silk/certificate_profile

Profiles: aarch64-apple-darwin, aarch64-unknown-linux-gnu, aarch64-unknown-linux-gnu-no-libc, wasm32-unknown-unknown, x86_64-unknown-linux-gnu, x86_64-unknown-linux-gnu-no-libc.

Borrowed semantic views for Silk's deliberately restricted TLS-server certificate profile.

When to use

Use CertificateProfile.inspect after structural certificate decoding and before path building. Use verifyIssuedBy only to check exact issuer linkage and the retained certificate signature.

Inspection is allocation-free, bounded, and retains the original certificate borrow. It admits role, key, signature metadata, and supported extension semantics while preserving original SAN and NameConstraints DER. Errors own only scalar metadata.

Gotchas

A successful profile inspection or issuer signature is not authentication. Neither operation checks current time, cumulative path constraints, trust authority, service identity, revocation, certificate transparency, or a complete path.

Import as CertificateProfile with import silk.certificate_profile { CertificateProfile }.

Public declarations: 10.

`CertificateRole`

pub enum CertificateRole

The certificate's intended position in the restricted TLS-server profile.

`ServerLeaf`

ServerLeaf = 0

A peer end-entity certificate inspected for admission to later TLS-server validation.

`Intermediate`

Intermediate = 1

A non-anchor CA certificate below the trust endpoint.

`Anchor`

Anchor = 2

An explicitly configured trust endpoint outside the returned path.

`CertificateKeyKind`

pub enum CertificateKeyKind

The admitted public-key algorithm and bounded key profile.

`P256`

P256 = 0

An uncompressed validated secp256r1 point.

`Rsa`

Rsa = 1

An odd 2048..4096-bit RSA modulus with exponent 65537.

`ProfileLimits`

pub struct ProfileLimits

Inclusive budgets for one semantic inspection or configured-constraint validation.

Field `extensions`

pub extensions: usize

Maximum number of certificate extensions, including unknown and duplicate OIDs.

Field `extensionBytes`

pub extensionBytes: usize

Maximum bytes in each extension value, including opaque unknown noncritical values.

Field `sanNames`

pub sanNames: usize

Maximum names in one subjectAltName value.

Field `constraintSubtrees`

pub constraintSubtrees: usize

Maximum GeneralSubtree values across one NameConstraints value.

Field `nodes`

pub nodes: usize

Maximum traversed extension-value TLV nodes across one operation.

Field `depth`

pub depth: usize

Maximum traversed extension-value TLV depth; a value root has depth one.

Associated function `ProfileLimits.defaults`

pub fn defaults() -> ProfileLimits

Returns 64 extensions, 16384 bytes per value, 256 SAN names, 256 constraint subtrees, 4096 traversed nodes, and depth 16.

Implementation `Copy for ProfileLimits`

impl Copy for ProfileLimits

`ProfileClass`

pub enum ProfileClass

The broad category of a semantic profile failure.

`Malformed`

Malformed = 0

DER or recognized extension content violates the selected schema.

`Unsupported`

Unsupported = 1

A well-formed value is outside the deliberately restricted profile.

`ResourceLimit`

ResourceLimit = 2

A configured finite budget or target size bound is exceeded.

`ProfileOffsetSpace`

pub enum ProfileOffsetSpace

The byte sequence in which a profile error offset is measured.

`CertificateDer`

CertificateDer = 0

Offset in the complete decoded certificate DER.

`ConfiguredConstraintDer`

ConfiguredConstraintDer = 1

Offset in caller-supplied configured NameConstraints DER.

`ProfileReason`

pub enum ProfileReason

The stable semantic reason for a profile rejection.

`Version`

Version = 0

The certificate version is invalid for the selected role.

`Serial`

Serial = 1

A path-certificate serial is nonpositive, zero, or longer than 20 content octets.

`UniqueIdentifier`

UniqueIdentifier = 2

An issuer or subject unique identifier is present.

`PublicKey`

PublicKey = 3

The public-key algorithm, encoding, parameters, or mathematical key is not admitted.

`SignatureAlgorithm`

SignatureAlgorithm = 4

The signature algorithm OID or signature BIT STRING metadata is not admitted.

`SignatureParameters`

SignatureParameters = 5

A recognized signature algorithm has forbidden, missing, or unsupported parameters.

`SignatureAlgorithmMismatch`

SignatureAlgorithmMismatch = 6

Inner and outer signature identifiers do not denote the same admitted effective algorithm.

`Extensions`

Extensions = 7

More certificate extensions are present than the configured bound.

`ExtensionBytes`

ExtensionBytes = 8

One extension value exceeds its configured byte bound.

`DuplicateExtension`

DuplicateExtension = 9

A duplicate extension OID is present.

