pub struct X509Certificate<'a> {
    pub tbs_certificate: TbsCertificate<'a>,
    pub signature_algorithm: AlgorithmIdentifier<'a>,
    pub signature_value: BitString<'a>,
}
Expand description

An X.509 v3 Certificate.

X.509 v3 certificates are defined in RFC5280, section 4.1. This object uses the same structure for content, so for ex the subject can be accessed using the path x509.tbs_certificate.subject.

X509Certificate also contains convenience methods to access the most common fields (subject, issuer, etc.). These are provided using Deref<Target = TbsCertificate>, so documentation for these methods can be found in the TbsCertificate object.

A X509Certificate is a zero-copy view over a buffer, so the lifetime is the same as the buffer containing the binary representation.

fn display_x509_info(x509: &X509Certificate<'_>) {
     let subject = x509.subject();
     let issuer = x509.issuer();
     println!("X.509 Subject: {}", subject);
     println!("X.509 Issuer: {}", issuer);
     println!("X.509 serial: {}", x509.tbs_certificate.raw_serial_as_string());
}

Fields

tbs_certificate: TbsCertificate<'a>signature_algorithm: AlgorithmIdentifier<'a>signature_value: BitString<'a>

Implementations

Available on crate feature verify only.

Verify the cryptographic signature of this certificate

public_key is the public key of the signer. For a self-signed certificate, (for ex. a public root certificate authority), this is the key from the certificate, so you can use None.

For a leaf certificate, this is the public key of the certificate that signed it. It is usually an intermediate authority.

Not all algorithms are supported, this function is limited to what ring supports.

Methods from Deref<Target = TbsCertificate<'a>>

Get the version of the encoded certificate

Get the certificate subject.

Get the certificate issuer.

Get the certificate validity.

Get the certificate public key information.

Returns the certificate extensions

Returns an iterator over the certificate extensions

Searches for an extension with the given Oid.

Return Ok(Some(extension)) if exactly one was found, Ok(None) if none was found, or an error DuplicateExtensions if the extension is present twice or more.

👎 Deprecated since 0.13.0:

Do not use this function (duplicate extensions are not checked), use get_extension_unique

Searches for an extension with the given Oid.

Duplicate extensions

Note: if there are several extensions with the same Oid, the first one is returned, masking other values.

RFC5280 forbids having duplicate extensions, but does not specify how errors should be handled.

Because of this, the find_extension method is not safe and should not be used! The get_extension_unique method checks for duplicate extensions and should be preferred.

Builds and returns a map of extensions.

If an extension is present twice, this will fail and return DuplicateExtensions.

Attempt to get the certificate Basic Constraints extension

Return Ok(Some(extension)) if exactly one was found, Ok(None) if none was found, or an error if the extension is present twice or more.

Attempt to get the certificate Key Usage extension

Return Ok(Some(extension)) if exactly one was found, Ok(None) if none was found, or an error if the extension is invalid, or is present twice or more.

Attempt to get the certificate Extended Key Usage extension

Return Ok(Some(extension)) if exactly one was found, Ok(None) if none was found, or an error if the extension is invalid, or is present twice or more.

Attempt to get the certificate Policy Constraints extension

Return Ok(Some(extension)) if exactly one was found, Ok(None) if none was found, or an error if the extension is invalid, or is present twice or more.

Attempt to get the certificate Policy Constraints extension

Return Ok(Some(extension)) if exactly one was found, Ok(None) if none was found, or an error if the extension is invalid, or is present twice or more.

Attempt to get the certificate Policy Mappings extension

Return Ok(Some(extension)) if exactly one was found, Ok(None) if none was found, or an error if the extension is invalid, or is present twice or more.

Attempt to get the certificate Subject Alternative Name extension

Return Ok(Some(extension)) if exactly one was found, Ok(None) if none was found, or an error if the extension is invalid, or is present twice or more.

Attempt to get the certificate Name Constraints extension

Return Ok(Some(extension)) if exactly one was found, Ok(None) if none was found, or an error if the extension is invalid, or is present twice or more.

Returns true if certificate has basicConstraints CA:true

Get the raw bytes of the certificate serial number

Get a formatted string of the certificate serial number, separated by ‘:’

Trait Implementations

Returns a copy of the value. Read more

Performs copy-assignment from source. Read more

Formats the value using the given formatter. Read more

The resulting type after dereferencing.

Dereferences the value.

Parse a DER-encoded X.509 Certificate, and return the remaining of the input and the built object.

The returned object uses zero-copy, and so has the same lifetime as the input.

Note that only parsing is done, not validation.

Certificate  ::=  SEQUENCE  {
        tbsCertificate       TBSCertificate,
        signatureAlgorithm   AlgorithmIdentifier,
        signatureValue       BIT STRING  }
Example

To parse a certificate and print the subject and issuer:

let res = parse_x509_certificate(DER);
match res {
    Ok((_rem, x509)) => {
        let subject = x509.subject();
        let issuer = x509.issuer();
        println!("X.509 Subject: {}", subject);
        println!("X.509 Issuer: {}", issuer);
    },
    _ => panic!("x509 parsing failed: {:?}", res),
}

A parser takes in input type, and returns a Result containing either the remaining input and the output value, or an error Read more

Maps a function over the result of a parser

Creates a second parser from the output of the first one, then apply over the rest of the input

Applies a second parser over the output of the first one

Applies a second parser after the first one, return their results as a tuple

Applies a second parser over the input if the first one failed

automatically converts the parser’s output and error values to another type, as long as they implement the From trait Read more

This method tests for self and other values to be equal, and is used by ==. Read more

This method tests for !=.

👎 Deprecated since 0.13.0:

please use X509StructureValidator instead

Attempts to validate current item. Read more

👎 Deprecated since 0.13.0:

please use X509StructureValidator instead

Attempts to validate current item, storing warning and errors in Vec. Read more

Auto Trait Implementations

Blanket Implementations

Gets the TypeId of self. Read more

Immutably borrows from an owned value. Read more

Mutably borrows from an owned value. Read more

Returns the argument unchanged.

Calls U::from(self).

That is, this conversion is whatever the implementation of From<T> for U chooses to do.

The resulting type after obtaining ownership.

Creates owned data from borrowed data, usually by cloning. Read more

Uses borrowed data to replace owned data, usually by cloning. Read more

The type returned in the event of a conversion error.

Performs the conversion.

The type returned in the event of a conversion error.

Performs the conversion.