silk.tls.certificate_bundle.

When to use#

Use CertificateBundle.decodePem for a chain file, such as the fullchain.pem of a server. Use CertificateBundle.decodeAnnotatedPem for a CA bundle with comment lines between the blocks, such as the files in /etc/ssl/certs. For exactly one certificate, use silk.tls.certificate.

Details#

A CertificateBundle keeps the certificates in input order, with duplicates. Each certificate owns its DER. If any block fails, the call returns no bundle and releases what it decoded.

Errors#

• DecodeError if a block is not valid or the input goes over a limit. certificateIndex tells you which block failed.

• OutOfMemoryError if the Allocator fails.

Gotchas#

Decoding checks only the structure. It does not verify the signature, the chain, the names, or the dates. Use silk.tls.certificate_path for that. The order of a bundle is the order of the file, not a chain order.

Examples#

Reject an empty file#

import silk.mem.allocator { Allocator, OutOfMemoryError }
import silk.tls.certificate { DecodeError, DecodeLimits, DecodeReason }
import silk.tls.certificate_bundle { CertificateBundle }
import silk.core.effect { Effect }
import silk.core.result { Result }

pub effect fn main() -> i32
  ! OutOfMemoryError {
  let mut allocator = Allocator.systemAllocatorProvider()
  let decoded = run CertificateBundle.decodePem(b"\n", DecodeLimits.defaults())
    |> Effect.provideMut<Allocator>(&mut allocator)
  return match move decoded {
    Result<CertificateBundle, DecodeError>.Failure { error } => {
      if error.reason != DecodeReason.EmptyInput {
        return 1
      }
      return 0
    }
    Result<CertificateBundle, DecodeError>.Success { value: _ } => 1
  }
}

Import as CertificateBundle with import silk.tls.certificate_bundle { CertificateBundle }.

Public declarations: 1.

CertificateBundle#

pub struct CertificateBundle

A list of decoded certificates in input order. It owns them, and duplicates stay as separate entries.

When to use#

Make one with CertificateBundle.decodePem for a chain file, such as the fullchain.pem of a server, or with CertificateBundle.decodeAnnotatedPem for a CA bundle with comment lines between the blocks. For exactly one certificate, use silk.tls.certificate.

Gotchas#

Decoding checks only the structure. It does not verify the signature, the chain, the names, or the dates. Use silk.tls.certificate_path for that. The order is the order of the file, not a chain order.

Implementation CertificateBundle#

impl CertificateBundle

Associated function decodePem#

pub effect fn decodePem(input: &[u8], limits: DecodeLimits) -> Result<
    CertificateBundle,
    DecodeError,
  > ! OutOfMemoryError ? &mut Allocator

Decodes all CERTIFICATE blocks of input, such as a chain file, in input order.

Only CERTIFICATE blocks and spaces, tabs, CR, and LF between them are allowed. The limits count the whitespace and each duplicate.

Errors#

• Failure with a DecodeError for text outside the blocks, another label, a block that is not valid, or a limit. No bundle is returned. certificateIndex tells which block failed.

• OutOfMemoryError if the Allocator fails.

Gotchas#

Decoding checks only the structure. It does not verify the signature, the chain, the names, or the dates. Use silk.tls.certificate_path for that. The order is the order of the file, not a chain order.

Associated function decodeAnnotatedPem#

pub effect fn decodeAnnotatedPem(input: &[u8], limits: DecodeLimits) -> Result<CertificateBundle, DecodeError>
  ! OutOfMemoryError ? &mut Allocator

Decodes all CERTIFICATE blocks of a CA file that has comment lines between them.

Lines of printable text outside the blocks are ignored, and count toward inputBytes. Each block is decoded strictly.

Errors#

• Failure with a DecodeError for a block that is not valid, another label, a limit, or a file without a block. No certificate is skipped.

• OutOfMemoryError if the Allocator fails.

Gotchas#

Use it only for a CA file that you trust. Use CertificateBundle.decodePem for input from a peer.

Method length#

pub fn length(self: &Self) -> usize

Returns the number of certificates, with duplicates.

Method get#

pub fn get<'a>(self: &'a Self, index: usize) -> Option<&'a Certificate>

Returns the certificate at index, or None if index is out of range.

Method intoCertificates#

pub fn intoCertificates(self: Self) -> List<Certificate>

Returns the certificates as a list and consumes the bundle. It does not copy them.

Category: TLS and certificates.

Profiles: aarch64-apple-darwin, aarch64-unknown-linux-gnu, aarch64-unknown-linux-gnu-no-libc, x86_64-unknown-linux-gnu, x86_64-unknown-linux-gnu-no-libc, wasm32-unknown-unknown, wasm32-wasip1, wasm32-wasip2.