Module ess 

Original ESS certificate bindings and signed validation-set restrictions.

Structs

Bindings

Both independent answers; absence does not imply a successful binding.

CertificateId

One readable certificate identifier; hash verification is a separate step.

IssuerSerial

Original certificate issuer names and serial, without normalization/copying.

IssuerSerialReading

Original standalone ESS issuer hint and independently retained diagnostics.

SigningAttributes

Both independently evaluated ESS attributes, with placement/cardinality diagnostics separate from certificate/hash/path checking.

SigningCertificate

One signing-certificate value, preserving the whole signed validation set. V1 and V2 values are evaluated independently (RFC5035 §2).

Enums

Binding

Agreement of one ESS first identifier with a caller-selected certificate. None of these answers independently establishes signature/path trust or erases the parsed attribute’s conformance/restriction diagnostics.

BindingError

Resource, source-pass and provider failures remain outside semantic answers.

CertificateReading

Later identifiers must remain in the signed restriction set even if unreadable.

IssuerAgreement

Agreement of the optional signed issuer/serial restriction alone. Hash agreement, retained faults and certificate trust remain separate.

IssuerReading

Optional issuerSerial is never silently discarded after a read failure.

Version

The signed attribute’s schema, not the CMS content digest algorithm.