Struct WebPkiClientVerifier

pub struct WebPkiClientVerifier { /* private fields */ }

A client certificate verifier that uses the webpki crate¹ to perform client certificate validation.

It must be created via the WebPkiClientVerifier::builder() or WebPkiClientVerifier::builder_with_provider() functions.

Once built, the provided Arc<dyn ClientCertVerifier> can be used with a Rustls ServerConfig to configure client certificate validation using with_client_cert_verifier.

Example:

To require all clients present a client certificate issued by a trusted CA:

let client_verifier = WebPkiClientVerifier::builder(roots.into())
  .build()
  .unwrap();

Or, to allow clients presenting a client certificate authenticated by a trusted CA, or anonymous clients that present no client certificate:

let client_verifier = WebPkiClientVerifier::builder(roots.into())
  .allow_unauthenticated()
  .build()
  .unwrap();

If you wish to disable advertising client authentication:

let client_verifier = WebPkiClientVerifier::no_client_auth();

You can also configure the client verifier to check for certificate revocation with client certificate revocation lists (CRLs):

let client_verifier = WebPkiClientVerifier::builder(roots.into())
  .with_crls(crls)
  .build()
  .unwrap();

---

1. https://github.com/rustls/webpki ↩

Implementations

impl WebPkiClientVerifier

pub fn builder(roots: Arc<RootCertStore>) -> ClientCertVerifierBuilder

Create a builder for the webpki client certificate verifier configuration using the process-default CryptoProvider.

Client certificate authentication will be offered by the server, and client certificates will be verified using the trust anchors found in the provided roots. If you wish to disable client authentication use WebPkiClientVerifier::no_client_auth() instead.

Use Self::builder_with_provider if you wish to specify an explicit provider.

For more information, see the ClientCertVerifierBuilder documentation.

pub fn builder_with_provider( roots: Arc<RootCertStore>, provider: Arc<CryptoProvider>, ) -> ClientCertVerifierBuilder

Create a builder for the webpki client certificate verifier configuration using a specified CryptoProvider.

Client certificate authentication will be offered by the server, and client certificates will be verified using the trust anchors found in the provided roots. If you wish to disable client authentication use WebPkiClientVerifier::no_client_auth() instead.

The cryptography used comes from the specified CryptoProvider.

For more information, see the ClientCertVerifierBuilder documentation.

pub fn no_client_auth() -> Arc<dyn ClientCertVerifier>

Create a new WebPkiClientVerifier that disables client authentication. The server will not offer client authentication and anonymous clients will be accepted.

This is in contrast to using WebPkiClientVerifier::builder().allow_unauthenticated().build(), which will produce a verifier that will offer client authentication, but not require it.

Trait Implementations

impl ClientCertVerifier for WebPkiClientVerifier

fn offer_client_auth(&self) -> bool

Returns true to enable the server to request a client certificate and false to skip requesting a client certificate. Defaults to true.

fn client_auth_mandatory(&self) -> bool

Return true to require a client certificate and false to make client authentication optional. Defaults to self.offer_client_auth().

fn root_hint_subjects(&self) -> &[DistinguishedName]

Returns the DistinguishedName subjects that the server will hint to clients to identify acceptable authentication trust anchors.

fn verify_client_cert( &self, end_entity: &CertificateDer<'_>, intermediates: &[CertificateDer<'_>], now: UnixTime, ) -> Result<ClientCertVerified, Error>

Verify the end-entity certificate end_entity is valid, acceptable, and chains to at least one of the trust anchors trusted by this verifier.

fn verify_tls12_signature( &self, message: &[u8], cert: &CertificateDer<'_>, dss: &DigitallySignedStruct, ) -> Result<HandshakeSignatureValid, Error>

Verify a signature allegedly by the given client certificate.

fn verify_tls13_signature( &self, message: &[u8], cert: &CertificateDer<'_>, dss: &DigitallySignedStruct, ) -> Result<HandshakeSignatureValid, Error>

Verify a signature allegedly by the given client certificate.

fn supported_verify_schemes(&self) -> Vec<SignatureScheme>

Return the list of SignatureSchemes that this verifier will handle, in verify_tls12_signature and verify_tls13_signature calls.

fn requires_raw_public_keys(&self) -> bool

Returns whether this verifier requires raw public keys as defined in RFC 7250.

impl Debug for WebPkiClientVerifier

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.