`UnknownCriticalExtension`

UnknownCriticalExtension = 10

A critical extension has no supported semantics in this profile.

`MalformedExtension`

MalformedExtension = 11

A recognized extension violates strict DER or its selected schema.

`BasicConstraints`

BasicConstraints = 12

BasicConstraints conflicts with the role or path-length rules.

`KeyUsage`

KeyUsage = 13

KeyUsage encoding or dependent bits are invalid.

`MissingKeyUsage`

MissingKeyUsage = 14

A present KeyUsage does not authorize the selected role.

`ExtendedKeyUsage`

ExtendedKeyUsage = 15

ExtendedKeyUsage is empty or malformed.

`MissingServerAuth`

MissingServerAuth = 16

A present ExtendedKeyUsage omits id-kp-serverAuth.

`SubjectAltName`

SubjectAltName = 17

subjectAltName is malformed or contains an invalid DNS/IP identity.

`EmptySubject`

EmptySubject = 18

An empty subject lacks a nonempty critical subjectAltName.

`UnsupportedCriticalName`

UnsupportedCriticalName = 19

A critical subjectAltName contains an unsupported GeneralName alternative.

`NameConstraints`

NameConstraints = 20

NameConstraints is malformed, empty, noncritical, or used on an end entity.

`UnsupportedNameConstraint`

UnsupportedNameConstraint = 21

A NameConstraints subtree form is outside the DNS/IP subset.

`PolicyProcessing`

PolicyProcessing = 22

A certificate-policy feature requiring policy-tree processing is present.

`TlsFeature`

TlsFeature = 23

TLS Feature is present although this profile cannot satisfy must-staple semantics.

`Role`

Role = 24

The certificate role's CA or BasicConstraints policy is violated.

`SanNames`

SanNames = 25

A SAN name count exceeds its configured bound.

`ConstraintSubtrees`

ConstraintSubtrees = 26

A NameConstraints subtree count exceeds its configured bound.

`Nodes`

Nodes = 27

The traversed extension-value node count exceeds its configured bound.

`Depth`

Depth = 28

The traversed extension-value depth exceeds its configured bound.

`SizeOverflow`

SizeOverflow = 29

Checked size or counter arithmetic cannot be represented.

`IssuerName`

IssuerName = 30

The subject issuer Name DER does not exactly equal the issuer subject Name DER.

`SignatureRejected`

SignatureRejected = 31

An admitted cryptographic primitive rejected the retained signature.

`NameConstraintViolation`

NameConstraintViolation = 32

A subordinate DNS or IP subjectAltName violates one NameConstraints source.

`NameComparisons`

NameComparisons = 33

The caller-supplied name/subtree comparison budget is exhausted.

`ProfileError`

pub struct ProfileError

An owned certificate-profile error with optional extension context and a stable byte offset.

Field `kind`

pub kind: ProfileClass

Broad failure category.

Field `reason`

pub reason: ProfileReason

Stable semantic failure reason.

Field `extensionIndex`

pub extensionIndex: silk/option.Option<usize>

Zero-based extension index when the failure belongs to one certificate extension.

Field `offsetSpace`

pub offsetSpace: ProfileOffsetSpace

Coordinate system for offset.

Field `offset`

pub offset: usize

Byte offset in the selected coordinate system.

`KeyUsage`

pub struct KeyUsage

Parsed KeyUsage bits retained independently of their original DER positions.

Field `digitalSignature`

pub digitalSignature: bool

digitalSignature bit.

Field `contentCommitment`

pub contentCommitment: bool

contentCommitment/nonRepudiation bit.

Field `keyEncipherment`

pub keyEncipherment: bool

keyEncipherment bit.

Field `dataEncipherment`

pub dataEncipherment: bool

dataEncipherment bit.

Field `keyAgreement`

pub keyAgreement: bool

keyAgreement bit.

Field `keyCertSign`

pub keyCertSign: bool

keyCertSign bit.

Field `crlSign`

pub crlSign: bool

cRLSign bit.

Field `encipherOnly`

pub encipherOnly: bool

encipherOnly bit.

Field `decipherOnly`

pub decipherOnly: bool

decipherOnly bit.

Implementation `Copy for KeyUsage`

impl Copy for KeyUsage

`ExtendedKeyUsage`

pub struct ExtendedKeyUsage

Parsed ExtendedKeyUsage facts used by the restricted TLS-server profile.

Field `serverAuth`

pub serverAuth: bool

Whether id-kp-serverAuth occurs.

Field `anyExtendedKeyUsage`

pub anyExtendedKeyUsage: bool

Whether anyExtendedKeyUsage occurs; it never substitutes for serverAuth.

Field `purposeCount`

pub purposeCount: usize

Number of key-purpose identifiers in the original extension.

