Struct LocalAuthority 

pub struct LocalAuthority {
    store: CaStore,
    issuer: Issuer<'static, KeyPair>,
    ca_pem: String,
    generated: bool,
}

This machine’s own certificate authority, loaded from the data directory or generated into it.

Fields

store: CaStore

issuer: Issuer<'static, KeyPair>

ca_pem: String

generated: bool

Implementations

impl LocalAuthority

pub fn open(dir: &Path) -> Result<Self, LocalError>

The authority in dir, generated the first time and reused after.

Reused means reused: a second start signs no new authority, so a developer trusts one certificate once rather than every time they restart a server.

pub fn certificate_path(&self) -> PathBuf

The authority certificate’s path: the file to trust.

pub fn was_generated(&self) -> bool

Whether this run generated the authority rather than finding it.

pub fn trust_instructions(&self) -> Vec<String>

What to do with Self::certificate_path, as lines to print.

One instruction per tool that has its own trust store, because a machine does not have one: the system store covers curl and anything reading it, and the browsers and Node each keep their own.

pub fn issue(&self, zone: &str) -> Result<(String, String), LocalError>

A <zone> + *.<zone> certificate chain and key for zone, both PEM, signed now.

The chain is the leaf followed by the authority, the order a public authority hands its own back in, so a client that already trusts the authority verifies from the leaf up without holding anything else.

A wildcard matches exactly one label, which is why a zone needs its own certificate rather than one at the root; see crate::fleet.

pub fn issue_names( &self, names: &[String], ) -> Result<(String, String), LocalError>

A certificate for exactly names, for a caller that wants something other than a zone and its wildcard.

A wildcard needs a name to sit under: *.localhost is not a DNS identifier a verifier will accept, so a server answering as localhost itself asks for that one name here.

fn certificate_for( &self, zone: &str, leaves: Option<&Path>, provider: &CryptoProvider, ) -> Result<CertifiedKey, LocalError>

zone’s certificate: the one under leaves if this authority signed it and it has life left, and a freshly signed one otherwise, saved over it.

leaves is a data directory, or None for a server that keeps nothing — which then signs a leaf at every start. Signing costs milliseconds and needs nothing off this machine, so a run with no data directory loses nothing by it.

fn stored_certificate( &self, zone: &str, leaves: &Path, provider: &CryptoProvider, ) -> Option<CertifiedKey>

The stored certificate for zone if this run can serve it.

None — sign a new one — covers every way it could be unusable, and they are not distinguished because the answer to all of them is the same: nothing saved, a set a crash left incomplete, a leaf from an ACME directory or from an authority this one replaced, one that does not load, and one close enough to expiry that this run would outlive it.

fn certificate_der(&self) -> Result<CertificateDer<'static>, CertError>

The authority’s certificate as DER, for comparing a stored chain’s last entry against.

Trait Implementations

impl Debug for LocalAuthority

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.