silk/certificate

Profiles: aarch64-apple-darwin, aarch64-unknown-linux-gnu, aarch64-unknown-linux-gnu-no-libc, wasm32-unknown-unknown, x86_64-unknown-linux-gnu, x86_64-unknown-linux-gnu-no-libc.

Owned X.509 certificates decoded from bounded DER or strict PEM input.

When to use

Use Certificate.decodeDer for one binary certificate or Certificate.decodePem for one CERTIFICATE block. Use silk.certificate_bundle.CertificateBundle for multiple PEM certificates.

Results own their bytes. Accessors borrow the owner and preserve original signed bytes and all extensions. Input is borrowed during execution. Allocation refusal uses OutOfMemoryError; other failures return DecodeError.

Gotchas

Decoding checks structure only. It does not verify signatures, trust, identities, or certificate validity. PEM rejects explanatory text, unrelated blocks, VT/FF whitespace, and noncanonical base64.

Import as Certificate with import silk.certificate { Certificate }.

Public declarations: 12.

`DecodeLimits`

pub struct DecodeLimits

Inclusive resource limits for one decode call. Zero permits no corresponding resource.

Field `inputBytes`

pub inputBytes: usize

Maximum complete input length, including PEM whitespace.

Field `certificateBytes`

pub certificateBytes: usize

Maximum DER length of one certificate, including its tag and length.

Field `totalDerBytes`

pub totalDerBytes: usize

Maximum sum of certificate DER lengths in one call.

Field `certificates`

pub certificates: usize

Maximum certificate count, including duplicates.

Field `fieldBytes`

pub fieldBytes: usize

Maximum content length of each primitive or open field, including the BIT STRING count octet.

Field `extensions`

pub extensions: usize

Maximum extension count per certificate, including duplicates.

Field `depth`

pub depth: usize

Maximum traversed TLV depth; the certificate root has depth one.

Field `nodes`

pub nodes: usize

Maximum traversed TLV count per certificate; opaque payloads do not add nodes.

Associated function `DecodeLimits.defaults`

pub fn defaults() -> DecodeLimits

Returns finite default limits: 16 MiB input, 1 MiB certificates, 8 MiB total DER, and 1024 certificates.

Details

Fields are limited to 256 KiB, extensions to 256, depth to 32, and nodes to 65536 per certificate.

Implementation `Copy for DecodeLimits`

impl Copy for DecodeLimits

`DecodeClass`

pub enum DecodeClass

The category of a decoding failure.

`Malformed`

Malformed = 0

The input violates the accepted encoding or schema.

`Unsupported`

Unsupported = 1

The version or PEM label is outside the selected format.

`ResourceLimit`

ResourceLimit = 2

A configured limit or machine size bound is exceeded.

`DecodeReason`

pub enum DecodeReason

The specific failed decoding rule.

`EmptyInput`

EmptyInput = 0

The input contains no certificate.

`PemSyntax`

PemSyntax = 1

A PEM marker or document byte is invalid.

`Base64`

Base64 = 2

Base64 alphabet, padding, or pad bits are invalid.

`TrailingData`

TrailingData = 3

Data follows the required single certificate.

`Truncated`

Truncated = 4

Required input ends before its declared boundary.

`Tag`

Tag = 5

A tag encoding or primitive/constructed bit is invalid.

`Length`

Length = 6

A DER length encoding is not canonical.

`Integer`

Integer = 7

An INTEGER is empty or is not minimally encoded.

`Boolean`

Boolean = 8

A BOOLEAN is not one canonical octet.

`BitString`

BitString = 9

A BIT STRING count or unused tail bits are invalid.

`Oid`

Oid = 10

An OID subidentifier is empty, unfinished, or nonminimal.

`SetOrder`

SetOrder = 11

An RDN SET OF is not in DER order.

`DefaultValue`

DefaultValue = 12

A default value is explicitly encoded.

`Time`

Time = 13

A certificate time or calendar date is invalid.

`Schema`

Schema = 14

The certificate fields violate the selected schema.

`StringEncoding`

StringEncoding = 15

An ASN.1 string encoding is invalid.

