Certificates

Two jobs sit in front of every signature: inspect a certificate to show the user what they are about to sign with, and filter a store or token down to the right certificate. Both are always available — no backend feature required.

Inspect — parse_certificate → CertDetails

parse_certificate(der) parses a DER certificate into the display-ready fields a "view certificate" UI shows, or None if the bytes are not a valid certificate.

use mudrit_keystore::{parse_certificate, CertDetails};

if let Some(d) = parse_certificate(signer.certificate()) {
    println!("Subject : {}", d.subject_cn);
    println!("Issuer  : {}", d.issuer_cn);
    println!("Valid   : {} → {}", d.not_before, d.not_after);
    println!("Usage   : {}", d.key_usage.join(", "));
    println!("SHA-256 : {}", d.sha256);
}

CertDetails fields:

Filter — CertFilter

CertFilter decides which certificates a picker or listing includes. Start from one of two bases and chain the predicates:

• CertFilter::default() — usable, in-date, end-entity RSA keys: excludes broken/missing keysets, expired or not-yet-valid certs, CA certs, and non-RSA keys. (Does not force signing-only or non-repudiation; chain those on.)
• CertFilter::any() — no filtering: every certificate in the store, CA certs, expired and non-RSA included.

use mudrit_keystore::CertFilter;

let f = CertFilter::default()
    .signing_only(true)
    .issuer_contains("Capricorn")
    .require_non_repudiation(true);

Every predicate:

Next