Struct x509_parser::certificate::X509Certificate

pub struct X509Certificate<'a> {
    pub tbs_certificate: TbsCertificate<'a>,
    pub signature_algorithm: AlgorithmIdentifier<'a>,
    pub signature_value: BitStringObject<'a>,
}

An X.509 v3 Certificate.

X.509 v3 certificates are defined in RFC5280, section 4.1. This object uses the same structure for content, so for ex the subject can be accessed using the path x509.tbs_certificate.subject.

X509Certificate also contains convenience methods to access the most common fields (subject, issuer, etc.).

A X509Certificate is a zero-copy view over a buffer, so the lifetime is the same as the buffer containing the binary representation.

fn display_x509_info(x509: &X509Certificate<'_>) {
     let subject = &x509.tbs_certificate.subject;
     let issuer = &x509.tbs_certificate.issuer;
     println!("X.509 Subject: {}", subject);
     println!("X.509 Issuer: {}", issuer);
     println!("X.509 serial: {}", x509.tbs_certificate.raw_serial_as_string());
}

Fields

tbs_certificate: TbsCertificate<'a>

signature_algorithm: AlgorithmIdentifier<'a>

signature_value: BitStringObject<'a>

Implementations

impl<'a> X509Certificate<'a>

pub fn from_der(i: &'a [u8]) -> X509Result<'_, Self>

Parse a DER-encoded X.509 Certificate, and return the remaining of the input and the built object.

The returned object uses zero-copy, and so has the same lifetime as the input.

Note that only parsing is done, not validation.

Certificate  ::=  SEQUENCE  {
        tbsCertificate       TBSCertificate,
        signatureAlgorithm   AlgorithmIdentifier,
        signatureValue       BIT STRING  }

Example

To parse a certificate and print the subject and issuer:

let res = parse_x509_certificate(DER);
match res {
    Ok((_rem, x509)) => {
        let subject = &x509.tbs_certificate.subject;
        let issuer = &x509.tbs_certificate.issuer;
        println!("X.509 Subject: {}", subject);
        println!("X.509 Issuer: {}", issuer);
    },
    _ => panic!("x509 parsing failed: {:?}", res),
}

pub fn version(&self) -> X509Version

Get the version of the encoded certificate

pub fn subject(&self) -> &X509Name<'_>

Get the certificate subject.

pub fn issuer(&self) -> &X509Name<'_>

Get the certificate issuer.

pub fn validity(&self) -> &Validity

Get the certificate validity.

pub fn extensions(&self) -> &HashMap<Oid<'_>, X509Extension<'_>>

Get the certificate extensions.

pub fn verify_signature(
    &self,
    public_key: Option<&SubjectPublicKeyInfo<'_>>
) -> Result<(), X509Error>

Verify the cryptographic signature of this certificate

public_key is the public key of the signer. For a self-signed certificate, (for ex. a public root certificate authority), this is the key from the certificate, so you can use None.

For a leaf certificate, this is the public key of the certificate that signed it. It is usually an intermediate authority.

Trait Implementations

impl<'a> Debug for X509Certificate<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'a> PartialEq<X509Certificate<'a>> for X509Certificate<'a>

fn eq(&self, other: &X509Certificate<'a>) -> bool

This method tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &X509Certificate<'a>) -> bool

This method tests for !=.

impl<'a> StructuralPartialEq for X509Certificate<'a>