Implementation `Copy for ExtendedKeyUsage`

impl Copy for ExtendedKeyUsage

`CertificateProfile`

pub struct CertificateProfile<'a>

One immutable borrowed semantic view over a complete decoded certificate.

Associated function `CertificateProfile.inspect`

pub fn inspect<'a>(certificate: &'a silk/certificate.Certificate, selectedRole: CertificateRole, limits: ProfileLimits) -> silk/result.Result<silk/certificate_profile.CertificateProfile<'a>, silk/certificate_profile.ProfileError>

Inspects one decoded certificate under the restricted TLS-server semantic profile.

Details

Inspection is allocation-free and bounded. It admits one role, validates key and extension policy, and caches immutable borrowed views. Path certificates also require matching admitted inner and outer signature metadata. Anchor signature metadata, serial, validity, and self-signature are deliberately ignored.

Gotchas

Success does not establish trust, current validity, a complete path, service identity, or an actual signature. An anchor must be supplied through silk.trust_anchor as explicit authority.

Method `CertificateProfile.certificate`

pub fn certificate<'a, 'life1>(self: &'life1 CertificateProfile<'a>) -> &'a silk/certificate.Certificate

Borrows the structurally decoded certificate retained by this view.

Method `CertificateProfile.certificateRole`

pub fn certificateRole<'a, 'life1>(self: &'life1 CertificateProfile<'a>) -> CertificateRole

Returns the role under which this certificate was inspected.

Method `CertificateProfile.keyKind`

pub fn keyKind<'a, 'life1>(self: &'life1 CertificateProfile<'a>) -> CertificateKeyKind

Returns the admitted public-key profile.

Method `CertificateProfile.ca`

pub fn ca<'a, 'life1>(self: &'life1 CertificateProfile<'a>) -> bool

Returns the admitted BasicConstraints CA value, or false when absent.

Method `CertificateProfile.pathLength`

pub fn pathLength<'a, 'life1>(self: &'life1 CertificateProfile<'a>) -> silk/option.Option<usize>

Returns the admitted BasicConstraints path length when present.

Method `CertificateProfile.keyUsage`

pub fn keyUsage<'a, 'life1>(self: &'life1 CertificateProfile<'a>) -> silk/option.Option<silk/certificate_profile.KeyUsage>

Returns admitted KeyUsage facts when the extension was present.

Method `CertificateProfile.extendedKeyUsage`

pub fn extendedKeyUsage<'a, 'life1>(self: &'life1 CertificateProfile<'a>) -> silk/option.Option<silk/certificate_profile.ExtendedKeyUsage>

Returns admitted ExtendedKeyUsage facts when the extension was present.

Method `CertificateProfile.subjectAltNamesDer`

pub fn subjectAltNamesDer<'a, 'life1>(self: &'life1 CertificateProfile<'a>) -> silk/option.Option<&'a [u8]>

Borrows the exact subjectAltName extension-value DER when present.

Method `CertificateProfile.nameConstraintsDer`

pub fn nameConstraintsDer<'a, 'life1>(self: &'life1 CertificateProfile<'a>) -> silk/option.Option<&'a [u8]>

Borrows the exact embedded NameConstraints extension-value DER when present.

Associated function `CertificateProfile.validateConfiguredNameConstraints`

pub fn validateConfiguredNameConstraints<'life1>(value: &'life1 [u8], limits: ProfileLimits) -> silk/result.Result<(), silk/certificate_profile.ProfileError>

Validates strict configured DNS/IP NameConstraints without allocating or retaining input.

Associated function `CertificateProfile.checkNameConstraints`

pub fn checkNameConstraints<'life1, 'life2, 'life3, 'life4>(subject: &'life1 silk/certificate_profile.CertificateProfile<'life2>, constraintDer: &'life3 [u8], comparisons: &'life4 mut usize, maximumComparisons: usize, offsetSpace: ProfileOffsetSpace) -> silk/result.Result<(), silk/certificate_profile.ProfileError>

Checks every DNS and IP subjectAltName against one strict NameConstraints value.

pub fn verifyIssuedBy<'life1, 'life2, 'life3, 'life4>(subject: &'life1 silk/certificate_profile.CertificateProfile<'life2>, issuer: &'life3 silk/certificate_profile.CertificateProfile<'life4>) -> silk/result.Result<(), silk/certificate_profile.ProfileError>

Verifies exact issuer-name linkage and the subject's retained original TBS signature.

Gotchas

This checks only one edge. It does not establish path, time, constraint, trust, or identity authentication.

Implementation `Copy for silk/certificate_profile.CertificateProfile<'a>`

impl Copy for silk/certificate_profile.CertificateProfile<'a>

silk/certificate_profile

On this page