Module identity 

Server/client identity (certificate + private key) loading.

PEM/DER loading accepts a leaf-first certificate list and an unencrypted PKCS#8 key. The key must match the leaf. Loading does not establish certificate trust.

PKCS#12 uses native Windows import or, on Unix, the openssl feature, independently of the selected trust backend. Without that capability it returns Error::Unsupported. System certificate stores are available only on Windows.

IdentitySource is parsed from the existing string configuration values: a plain value is a PKCS#12 file path (empty password), a value starting with cert: selects a Windows system store, see IdentitySource::from_str. Store sources are rejected when parsed on non-Windows targets.

Store selection semantics:

• the existing store is opened read-only, a missing store is not created;
• by thumbprint (40 hex chars, SHA-1 of DER): validity dates are ignored;
• by subject: case-insensitive substring of the subject attribute values joined by ", " (attribute names such as CN= do not match), only currently valid certificates with a private key are considered and the one that expires last wins;
• no chain trust validation is performed, the private key must be accessible to the service account.

PrivateKey supports signing on every backend and fallible PKCS#8 export. On Windows, keys remain in CNG. Identity imports persist an isolated key for Schannel compatibility and delete it on final drop; abnormal exits may leave the temporary key behind. ClientIdentity imports use ephemeral keys instead.

Key material is never logged, Debug redacts the key.

Client identity

ClientIdentity is the identity presented by outbound TLS clients (rustls). Its chain is leaf first, ordered by issuer, without a self-signed root.

Chain ordering checks issuer metadata and signatures, but does not check trust or dates. Rustls adapters are provided in crate::rustls when that feature is enabled.

Structs

ClientIdentity

Outbound TLS client identity, see the module docs.

Identity

Certificate with its private key, see the module docs.

Enums

HashAlg

Hash algorithm used by a signature scheme.

IdentitySource

Where an identity is loaded from.

SignScheme

Signature encoding and hash used by PrivateKey::sign.

StoreLocation

Location of a Windows system certificate store.

StoreSelector

Certificate selection within a Windows system certificate store.