Struct ExactRootMatch 

struct ExactRootMatch {
    inner: Verifier,
    roots: Vec<CertificateDer<'static>>,
}

A server certificate verifier that accepts a server certificate that is byte-for-byte identical to one of roots, and otherwise defers to inner.

An exact match must still be within its validity period and valid for the server name, but skips the chain, basic constraints and key usage checks. This keeps a self-signed CA:TRUE certificate working when it is supplied as its own certificate authority, which webpki rejects as CaUsedAsEndEntity. The name check falls back to the subject common names when an exact match has no DNS or IP subjectAltName, see common_name_matches. Every other certificate is checked against subjectAltNames only. An exact match is decided without consulting inner. Handshake signatures are always verified by inner.

Fields

inner: Verifier

roots: Vec<CertificateDer<'static>>

Trait Implementations

impl Debug for ExactRootMatch

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl ServerCertVerifier for ExactRootMatch

fn verify_server_cert( &self, end_entity: &CertificateDer<'_>, intermediates: &[CertificateDer<'_>], server_name: &ServerName<'_>, ocsp_response: &[u8], now: UnixTime, ) -> Result<ServerCertVerified, Error>

Verify the end-entity certificate end_entity is valid for the hostname dns_name and chains to at least one trust anchor.

fn verify_tls12_signature( &self, message: &[u8], cert: &CertificateDer<'_>, dss: &DigitallySignedStruct, ) -> Result<HandshakeSignatureValid, Error>

Verify a signature allegedly by the given server certificate.

fn verify_tls13_signature( &self, message: &[u8], cert: &CertificateDer<'_>, dss: &DigitallySignedStruct, ) -> Result<HandshakeSignatureValid, Error>

Verify a signature allegedly by the given server certificate.

fn supported_verify_schemes(&self) -> Vec<SignatureScheme>

Return the list of SignatureSchemes that this verifier will handle, in verify_tls12_signature and verify_tls13_signature calls.

fn requires_raw_public_keys(&self) -> bool

Returns whether this verifier requires raw public keys as defined in RFC 7250.

fn root_hint_subjects(&self) -> Option<&[DistinguishedName]>

Return the DistinguishedNames of certificate authorities that this verifier trusts.