Module cert 

Parsed X.509 certificate.

Certificates are parsed with x509-parser (pure Rust DER parser, no crypto). The DER encoding is kept as Bytes (cheap clone, zero-copy from ntex-tls) and is the source for trust verification, thumbprints and PEM encoding.

Field rules (parity with the previous OpenSSL based implementation):

• subject CN: first commonName attribute, decoded like OpenSSL ASN1_STRING_to_UTF8 (UTF8/Printable/IA5/Numeric/Visible strings as UTF-8, T61 as Latin-1, BMP as UCS-2, Universal as UCS-4). Values that cannot be decoded are treated as missing.
• SAN DNS / URI / email: values are kept as encoded; entries with invalid encoding are skipped. A certificate with a malformed or duplicated SAN extension has no SANs.
• SAN IP: raw octets are kept; SanIp::addr returns None unless 4 or 16 bytes.
• case folding is done by callers (see crate::x509::auth), values are returned as encoded.
• thumbprints are computed lazily over the DER encoding and rendered as lowercase hex.

Structs

Certificate

Parsed X.509 certificate. Cheap to clone (Arc), Send + Sync.

SanIp

Raw iPAddress SAN entry.

SubjectAltNames

Subject alternative names of a certificate.

Enums

KeyType

Public key type of a certificate, see Certificate::key_type.

Functions

pem_encode

Encodes DER as PEM with the given label (64 column base64 lines, trailing newline).