/// Validates a node's TLS certificate.
///
/// See the crate documentation for the exact checks that are performed.
Validates a node's TLS certificate.
See the crate documentation for the exact checks that are performed.
Validates a node ' s TLS certificate . See the crate documentation for the exact checks that are performed .
pub fn validate_tls_certificate(
    tls_certificate: &Option<X509PublicKeyCert>,
    node_id: NodeId,
) -> Result<(), KeyValidationError> {
    let cert = tls_certificate
        .as_ref()
        .ok_or_else(|| invalid_tls_certificate_error("certificate is missing"))?;
    let x509_cert = parse_x509_v3_certificate(&cert.certificate_der)?;
    let subject_cn = single_subject_cn_as_str(&x509_cert)?;
    ensure_subject_cn_equals_node_id(subject_cn, node_id)?;
    ensure_single_issuer_cn_equals_subject_cn(&x509_cert, subject_cn)?;
    ensure_not_ca(&x509_cert)?;
    ensure_notbefore_date_is_latest_in_two_minutes_from_now(&x509_cert)?;
    ensure_notafter_date_equals_99991231235959z(&x509_cert)?;
    ensure_signature_algorithm_is_ed25519(&x509_cert)?;
    let public_key = ed25519_pubkey_from_x509_cert(&x509_cert)?;
    verify_ed25519_public_key(&public_key)?;
    verify_ed25519_signature(&x509_cert, &public_key).map_err(|e| {
        invalid_tls_certificate_error(format!("signature verification failed: {}", e))
    })?;
    Ok(())
}
pub fn validate_tls_certificate ( tls_certificate : & Option < X509PublicKeyCert > , node_id : NodeId , ) -> Result < ( ) , KeyValidationError > { let cert = tls_certificate . as_ref ( ) . ok_or_else ( | | invalid_tls_certificate_error ( " " ) ) ? ; let x509_cert = parse_x509_v3_certificate ( & cert . certificate_der ) ? ; let subject_cn = single_subject_cn_as_str ( & x509_cert ) ? ; ensure_subject_cn_equals_node_id ( subject_cn , node_id ) ? ; ensure_single_issuer_cn_equals_subject_cn ( & x509_cert , subject_cn ) ? ; ensure_not_ca ( & x509_cert ) ? ; ensure_notbefore_date_is_latest_in_two_minutes_from_now ( & x509_cert ) ? ; ensure_notafter_date_equals_99991231235959z ( & x509_cert ) ? ; ensure_signature_algorithm_is_ed25519 ( & x509_cert ) ? ; let public_key = ed25519_pubkey_from_x509_cert ( & x509_cert ) ? ; verify_ed25519_public_key ( & public_key ) ? ; verify_ed25519_signature ( & x509_cert , & public_key ) . map_err ( | e | { invalid_tls_certificate_error ( format ! ( " " e ) ) } ) ? ; Ok ( ( ) ) }
Validates a node's TLS certificate.
Validates a node ' s TLS certificate .
tls_certificate
&Option<X509PublicKeyCert>
node_id
NodeId