Struct PeerCertificate 

pub struct PeerCertificate {
    pub leaf_der: Bytes,
    pub subject_cn: Option<Arc<str>>,
    pub san_dns: Arc<[Arc<str>]>,
    pub fingerprint_sha256: Arc<str>,
    pub spki_sha256: Arc<str>,
    pub issuer_cn: Option<Arc<str>>,
    pub serial: Arc<str>,
}

Verified client certificate captured at TLS handshake time, with every predicate-readable field pre-extracted so the per-Check dispatch is allocation-light. Built once by the engine’s post-handshake population (run_tls); the seven tls.peer_cert.* predicates read pre-computed strings off this struct rather than re-parsing the DER on every test.

leaf_der retains the raw DER bytes so future predicates (or a post-MVP debug surface) can re-derive any field x509-parser exposes; the seven currently-spec’d fields are pre-extracted.

All String-typed fields are byte-for-byte canonical: hex digests are ASCII-lowercase; serial is hex (lowercase, no leading-zero stripping). See spec/crates/core.md § Predicate for the canonical formats.

Fields

leaf_der: Bytes

Raw leaf cert DER. Retained for future predicates that need fields not pre-extracted; current readers should use the pre-extracted scalar fields below.

subject_cn: Option<Arc<str>>

All String / Vec<String> predicate-readable fields are stored as Arc<str> / Arc<[Arc<str>]> so per-Check predicate dispatch can hand out borrowed &str slices instead of cloning ~30ns Strings inside the connection Mutex<Option<TlsInfo>> guard.

san_dns: Arc<[Arc<str>]>

fingerprint_sha256: Arc<str>

spki_sha256: Arc<str>

issuer_cn: Option<Arc<str>>

serial: Arc<str>

Implementations

impl PeerCertificate

pub fn from_der(leaf_der: &CertificateDer<'_>) -> Option<Self>

Pre-extract every tls.peer_cert.* predicate-readable field from a raw leaf cert DER. Returns None when the bytes are not a parseable X.509v3 certificate; the caller treats that as “no verified peer cert” (sound-by-default per spec).

Trait Implementations

impl Clone for PeerCertificate

fn clone(&self) -> PeerCertificate

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PeerCertificate

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for PeerCertificate

fn default() -> PeerCertificate

Returns the “default value” for a type.