Browse the docs

silk.tls.trust_anchor.

A trust anchor: a CA certificate that you trust, with optional limits that you add.

When to use#

Make a TrustAnchor for each root CA that can start a certificate chain, and put the anchors in a TrustSnapshot. Use TrustAnchor.fromCertificate to trust a certificate as it is. Use TrustAnchor.fromCertificateWithConstraints to limit it more, for example to a maximum chain length or to names under example.com.

Details#

The anchor owns its certificate. The limits that you add are kept apart from the limits inside the certificate, and path validation applies both.

Errors#

Gotchas#

Making an anchor gives a certificate full authority. It does not check the certificate, its self-signature, or its dates. Anchor only certificates that you trust.

Import as TrustAnchor with import silk.tls.trust_anchor { TrustAnchor }.

Public declarations: 1.

TrustAnchor#

silk
pub struct TrustAnchor

A CA certificate that you trust, with optional limits on chain length and names.

When to use#

Make one for each root CA that can start a certificate chain, and put the anchors in a TrustSnapshot. Use TrustAnchor.fromCertificate to trust a certificate as it is. Use TrustAnchor.fromCertificateWithConstraints to limit it more.

Details#

The anchor owns its certificate. The limits that you add are kept apart from the limits inside the certificate, and path validation applies both.

Gotchas#

Making an anchor gives a certificate full authority. It does not check the certificate, its self-signature, or its dates. Anchor only certificates that you trust.

Implementation TrustAnchor#

silk
impl TrustAnchor

Associated function fromCertificate#

silk
pub fn fromCertificate(certificate: Certificate) -> TrustAnchor

Returns an anchor for certificate, with no limits that you add. It does not allocate or check the certificate.

Associated function fromCertificateWithConstraints#

silk
pub effect fn fromCertificateWithConstraints(
    certificate: Certificate,
    maximumPathLength: Option<usize>,
    configuredNameConstraints: Option<&[u8]>,
    limits: ProfileLimits,
  ) -> Result<TrustAnchor, ProfileError>
  ! OutOfMemoryError
  ? &mut Allocator

Returns an anchor for certificate, with a maximum chain length and name constraints that you add.

maximumPathLength works like the pathLenConstraint of a basic constraints extension. configuredNameConstraints is the DER of a NameConstraints value. Only DNS and IP address constraints are supported. The anchor keeps a copy of it.

Errors#

  • Failure with a ProfileError if the name constraints are not valid or go over limits. The certificate is dropped.

  • OutOfMemoryError if the Allocator fails.

Method clone#

silk
pub effect fn clone(self: &Self) -> TrustAnchor ! OutOfMemoryError ? &mut Allocator

Returns a copy of the anchor, with its certificate and limits.

Errors#

  • OutOfMemoryError if the Allocator fails. The original does not change.

Method certificate#

silk
pub fn certificate(self: &Self) -> &Certificate

Returns the certificate of the anchor.

Method configuredPathLength#

silk
pub fn configuredPathLength(self: &Self) -> Option<usize>

Returns the maximum chain length that you added, or None.

Method configuredNameConstraints#

silk
pub fn configuredNameConstraints(self: &Self) -> Option<&[u8]>

Returns the DER of the name constraints that you added, or None.

Method encodedBytes#

silk
pub fn encodedBytes(self: &Self) -> usize

Returns the size of the certificate DER plus the name constraint DER. Snapshot limits count this value.

Category: TLS and certificates.

Profiles: aarch64-apple-darwin, aarch64-unknown-linux-gnu, aarch64-unknown-linux-gnu-no-libc, x86_64-unknown-linux-gnu, x86_64-unknown-linux-gnu-no-libc, wasm32-unknown-unknown, wasm32-wasip1, wasm32-wasip2.

View the source of this page