Brian Smith 04d37e7261 Change the certificate validation API to guarantee end-entity is ...

present.

Rustls already handles internally the case where no certificate is
present in the Certificate message. Every implementation of the
certificate verification APIs currently needs to deal with the
possibility that the end-entity certificate wasn't provided, or
dangerously assume that the list of certificates it is given is never
empty. Make it clear that it will be given at least the end-entity
certificate by splitting the end-entity certificate out into its own
parameter. This makes it easier to correctly and safely implement the
certificate verifier interfaces.

In the previous API, the ordering of the certificates in the chain was
not documented; the API required knowledge of the TLS specification and
an assumption that Rustls does the "obvious" thing to know that the
end-entity certificate is at the beginning. The new API avoids any
doubt about this. Also, there is now documentation that guarantees that
the intermediates are in the same order that they were in the handshake.

This also makes static analysis easier because it eliminates a use of
the panic-prone `[]` slice indexing operator.

2021-02-06 11:12:50 +00:00

..

tlsclient.rs

Change the certificate validation API to guarantee end-entity is

2021-02-06 11:12:50 +00:00

tlsserver.rs

Move pemfile parsing module to a separate crate

2020-12-28 15:53:31 +00:00