结构体 WebPkiClientVerifier

Source

pub struct WebPkiClientVerifier { /* private fields */ }

展开描述

A client certificate verifier that uses the webpki crate¹ 到 perform client certificate validation.

It must be created via the WebPkiClientVerifier::builder() 或 WebPkiClientVerifier::builder_with_provider() functions.

Once built, the provided Arc<dyn ClientCertVerifier> can be 用 with 一个 Rustls ServerConfig 到 configure client certificate validation using with_client_cert_verifier。

示例：

To require all clients present 一个 client certificate issued by 一个 trusted CA:

let client_verifier = WebPkiClientVerifier::builder(roots.into())
  .build()
  .unwrap();

Or, to allow clients presenting a client certificate authenticated by a trusted CA, or anonymous clients that present no client certificate:

let client_verifier = WebPkiClientVerifier::builder(roots.into())
  .allow_unauthenticated()
  .build()
  .unwrap();

If you wish to disable advertising client authentication:

let client_verifier = WebPkiClientVerifier::no_client_auth();

You can also configure the client verifier to check for certificate revocation with client certificate revocation lists (CRLs):

let client_verifier = WebPkiClientVerifier::builder(roots.into())
  .with_crls(crls)
  .build()
  .unwrap();

https://github.com/rustls/webpki ↩

实现§

Source §

impl WebPkiClientVerifier

Source

pub fn builder(roots: Arc<RootCertStore>) -> ClientCertVerifierBuilder

创建一个 builder 用于 the webpki client certificate verifier configuration using the process-default CryptoProvider。

Client certificate authentication ， offered by the server, 并客户端证书， verified using the trust anchors found in the provided roots。 If you wish 到 disable client authentication use WebPkiClientVerifier::no_client_auth() instead.

Use Self::builder_with_provider if you wish 到 specify an explicit provider.

For more information, see the ClientCertVerifierBuilder documentation.

Source

pub fn builder_with_provider( roots: Arc<RootCertStore>, provider: Arc<CryptoProvider>, ) -> ClientCertVerifierBuilder

创建一个 builder 用于 the webpki client certificate verifier configuration using 一个 specified CryptoProvider。

Client certificate authentication ， offered by the server, 并客户端证书， verified using the trust anchors found in the provided roots。 If you wish 到 disable client authentication use WebPkiClientVerifier::no_client_auth() instead.

此 cryptography 用 comes 从 the specified CryptoProvider。

For more information, see the ClientCertVerifierBuilder documentation.

Source

pub fn no_client_auth() -> Arc<dyn ClientCertVerifier>

创建一个 new WebPkiClientVerifier that disables client authentication. 此 server will not offer client authentication 并 anonymous clients ，已接受.

This is in contrast 到 using WebPkiClientVerifier::builder().allow_unauthenticated().build(), which will produce 一个 verifier that will offer client authentication, but not require it.