Struct ChainSpec 

pub struct ChainSpec {
    pub leaf_cn: String,
    pub leaf_sans: Vec<String>,
    pub root_cn: String,
    pub intermediate_cn: String,
    pub rsa_bits: usize,
    pub root_validity_days: u32,
    pub intermediate_validity_days: u32,
    pub leaf_validity_days: u32,
    pub leaf_not_before: Option<NotBeforeOffset>,
    pub intermediate_not_before: Option<NotBeforeOffset>,
    pub intermediate_is_ca: Option<bool>,
    pub intermediate_key_usage: Option<KeyUsage>,
}

Specification for generating a three-level X.509 certificate chain (root CA -> intermediate CA -> leaf).

Fields

leaf_cn: String

Common Name (CN) for the leaf certificate.

leaf_sans: Vec<String>

DNS Subject Alternative Names for the leaf certificate.

root_cn: String

Common Name (CN) for the root CA.

intermediate_cn: String

Common Name (CN) for the intermediate CA.

rsa_bits: usize

RSA key size in bits.

root_validity_days: u32

Root CA validity period in days.

intermediate_validity_days: u32

Intermediate CA validity period in days.

leaf_validity_days: u32

Leaf certificate validity period in days.

leaf_not_before: Option<NotBeforeOffset>

Override for leaf not_before relative to the deterministic base time.

When None, not_before = base_time - 1 day (the default).

intermediate_not_before: Option<NotBeforeOffset>

Override for intermediate not_before relative to the deterministic base time.

When None, not_before = base_time - 1 day (the default).

intermediate_is_ca: Option<bool>

Optional override for whether the intermediate claims CA status.

When None, the intermediate remains a CA.

intermediate_key_usage: Option<KeyUsage>

Optional override for the intermediate key usage bits.

When None, the intermediate uses standard CA key usage.

Implementations

impl ChainSpec

pub fn new(leaf_cn: impl Into<String>) -> ChainSpec

Create a chain spec with sensible defaults for the given leaf CN.

The leaf CN is automatically added to the SAN list.

pub fn with_sans(self, sans: Vec<String>) -> ChainSpec

Set the DNS Subject Alternative Names for the leaf certificate.

The leaf CN is not automatically added; include it explicitly if needed.

pub fn with_root_cn(self, cn: impl Into<String>) -> ChainSpec

Set the root CA Common Name.

pub fn with_intermediate_cn(self, cn: impl Into<String>) -> ChainSpec

Set the intermediate CA Common Name.

pub fn with_rsa_bits(self, bits: usize) -> ChainSpec

Set the RSA key size in bits.

pub fn with_root_validity_days(self, days: u32) -> ChainSpec

Set the root CA validity period in days.

pub fn with_intermediate_validity_days(self, days: u32) -> ChainSpec

Set the intermediate CA validity period in days.

pub fn with_leaf_validity_days(self, days: u32) -> ChainSpec

Set the leaf certificate validity period in days.

pub fn with_leaf_not_before(self, offset: NotBeforeOffset) -> ChainSpec

Set the leaf not_before override.

pub fn with_intermediate_not_before(self, offset: NotBeforeOffset) -> ChainSpec

Set the intermediate not_before override.

pub fn with_intermediate_is_ca(self, is_ca: bool) -> ChainSpec

Override whether the intermediate claims CA status.

pub fn with_intermediate_key_usage(self, key_usage: KeyUsage) -> ChainSpec

Override the intermediate key usage bits.

pub fn stable_bytes(&self) -> Vec<u8>

Stable byte representation for deterministic derivation.

SANs are sorted and deduplicated before encoding for stability.

For backward compatibility, specs that only use the pre-#279 surface keep the legacy v2 encoding so existing good/expired chain fixtures do not drift. Richer time offsets and intermediate overrides use v3.

Trait Implementations

impl Clone for ChainSpec

fn clone(&self) -> ChainSpec

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ChainSpec

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Hash for ChainSpec

fn hash<__H>(&self, state: &mut __H)

where __H: Hasher,

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for ChainSpec

fn eq(&self, other: &ChainSpec) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Eq for ChainSpec

impl StructuralPartialEq for ChainSpec