Struct ZoneResolver 

pub struct ZoneResolver {
    zones: Vec<(String, Arc<SwappableCert>)>,
    primary: Arc<SwappableCert>,
}

The process’s one rustls certificate resolver when several zones are served: one SwappableCert per zone, chosen by SNI.

No SNI, and unknown SNI

A ClientHello with no server name — an IP-address connection, or an ancient client — gets the primary zone’s certificate: the first zone configured, which is also the zone whose hostname the server answers for itself. Handing back something is right here; the handshake then fails or succeeds on the client’s own name check, which is where that decision belongs.

A ClientHello naming a host no configured zone covers gets None, which rustls turns into an unrecognized_name alert. That is the honest answer: presenting a certificate for a name we do not serve would fail the client’s verification anyway, and more confusingly.

Fields

zones: Vec<(String, Arc<SwappableCert>)>

Zone hostname and its live certificate, sorted deepest zone first so a nested pair (pds.did.bot and claudes.pds.did.bot) resolves to the more specific one — matching didbot_identity::ZoneRegistry’s own “most specific wins” rule.

primary: Arc<SwappableCert>

The first zone as configured, which sorting by depth moves. Held separately rather than by index for that reason.

Implementations

impl ZoneResolver

pub fn new( zones: Vec<(String, Arc<SwappableCert>)>, ) -> Result<Arc<Self>, FleetError>

Builds a resolver over zones, refusing an empty or duplicated set.

The first entry is the primary: the certificate a ClientHello with no SNI gets.

pub fn zones(&self) -> Vec<&str>

The zones this resolver can answer for, deepest first.

pub fn certificate_for(&self, host: &str) -> Option<Arc<CertifiedKey>>

The certificate this resolver would present for host, if any.

Exposed so a test — or an operator-facing check — can ask the question without building a ClientHello.

impl ZoneResolver

pub fn primary_cert(&self) -> Arc<CertifiedKey>

The certificate a ClientHello with no SNI name gets: the first zone configured.

Trait Implementations

impl Debug for ZoneResolver

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl ResolvesServerCert for ZoneResolver

fn resolve(&self, client_hello: ClientHello<'_>) -> Option<Arc<CertifiedKey>>

Choose a certificate chain and matching key given simplified ClientHello information.

fn only_raw_public_keys(&self) -> bool

Return true when the server only supports raw public keys.