Struct CertificatePool 

pub struct CertificatePool { /* private fields */ }

A pool of trusted root and intermediate certificates for verification

Implementations

impl CertificatePool

pub fn from_embedded_trust_root() -> Result<Self, CertVerificationError>

Load the default Fulcio trusted roots from embedded trusted_root.json

pub fn from_trusted_root( trusted_root: TrustedRoot, ) -> Result<Self, CertVerificationError>

Create a certificate pool from a TrustedRoot structure

pub fn verify_pem_cert( &self, cert_pem: &[u8], integrated_time: i64, ) -> Result<(), CertVerificationError>

Verify a certificate chain from a PEM-encoded certificate

Arguments

• cert_pem - PEM-encoded certificate (leaf certificate)
• integrated_time - Unix timestamp when signature was created (from Rekor)

Security

This performs full RFC 5280 path validation including:

• Signature verification at each level
• Validity period checking
• Key usage validation
• Chain building up to trusted root

pub fn verify_der_cert( &self, cert_der: &[u8], integrated_time: i64, ) -> Result<(), CertVerificationError>

Verify a certificate chain from DER-encoded certificate