枚举 CertificateError 

#[non_exhaustive]
pub enum CertificateError {
    BadEncoding,
    Expired,
    ExpiredContext {
        time: UnixTime,
        not_after: UnixTime,
    },
    NotValidYet,
    NotValidYetContext {
        time: UnixTime,
        not_before: UnixTime,
    },
    Revoked,
    UnhandledCriticalExtension,
    UnknownIssuer,
    UnknownRevocationStatus,
    ExpiredRevocationList,
    ExpiredRevocationListContext {
        time: UnixTime,
        next_update: UnixTime,
    },
    BadSignature,
    UnsupportedSignatureAlgorithm,
    UnsupportedSignatureAlgorithmContext {
        signature_algorithm_id: Vec<u8>,
        supported_algorithms: Vec<AlgorithmIdentifier>,
    },
    UnsupportedSignatureAlgorithmForPublicKeyContext {
        signature_algorithm_id: Vec<u8>,
        public_key_algorithm_id: Vec<u8>,
    },
    NotValidForName,
    NotValidForNameContext {
        expected: ServerName<'static>,
        presented: Vec<String>,
    },
    InvalidPurpose,
    InvalidPurposeContext {
        required: ExtendedKeyPurpose,
        presented: Vec<ExtendedKeyPurpose>,
    },
    InvalidOcspResponse,
    ApplicationVerificationFailure,
    Other(OtherError),
}

证书验证器表达错误的方式。

Note that the rustls TLS protocol code interprets specifically these error codes 到 send specific TLS alerts. Therefore, if 一个 custom certificate validator uses incorrect errors the library as 一个 whole will send alerts that do not match 标准 (this is usually 一个 minor issue, but could be misleading)。

变体 (Non-exhaustive)

非穷尽枚举未来可能添加新的变体。因此，在对非穷尽枚举的变体进行模式匹配时，必须额外增加一个通配符分支以涵盖未来的新变体。

BadEncoding

此 certificate is not correctly encoded.

Expired

此 current time is after the notAfter time in 证书.

ExpiredContext

此 current time is after the notAfter time in 证书.

This variant is semantically the same as Expired, but includes extra data 到 improve error reports.

字段

time: UnixTime

此 validation time.

not_after: UnixTime

此 notAfter time of 证书.

NotValidYet

此 current time is before the notBefore time in 证书.

NotValidYetContext

此 current time is before the notBefore time in 证书.

This variant is semantically the same as NotValidYet, but includes extra data 到 improve error reports.

字段

time: UnixTime

此 validation time.

not_before: UnixTime

此 notBefore time of 证书.

Revoked

此 certificate has been revoked.

UnhandledCriticalExtension

此 certificate contains an extension marked critical, but it was not processed by 证书 validator.

UnknownIssuer

此 certificate chain is not issued by 一个 known root certificate.

UnknownRevocationStatus

此 certificate’s revocation status could not be determined.

ExpiredRevocationList

此 certificate’s revocation status could not be determined, because the CRL is expired.

ExpiredRevocationListContext

此 certificate’s revocation status could not be determined, because the CRL is expired.

This variant is semantically the same as ExpiredRevocationList, but includes extra data 到 improve error reports.

字段

time: UnixTime

此 validation time.

next_update: UnixTime

此 nextUpdate time of the CRL.

BadSignature

证书未被其宣称的白发者的密钥正确签署。

UnsupportedSignatureAlgorithm

👎Deprecated since 0.23.29: use UnsupportedSignatureAlgorithmContext instead

A signature inside 一个 certificate 或 on 一个 handshake was made with an unsupported 算法.

UnsupportedSignatureAlgorithmContext

A signature inside 一个 certificate 或 on 一个 handshake was made with an unsupported 算法.

字段

signature_algorithm_id: Vec<u8>

此 签名算法 OID that was unsupported.

supported_algorithms: Vec<AlgorithmIdentifier>

Supported algorithms that were available 用于 signature verification.

UnsupportedSignatureAlgorithmForPublicKeyContext

A signature was made with an 算法 that doesn’t match the relevant 公钥.

字段

signature_algorithm_id: Vec<u8>

此 签名算法 OID.

public_key_algorithm_id: Vec<u8>

此 公钥 算法 OID.

NotValidForName

此 subject names in an end-entity certificate do not include the expected name.

NotValidForNameContext

此 subject names in an end-entity certificate do not include the expected name.

This variant is semantically the same as NotValidForName, but includes extra data 到 improve error reports.

字段

expected: ServerName<'static>

期望的服务器名称。

presented: Vec<String>

此 names presented in the end entity certificate.

These are the subject names as present in the leaf certificate 并 may contain DNS names with 或 without 一个 wildcard label as well as IP address names.

InvalidPurpose

此 certificate is being 用 用于 一个 different purpose than allowed.

InvalidPurposeContext

此 certificate is being 用 用于 一个 different purpose than allowed.

This variant is semantically the same as InvalidPurpose, but includes extra data 到 improve error reports.

字段

required: ExtendedKeyPurpose

应用程序要求的扩展密钥用途。

presented: Vec<ExtendedKeyPurpose>

在 peer 证书中提交的扩展密钥用途。

InvalidOcspResponse

此 OCSP response provided 到 the verifier was invalid.

This should be returned 从 ServerCertVerifier::verify_server_cert() when 一个 verifier checks its ocsp_response parameter 并 finds it invalid.

This maps 到 AlertDescription::BadCertificateStatusResponse。

ApplicationVerificationFailure

此 certificate is valid, but the handshake is rejected 用于 other reasons.

Other(OtherError)

Any other error.

This can be 用于 custom verifiers 到 expose 底层 error (where they are not better described by the more specific errors above)。

It 也 用于 默认 verifier in case its error is not covered by the above common cases.

Enums holding this variant will never compare equal 到 each other.

Trait 实现

impl Clone for CertificateError

fn clone(&self) -> CertificateError

返回值的副本。 更多信息

fn clone_from(&mut self, source: &Self)

Performs copy-assignment 从 source. 更多信息

impl Debug for CertificateError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

使用给定的格式化器格式化此值。 更多信息

impl Display for CertificateError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

使用给定的格式化器格式化此值。 更多信息

impl From<CertificateError> for AlertDescription

fn from(e: CertificateError) -> Self

从输入类型转换为此类型。

impl From<CertificateError> for Error

fn from(e: CertificateError) -> Self

从输入类型转换为此类型。

impl PartialEq for CertificateError

fn eq(&self, other: &Self) -> bool

测试 self 与 other 值是否相等，供 == 运算符使用。

fn ne(&self, other: &Rhs) -> bool

测试 != 运算符。默认实现几乎总是够用，除非有非常充分的理由，否则不应被覆盖。