`Version`

Version = 16

The certificate version is not v1, v2, or v3.

`PemLabel`

PemLabel = 17

The PEM label is not CERTIFICATE.

`InputBytes`

InputBytes = 18

The complete input exceeds its limit.

`CertificateBytes`

CertificateBytes = 19

One certificate exceeds its DER byte limit.

`TotalDerBytes`

TotalDerBytes = 20

The aggregate DER bytes exceed their limit.

`Certificates`

Certificates = 21

The certificate count exceeds its limit.

`FieldBytes`

FieldBytes = 22

A primitive or open field exceeds its content limit.

`Extensions`

Extensions = 23

The extension count exceeds its limit.

`Depth`

Depth = 24

The traversed TLV depth exceeds its limit.

`Nodes`

Nodes = 25

The traversed TLV count exceeds its limit.

`SizeOverflow`

SizeOverflow = 26

A length, tag number, or allocation size exceeds the target size range.

`DecodeOffsetSpace`

pub enum DecodeOffsetSpace

The byte sequence used by a diagnostic offset.

`Input`

Input = 0

The offset is in the original supplied input.

`Der`

Der = 1

The offset is in the DER decoded from the indicated PEM block.

`CertificateVersion`

pub enum CertificateVersion

The structural X.509 certificate version.

`V1`

V1 = 0

Version one, encoded by an absent version field.

`V2`

V2 = 1

Version two, encoded as INTEGER one.

`V3`

V3 = 2

Version three, encoded as INTEGER two.

`DecodeError`

pub struct DecodeError

A decoding failure without a borrow of the input.

Field `kind`

pub kind: DecodeClass

The failure category.

Field `reason`

pub reason: DecodeReason

The failed rule.

Field `certificateIndex`

pub certificateIndex: usize

The zero-based attempted certificate index; document failures use zero.

Field `offsetSpace`

pub offsetSpace: DecodeOffsetSpace

The coordinate system for the offset.

Field `offset`

pub offset: usize

The offending byte, TLV tag, or end offset when required input is missing.

Implementation `Copy for DecodeError`

impl Copy for DecodeError

`CertificateTime`

pub struct CertificateTime

A decoded Gregorian certificate time in UTC.

Field `year`

pub year: u16

The full year, from 1 through 9999.

Field `month`

pub month: u8

The month, from 1 through 12.

Field `day`

pub day: u8

The valid day of the month.

Field `hour`

pub hour: u8

The hour, from 0 through 23.

Field `minute`

pub minute: u8

The minute, from 0 through 59.

Field `second`

pub second: u8

The second, from 0 through 59.

Implementation `Copy for CertificateTime`

impl Copy for CertificateTime

`BitStringView`

pub struct BitStringView<'a>

A borrowed BIT STRING payload with its unused-bit metadata.

Field `bytes`

pub bytes: &'a [u8]

The original payload, excluding its initial count octet.

Field `unusedBits`

pub unusedBits: u8

The number of zero low bits in the last payload octet.

`AlgorithmView`

pub struct AlgorithmView<'a>

A borrowed AlgorithmIdentifier with uninterpreted parameters.

Field `der`

pub der: &'a [u8]

The complete original AlgorithmIdentifier TLV.

Field `oid`

pub oid: &'a [u8]

The canonical OID content octets, without tag or length.

Field `parametersDer`

pub parametersDer: silk/option.Option<&'a [u8]>

The complete parameter TLV; absence differs from explicit NULL.

`CertificateOffsets`

pub struct CertificateOffsets

Stable byte offsets for semantically significant fields in the retained certificate DER.

Field `tbs`

pub tbs: usize

Complete TBSCertificate tag.

Field `version`

pub version: usize

Explicit version wrapper, or the first TBSCertificate field when version is absent.

Field `serial`

pub serial: usize

Serial-number INTEGER tag.

Field `tbsSignatureAlgorithm`

pub tbsSignatureAlgorithm: usize

Inner TBSCertificate signature AlgorithmIdentifier tag.

