Certificates
parse_certificate, CertDetails, and CertFilter — inspecting and filtering X.509 certificates
These types are always compiled — no feature flag — since every backend needs to parse and filter certificates regardless of where the key lives.
parse_certificate
pub fn parse_certificate(der: &[u8]) -> Option<CertDetails>;Parse a DER-encoded X.509 certificate into a display-ready CertDetails. Returns
None if der isn't a well-formed certificate — this function never panics or errors, it's meant
for UI rendering (picker rows, a "view certificate" panel) where a bad input should just show nothing.
use mudrit::mudrit_keystore::parse_certificate;
if let Some(d) = parse_certificate(signer.certificate()) {
println!("{} <{}> — expires {}", d.subject_cn, d.subject_org, d.not_after);
}CertDetails
Everything worth showing a user about a certificate, pre-formatted as strings. Debug + Clone + Default.
Prop
Type
CertFilter
Which certificates a KeyStore, picker, or Pkcs11Manager::list_certificates shows. Debug + Clone;
Default is a sane "usable signing certificates only" filter, and every field is a builder method so
filters compose with . chaining.
Prop
Type
Prop
Type
Each field above also has a same-named builder method, e.g. .exclude_expired(false) or
.subject_contains("Acme"), each pub fn name(mut self, v) -> Self, so filters read as a chain:
use mudrit::prelude::*;
// Any non-expired certificate, including ECDSA and CAs — for an admin "show me everything" view
let everything = CertFilter::any().exclude_expired(true);
// Only certificates that satisfy non-repudiation, for a strict e-signature workflow
let strict = CertFilter::default().require_non_repudiation(true);
// A single specific certificate by thumbprint
let one = CertFilter::any().thumbprint_eq(Some("AB12CD34...".into()));