Struct CaCert 

pub struct CaCert {
    pub v: u32,
    pub active_kid: String,
    pub active_pubkey_b64: String,
    pub issued_at: String,
    pub expires_at: String,
    pub cluster_domain: String,
    pub sig_by_ca: String,
}

“CA certificate” minted by the cluster CA at every rotation of the active signing key.

Provides the binding: active_kid was issued by the cluster whose ca_public_key_b64 is published in this cluster’s TrustBundle. The signature sig_by_ca is the CA’s Ed25519 signature over serde_json::to_vec(&CaCertCore { active_kid, active_pubkey_b64, issued_at, expires_at, cluster_domain }) (i.e. the same struct with the sig_by_ca field stripped).

Field declaration order is canonical for signing. Do NOT reorder without bumping CA_CERT_FORMAT_VERSION and adding a migration.

Fields

v: u32

Format version for the CA cert body. 1 today.

active_kid: String

kid of the active signing key this cert is binding.

active_pubkey_b64: String

URL-safe no-pad base64 of the active signing key’s verifying key.

issued_at: String

RFC3339 timestamp when this cert was issued.

expires_at: String

RFC3339 timestamp when this cert expires. Should match the active key’s own grace expiry so the cert and key share a retirement clock.

cluster_domain: String

Cluster identity this cert binds to. Defaults to the cluster’s UUID; operators may override to a DNS-style name like prod.zlayer.example.

sig_by_ca: String

Ed25519 signature of the CA over serde_json::to_vec(&self with sig_by_ca cleared). URL-safe no-pad base64.

Trait Implementations

impl Clone for CaCert

fn clone(&self) -> CaCert

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl ComposeSchema for CaCert

fn compose(generics: Vec<RefOr<Schema>>) -> RefOr<Schema>

impl Debug for CaCert

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for CaCert

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for CaCert

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl ToSchema for CaCert

fn name() -> Cow<'static, str>

Return name of the schema.

fn schemas(schemas: &mut Vec<(String, RefOr<Schema>)>)

Implement reference utoipa::openapi::schema::Schemas for this type.