/// Validates a node's TLS certificate.
///
/// Validation of a *node's TLS certificate* includes verifying that
/// * the certificate is well-formed, i.e., formatted in X.509 version 3 and
///   DER-encoded
/// * the certificate has a single subject common name (CN) that matches the
///   `node_id`
/// * the certificate has a single issuer common name (CN) that matches the
///   subject CN (indicating that the certificate is self-signed)
/// * the certificate is NOT for a certificate authority. This means either 1)
///   there are no BasicConstraints extensions, or 2) if there are
///   BasicConstraints then one is `CA` and it's set to `False`.
/// * the certificate's notBefore date is latest in two minutes from now. This
///   is to ensure that the certificate is already valid or becomes valid
///   shortly. The grace period is to account for potential clock differences.
/// * the certificate's notAfter date indicates according to [RFC 5280 (section
///   4.1.2.5)] that the certificate has no well-defined expiration date.
/// * the certificate's signature algorithm is Ed25519 (OID 1.3.101.112)
/// * the certificate's public key is valid, which includes checking that the
///   key is a point on the curve and in the right subgroup
/// * the certificate's signature is valid w.r.t. the certificate's public key,
///   that is, the certificate is correctly self-signed
///
/// [RFC 5280 (section 4.1.2.5)]: https://tools.ietf.org/html/rfc5280#section-4.1.2.5
Validates a node's TLS certificate.
Validation of a *node's TLS certificate* includes verifying that
the certificate is well-formed, i.e., formatted in X.509 version 3 and
DER-encoded
the certificate has a single subject common name (CN) that matches the
`node_id`
the certificate has a single issuer common name (CN) that matches the
subject CN (indicating that the certificate is self-signed)
the certificate is NOT for a certificate authority. This means either 1)
there are no BasicConstraints extensions, or 2) if there are
BasicConstraints then one is `CA` and it's set to `False`.
the certificate's notBefore date is latest in two minutes from now. This
is to ensure that the certificate is already valid or becomes valid
shortly. The grace period is to account for potential clock differences.
the certificate's notAfter date indicates according to [RFC 5280 (section
4.1.2.5)] that the certificate has no well-defined expiration date.
the certificate's signature algorithm is Ed25519 (OID 1.3.101.112)
the certificate's public key is valid, which includes checking that the
key is a point on the curve and in the right subgroup
the certificate's signature is valid w.r.t. the certificate's public key,
that is, the certificate is correctly self-signed


Validates a node ' s TLS certificate . Validation of a * node ' s TLS certificate * includes verifying that the certificate is well - formed i . e . formatted in X . 509 version 3 and DER - encoded the certificate has a single subject common name ( CN ) that matches the ` node_id ` the certificate has a single issuer common name ( CN ) that matches the subject CN ( indicating that the certificate is self - signed ) the certificate is NOT for a certificate authority . This means either 1 ) there are no BasicConstraints extensions or 2 ) if there are BasicConstraints then one is ` CA ` and it ' s set to ` False ` . the certificate ' s notBefore date is latest in two minutes from now . This is to ensure that the certificate is already valid or becomes valid shortly . The grace period is to account for potential clock differences . the certificate ' s notAfter date indicates according to [ RFC 5280 ( section 4 . 1 . 2 . 5 ) ] that the certificate has no well - defined expiration date . the certificate ' s signature algorithm is Ed25519 ( OID 1 . 3 . 101 . 112 ) the certificate ' s public key is valid which includes checking that the key is a point on the curve and in the right subgroup the certificate ' s signature is valid w . r . t . the certificate ' s public key that is the certificate is correctly self - signed
pub fn validate_tls_certificate(
    tls_certificate: &X509PublicKeyCert,
    node_id: NodeId,
) -> Result<(), TlsCertValidationError> {
    let x509_cert = parse_x509_v3_certificate(&tls_certificate.certificate_der)?;
    let subject_cn = single_subject_cn_as_str(&x509_cert)?;
    ensure_subject_cn_equals_node_id(subject_cn, node_id)?;
    ensure_single_issuer_cn_equals_subject_cn(&x509_cert, subject_cn)?;
    ensure_not_ca(&x509_cert)?;
    ensure_notbefore_date_is_latest_in_two_minutes_from_now(&x509_cert)?;
    ensure_notafter_date_equals_99991231235959z(&x509_cert)?;
    ensure_signature_algorithm_is_ed25519(&x509_cert)?;
    let public_key = ed25519_pubkey_from_x509_cert(&x509_cert)?;
    verify_ed25519_public_key(&public_key)?;
    verify_ed25519_signature(&x509_cert, &public_key).map_err(|e| {
        invalid_tls_certificate_error(format!("signature verification failed: {}", e))
    })?;
    Ok(())
}
pub fn validate_tls_certificate ( tls_certificate : & X509PublicKeyCert , node_id : NodeId , ) -> Result < ( ) , TlsCertValidationError > { let x509_cert = parse_x509_v3_certificate ( & tls_certificate . certificate_der ) ? ; let subject_cn = single_subject_cn_as_str ( & x509_cert ) ? ; ensure_subject_cn_equals_node_id ( subject_cn , node_id ) ? ; ensure_single_issuer_cn_equals_subject_cn ( & x509_cert , subject_cn ) ? ; ensure_not_ca ( & x509_cert ) ? ; ensure_notbefore_date_is_latest_in_two_minutes_from_now ( & x509_cert ) ? ; ensure_notafter_date_equals_99991231235959z ( & x509_cert ) ? ; ensure_signature_algorithm_is_ed25519 ( & x509_cert ) ? ; let public_key = ed25519_pubkey_from_x509_cert ( & x509_cert ) ? ; verify_ed25519_public_key ( & public_key ) ? ; verify_ed25519_signature ( & x509_cert , & public_key ) . map_err ( | e | { invalid_tls_certificate_error ( format ! ( " " e ) ) } ) ? ; Ok ( ( ) ) }
Validates a node's TLS certificate.
Validates a node ' s TLS certificate .
tls_certificate
&X509PublicKeyCert
node_id
NodeId