Module x509 

X.509 certificate handling: parsing, thumbprints, trust verification and identity loading.

Backends

Windows always uses native APIs. Elsewhere rustls takes precedence over openssl. Both TLS transports remain available when both features are enabled. Verification failures are never retried with another backend.

Configuration	Thumbprints	Trust	PKCS#12
Windows	CNG (BCrypt)	Crypt32	Native
rustls	SHA-1/SHA-256 crates	WebPKI	OpenSSL feature required on Unix
OpenSSL only	OpenSSL	OpenSSL (PARTIAL_CHAIN)	OpenSSL on Unix

Client identities (identity::ClientIdentity) keep the private key in CNG on Windows and sign in place (NCryptSignHash).

Certificate parsing uses x509-parser on all targets. Rustls-only builds do not depend on OpenSSL. Install a rustls crypto provider before loading keys or verifying chains, or enable rustls-ring to use ring when no provider is installed. Thumbprint hashing does not require an installed provider.

Modules

auth

Client certificate authentication checks.

cert

Parsed X.509 certificate.

digest

Message digests used for certificate thumbprints.

identity

Server/client identity (certificate + private key) loading.

key

Portable private-key ownership and signing.

peer

Certificates presented by a TLS peer.

trust

Client certificate trust verification against a set of registered CA certificates.

Structs

CaCerts

Registered CA certificates (trust anchors).

Certificate

Parsed X.509 certificate. Cheap to clone (Arc), Send + Sync.

ClientIdentity

Outbound TLS client identity, see the module docs.

Identity

Certificate with its private key, see the module docs.

PeerCerts

Leaf certificate and additional chain certificates presented by a TLS peer.

PrivateKey

A matching certificate/private-key pair; clones share the underlying key.

SanIp

Raw iPAddress SAN entry.

SubjectAltNames

Subject alternative names of a certificate.

Enums

Error

Error returned by x509 operations.

HashAlg

Hash algorithm used by a signature scheme.

IdentitySource

Where an identity is loaded from.

KeyType

Public key type of a certificate, see Certificate::key_type.

SignScheme

Signature encoding and hash used by PrivateKey::sign.

TrustError

Trust verification failure.

Functions

pem_encode

Encodes DER as PEM with the given label (64 column base64 lines, trailing newline).