Expand description
Certificates, read into a model that keeps what a decision needs.
A certificate is read once and kept as it arrived: every field borrows the document, and the bytes a signature is computed over are handed back as the range they occupy rather than re-encoded from what was understood. A parser that re-encodes has decided that its own understanding is the document, and a signature checked over that says nothing about the file somebody was sent.
Two kinds of fault are kept apart, because they lead to different answers.
What cannot be represented honestly is refused: an unreadable encoding, a field the certificate’s own version says is not there, two copies of one extension with no way to say which applies, or an algorithm named outside the signed bytes that differs from the one named inside them.
What can be represented is reported rather than refused, even when it is wrong: a negative serial number, a validity interval that ends before it starts, a critical extension nobody here knows. Refusing those would leave the product unable to explain a document a person is holding, and explaining is the product.
Re-exports§
pub use algorithm::AlgorithmIdentifier;pub use certificate::Certificate;pub use certificate::TbsCertificate;pub use certificate::Validity;pub use certificate::Version;pub use error::Error;pub use error::ErrorCode;pub use error::Result;pub use extension::Extension;pub use extension::Extensions;pub use extension::Recognizer;pub use key::PublicKeyInfo;pub use name::Attribute;pub use name::Name;pub use name::Ordered;pub use time::Time;
Modules§
- access
- Where things related to a certificate are published.
- algorithm
- Which algorithm, and the parameters that go with it.
- certificate
- The certificate: what it says, and the bytes that were signed.
- constraints
- What a certificate may certify below itself.
- crl
- Borrowed certificate revocation lists and their original signed ranges.
- der
- Holding a range to the distinguished rules.
- error
- What was wrong with a certificate, and which field it was in.
- extension
- The extensions a certificate carries, kept whether or not they are understood.
- general_
name - The several kinds of name an extension can carry.
- identifier
- The identifiers that say which key signed a certificate and which key it carries.
- key
- The public key a certificate carries.
- name
- Distinguished names, kept as they were encoded.
- ocsp
- OCSP response evidence over original caller-supplied DER ranges.
- oid
- The object identifiers this crate names.
- path
- Certification paths: which sequences of certificates lead from a certificate to an anchor the caller trusts, and what that costs.
- policy
- The policies a certificate was issued under.
- qualified
- What a certificate claims about being a qualified certificate.
- temporal
- UTC arithmetic with caller-supplied leap-second facts.
- time
- The two ways a certificate writes a moment, read into one.
- usage
- What a key may be used for.