Module trust 

Client certificate trust verification against a set of registered CA certificates.

CaCerts::is_trusted semantics (all targets):

• an empty store never trusts anything;
• every registered certificate is a trust anchor, it does not have to be self-signed (OpenSSL X509_V_FLAG_PARTIAL_CHAIN); in particular a registered leaf certificate pins that leaf;
• certificates sent by the peer (PeerCerts::chain) are untrusted intermediates;
• validity periods of all certificates on the verified path, including the anchor, are checked against now;
• on success the earliest not_after of the verified path (leaf, intermediates and anchor) is returned, the session must not outlive it;
• no revocation checking.

Backends

Target	Backend
rustls, non-Windows	WebPKI with the rustls crypto provider
OpenSSL only, non-Windows	OpenSSL X509Store with PARTIAL_CHAIN, default purpose checks
windows	Crypt32 private chain engine (exclusive roots)

The Crypt32 backend (Windows) differs from OpenSSL in these accepted ways:

• a certificate with an extended key usage extension that does not contain clientAuth is rejected (OpenSSL ignores EKU of intermediates);
• weak signature algorithms (e.g. SHA-1) follow the Windows weak crypto policy;
• basic constraints, X.509 v1 and critical extension handling follow Crypt32 rules;
• a pinned leaf (leaf DER equal to a registered certificate) is trusted after a validity check only, the chain engine does not support end-entity trust anchors;
• error strings in TrustError differ.

WebPKI also enforces client-authentication EKU and its own encoding/algorithm policy. It does not support verification times before 1970. SHA-1 thumbprints remain supported even when the crypto provider rejects SHA-1 certificate signatures.

Structs

CaCerts

Registered CA certificates (trust anchors).

Enums

TrustError

Trust verification failure.