Struct TbsCertificate

pub struct TbsCertificate<'a> {
    pub version: X509Version,
    pub serial: BigUint,
    pub signature: AlgorithmIdentifier<'a>,
    pub issuer: X509Name<'a>,
    pub validity: Validity,
    pub subject: X509Name<'a>,
    pub subject_pki: SubjectPublicKeyInfo<'a>,
    pub issuer_uid: Option<UniqueIdentifier<'a>>,
    pub subject_uid: Option<UniqueIdentifier<'a>>,
    /* private fields */
}

Available on crate feature mtls only.

The sequence TBSCertificate contains information associated with the subject of the certificate and the CA that issued it.

RFC5280 definition:

  TBSCertificate  ::=  SEQUENCE  {
       version         [0]  EXPLICIT Version DEFAULT v1,
       serialNumber         CertificateSerialNumber,
       signature            AlgorithmIdentifier,
       issuer               Name,
       validity             Validity,
       subject              Name,
       subjectPublicKeyInfo SubjectPublicKeyInfo,
       issuerUniqueID  [1]  IMPLICIT UniqueIdentifier OPTIONAL,
                            -- If present, version MUST be v2 or v3
       subjectUniqueID [2]  IMPLICIT UniqueIdentifier OPTIONAL,
                            -- If present, version MUST be v2 or v3
       extensions      [3]  EXPLICIT Extensions OPTIONAL
                            -- If present, version MUST be v3
       }

Fields

version: X509Version

serial: BigUint

signature: AlgorithmIdentifier<'a>

issuer: X509Name<'a>

validity: Validity

subject: X509Name<'a>

subject_pki: SubjectPublicKeyInfo<'a>

issuer_uid: Option<UniqueIdentifier<'a>>

subject_uid: Option<UniqueIdentifier<'a>>

Implementations

impl<'a> TbsCertificate<'a>

pub fn version(&self) -> X509Version

Get the version of the encoded certificate

pub fn subject(&self) -> &X509Name<'_>

Get the certificate subject.

pub fn issuer(&self) -> &X509Name<'_>

Get the certificate issuer.

pub fn validity(&self) -> &Validity

Get the certificate validity.

pub fn public_key(&self) -> &SubjectPublicKeyInfo<'_>

Get the certificate public key information.

pub fn extensions(&self) -> &[X509Extension<'a>]

Returns the certificate extensions

pub fn iter_extensions(&self) -> impl Iterator<Item = &X509Extension<'a>>

Returns an iterator over the certificate extensions

pub fn get_extension_unique( &self, oid: &Oid<'_>, ) -> Result<Option<&X509Extension<'a>>, X509Error>

Searches for an extension with the given Oid.

Return Ok(Some(extension)) if exactly one was found, Ok(None) if none was found, or an error DuplicateExtensions if the extension is present twice or more.

pub fn find_extension(&self, oid: &Oid<'_>) -> Option<&X509Extension<'a>>

👎Deprecated since 0.13.0: Do not use this function (duplicate extensions are not checked), use get_extension_unique

Searches for an extension with the given Oid.

Duplicate extensions

Note: if there are several extensions with the same Oid, the first one is returned, masking other values.

RFC5280 forbids having duplicate extensions, but does not specify how errors should be handled.

Because of this, the find_extension method is not safe and should not be used! The get_extension_unique method checks for duplicate extensions and should be preferred.

pub fn extensions_map( &self, ) -> Result<HashMap<Oid<'_>, &X509Extension<'a>>, X509Error>

Builds and returns a map of extensions.

If an extension is present twice, this will fail and return DuplicateExtensions.

pub fn basic_constraints( &self, ) -> Result<Option<BasicExtension<&BasicConstraints>>, X509Error>

Attempt to get the certificate Basic Constraints extension

Return Ok(Some(extension)) if exactly one was found, Ok(None) if none was found, or an error if the extension is present twice or more.

pub fn key_usage(&self) -> Result<Option<BasicExtension<&KeyUsage>>, X509Error>

Attempt to get the certificate Key Usage extension

Return Ok(Some(extension)) if exactly one was found, Ok(None) if none was found, or an error if the extension is invalid, or is present twice or more.

pub fn extended_key_usage( &self, ) -> Result<Option<BasicExtension<&ExtendedKeyUsage<'_>>>, X509Error>

Attempt to get the certificate Extended Key Usage extension

Return Ok(Some(extension)) if exactly one was found, Ok(None) if none was found, or an error if the extension is invalid, or is present twice or more.

pub fn policy_constraints( &self, ) -> Result<Option<BasicExtension<&PolicyConstraints>>, X509Error>

