a wildcard directly beneath it reads as one spanning an entire top-level domain, which no browser will accept. A certificate naming e2e.ssh-browser outright, from the same authority, loads — with isSecureContext, service workers and crypto.subtle all present, which is the whole point of the mode.

So there is one certificate per alias, minted when a handshake first asks for that name.