Field `issuer`

pub issuer: usize

Issuer Name tag.

Field `subject`

pub subject: usize

Subject Name tag.

Field `spki`

pub spki: usize

SubjectPublicKeyInfo tag.

Field `publicKey`

pub publicKey: usize

SubjectPublicKey BIT STRING tag.

Field `signatureAlgorithm`

pub signatureAlgorithm: usize

Outer signature AlgorithmIdentifier tag.

Field `signature`

pub signature: usize

Signature-value BIT STRING tag.

Field `issuerUniqueId`

pub issuerUniqueId: usize

Issuer unique-identifier tag, or the TBSCertificate tag when absent.

Field `subjectUniqueId`

pub subjectUniqueId: usize

Subject unique-identifier tag, or the TBSCertificate tag when absent.

`ExtensionView`

pub struct ExtensionView<'a>

A borrowed raw extension, including unknown or duplicate extensions.

Field `offset`

pub offset: usize

Byte offset of the complete Extension TLV in the certificate DER.

Field `valueOffset`

pub valueOffset: usize

Byte offset of the extension value content in the certificate DER.

Field `der`

pub der: &'a [u8]

The complete original Extension TLV.

Field `oid`

pub oid: &'a [u8]

The canonical OID content octets, without tag or length.

Field `critical`

pub critical: bool

The critical bit, false when absent.

Field `value`

pub value: &'a [u8]

The exact OCTET STRING content, without ASN.1 interpretation.

`Certificate`

pub struct Certificate

An immutable owned certificate that preserves its original DER and all raw extensions.

Details

Accessors borrow this owner. Dropping the certificate releases all owned storage. Unknown algorithms, duplicate extensions, and policy-invalid serials remain available to independent validators.

Method `Certificate.copy`

pub effect<'life0> fn copy<'life0>(self: &'life0 Certificate) -> Certificate ! OutOfMemoryError ? &mut Allocator

Copies this decoded certificate into independent owned storage without reinterpreting it.

Details

The copy preserves every original DER byte, checked field offset, algorithm spelling, and raw extension in source order. Allocation refusal releases partial storage and returns OutOfMemoryError; no semantic validation is performed.

Associated function `Certificate.decodeDer`

pub effect<'life0> fn decodeDer<'life0>(input: &'life0 [u8], limits: DecodeLimits) -> silk/result.Result<silk/certificate.Certificate, silk/certificate.DecodeError> ! OutOfMemoryError ? &mut Allocator

Decodes exactly one DER certificate into independent owned storage.

Details

Limits are inclusive. Structural failures return DecodeError; allocation refusal uses OutOfMemoryError. No partial result escapes. The result retains no input borrow. Trailing bytes, including whitespace, fail.

Gotchas

Success does not verify signatures, trust, names, or current validity. Extensions remain opaque.

Associated function `Certificate.decodePem`

pub effect<'life0> fn decodePem<'life0>(input: &'life0 [u8], limits: DecodeLimits) -> silk/result.Result<silk/certificate.Certificate, silk/certificate.DecodeError> ! OutOfMemoryError ? &mut Allocator

Decodes exactly one strict CERTIFICATE PEM block into independent owned storage.

Details

The parser accepts SP, HT, LF, CRLF, and CR whitespace, with canonical base64 padding and pad bits. Other labels are unsupported. Text outside markers, malformed markers, and a second block fail. Allocation refusal uses OutOfMemoryError; no partial certificate escapes.

Gotchas

This strict profile rejects explanatory text and VT/FF that permissive RFC 7468 readers can ignore. Success does not establish trust or validate a signature.

Method `Certificate.tbsDer`

pub fn tbsDer<'life0>(self: &'life0 Certificate) -> &'life0 [u8]

Borrows the complete original signed TBSCertificate TLV; the view cannot outlive this owner.

Method `Certificate.issuerDer`

pub fn issuerDer<'life0>(self: &'life0 Certificate) -> &'life0 [u8]

Borrows the complete issuer Name TLV, without normalization; the view cannot outlive this owner.