Attempt to get the certificate Policy Constraints extension

Return Ok(Some(extension)) if exactly one was found, Ok(None) if none was found, or an error if the extension is invalid, or is present twice or more.

pub fn inhibit_anypolicy( &self, ) -> Result<Option<BasicExtension<&InhibitAnyPolicy>>, X509Error>

Attempt to get the certificate Policy Constraints extension

Return Ok(Some(extension)) if exactly one was found, Ok(None) if none was found, or an error if the extension is invalid, or is present twice or more.

pub fn policy_mappings( &self, ) -> Result<Option<BasicExtension<&PolicyMappings<'_>>>, X509Error>

Attempt to get the certificate Policy Mappings extension

Return Ok(Some(extension)) if exactly one was found, Ok(None) if none was found, or an error if the extension is invalid, or is present twice or more.

pub fn subject_alternative_name( &self, ) -> Result<Option<BasicExtension<&SubjectAlternativeName<'a>>>, X509Error>

Attempt to get the certificate Subject Alternative Name extension

Return Ok(Some(extension)) if exactly one was found, Ok(None) if none was found, or an error if the extension is invalid, or is present twice or more.

pub fn name_constraints( &self, ) -> Result<Option<BasicExtension<&NameConstraints<'_>>>, X509Error>

Attempt to get the certificate Name Constraints extension

Return Ok(Some(extension)) if exactly one was found, Ok(None) if none was found, or an error if the extension is invalid, or is present twice or more.

pub fn is_ca(&self) -> bool

Returns true if certificate has basicConstraints CA:true

pub fn raw_serial(&self) -> &'a [u8]

Get the raw bytes of the certificate serial number

pub fn raw_serial_as_string(&self) -> String

Get a formatted string of the certificate serial number, separated by ‘:’

Trait Implementations

impl<'a> AsRef<[u8]> for TbsCertificate<'a>

fn as_ref(&self) -> &[u8]

Converts this type into a shared reference of the (usually inferred) input type.

impl<'a> Clone for TbsCertificate<'a>

fn clone(&self) -> TbsCertificate<'a>

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<'a> Debug for TbsCertificate<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl<'a> FromDer<'a, X509Error> for TbsCertificate<'a>

fn from_der( i: &'a [u8], ) -> Result<(&'a [u8], TbsCertificate<'a>), Err<X509Error>>

Parse a DER-encoded TbsCertificate object

TBSCertificate  ::=  SEQUENCE  {
     version         [0]  Version DEFAULT v1,
     serialNumber         CertificateSerialNumber,
     signature            AlgorithmIdentifier,
     issuer               Name,
     validity             Validity,
     subject              Name,
     subjectPublicKeyInfo SubjectPublicKeyInfo,
     issuerUniqueID  [1]  IMPLICIT UniqueIdentifier OPTIONAL,
                          -- If present, version MUST be v2 or v3
     subjectUniqueID [2]  IMPLICIT UniqueIdentifier OPTIONAL,
                          -- If present, version MUST be v2 or v3
     extensions      [3]  Extensions OPTIONAL
                          -- If present, version MUST be v3 --  }

impl<'a> Parser<&'a [u8], TbsCertificate<'a>, X509Error> for TbsCertificateParser

fn parse( &mut self, input: &'a [u8], ) -> Result<(&'a [u8], TbsCertificate<'a>), Err<X509Error>>

A parser takes in input type, and returns a Result containing either the remaining input and the output value, or an error

fn map<G, O2>(self, g: G) -> Map<Self, G, O>

where G: Fn(O) -> O2, Self: Sized,

Maps a function over the result of a parser

fn flat_map<G, H, O2>(self, g: G) -> FlatMap<Self, G, O>

where G: FnMut(O) -> H, H: Parser<I, O2, E>, Self: Sized,

Creates a second parser from the output of the first one, then apply over the rest of the input

fn and_then<G, O2>(self, g: G) -> AndThen<Self, G, O>

where G: Parser<O, O2, E>, Self: Sized,

Applies a second parser over the output of the first one

fn and<G, O2>(self, g: G) -> And<Self, G>

where G: Parser<I, O2, E>, Self: Sized,

Applies a second parser after the first one, return their results as a tuple

fn or<G>(self, g: G) -> Or<Self, G>

where G: Parser<I, O, E>, Self: Sized,

Applies a second parser over the input if the first one failed

fn into<O2, E2>(self) -> Into<Self, O, O2, E, E2>

where O2: From<O>, E2: From<E>, Self: Sized,

automatically converts the parser’s output and error values to another type, as long as they implement the From trait

impl<'a> PartialEq for TbsCertificate<'a>

fn eq(&self, other: &TbsCertificate<'a>) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl<'a> StructuralPartialEq for TbsCertificate<'a>