Method `Certificate.subjectDer`

pub fn subjectDer<'life0>(self: &'life0 Certificate) -> &'life0 [u8]

Borrows the complete subject Name TLV, without normalization; the view cannot outlive this owner.

Method `Certificate.validityDer`

pub fn validityDer<'life0>(self: &'life0 Certificate) -> &'life0 [u8]

Borrows the complete original Validity TLV; the view cannot outlive this owner.

Method `Certificate.spkiDer`

pub fn spkiDer<'life0>(self: &'life0 Certificate) -> &'life0 [u8]

Borrows the complete original SubjectPublicKeyInfo TLV; the view cannot outlive this owner.

Method `Certificate.der`

pub fn der<'life0>(self: &'life0 Certificate) -> &'life0 [u8]

Borrows all original DER bytes; the view cannot outlive this owner.

Method `Certificate.version`

pub fn version<'life0>(self: &'life0 Certificate) -> CertificateVersion

Returns the structural certificate version without imposing validation policy.

Method `Certificate.offsets`

pub fn offsets<'life0>(self: &'life0 Certificate) -> CertificateOffsets

Returns stable byte offsets for semantic diagnostics over the retained DER.

Method `Certificate.serial`

pub fn serial<'life0>(self: &'life0 Certificate) -> &'life0 [u8]

Borrows minimal signed INTEGER content, including a required sign octet; the view borrows this owner.

Method `Certificate.notBefore`

pub fn notBefore<'life0>(self: &'life0 Certificate) -> CertificateTime

Returns the decoded UTC lower validity boundary without consulting a clock.

Method `Certificate.notAfter`

pub fn notAfter<'life0>(self: &'life0 Certificate) -> CertificateTime

Returns the decoded UTC upper validity boundary without checking interval order.

Method `Certificate.publicKey`

pub fn publicKey<'a>(self: &'a Certificate) -> silk/certificate.BitStringView<'a>

Borrows the original subjectPublicKey payload and unused-bit count; the view borrows this owner.

Method `Certificate.signature`

pub fn signature<'a>(self: &'a Certificate) -> silk/certificate.BitStringView<'a>

Borrows the original signatureValue payload and unused-bit count; the view borrows this owner.

Method `Certificate.publicKeyAlgorithm`

pub fn publicKeyAlgorithm<'a>(self: &'a Certificate) -> silk/certificate.AlgorithmView<'a>

Borrows the SPKI AlgorithmIdentifier, preserving parameter absence and original encoding.

Method `Certificate.tbsSignatureAlgorithm`

pub fn tbsSignatureAlgorithm<'a>(self: &'a Certificate) -> silk/certificate.AlgorithmView<'a>

Borrows the TBSCertificate signature AlgorithmIdentifier, preserving parameter absence and original encoding.

Method `Certificate.signatureAlgorithm`

pub fn signatureAlgorithm<'a>(self: &'a Certificate) -> silk/certificate.AlgorithmView<'a>

Borrows the outer signature AlgorithmIdentifier, preserving parameter absence and original encoding.

Method `Certificate.issuerUniqueId`

pub fn issuerUniqueId<'a>(self: &'a Certificate) -> silk/option.Option<silk/certificate.BitStringView<'a>>

Borrows the optional unique ID and unused-bit count; absence returns None. The view borrows this owner.

Method `Certificate.subjectUniqueId`

pub fn subjectUniqueId<'a>(self: &'a Certificate) -> silk/option.Option<silk/certificate.BitStringView<'a>>

Borrows the optional unique ID and unused-bit count; absence returns None. The view borrows this owner.

Method `Certificate.extensionCount`

pub fn extensionCount<'life0>(self: &'life0 Certificate) -> usize

Returns the extension count, including duplicates and unknown OIDs.

Method `Certificate.extension`

pub fn extension<'a>(self: &'a Certificate, index: usize) -> silk/option.Option<silk/certificate.ExtensionView<'a>>

Borrows an extension in input order, or returns None when the index is out of range.

Details

The value is exact OCTET STRING content. Unknown and duplicate OIDs remain present. The view borrows this owner.

silk/certificate

On this page