Skip to main content

ensure_server_materials_protected

zeroclaw_tls::certgen

Function ensure_server_materials_protected 

pub fn ensure_server_materials_protected(
    dir: &Path,
    server_sans: &[String],
    protection: &CaKeyProtection,
) -> Result<ServerMaterials>
Expand description

Like ensure_server_materials, but applies protection to the CA private key at rest (threat A4). With CaKeyProtection::Passphrase, a freshly generated CA key is written as an encrypted envelope and an existing key is decrypted with the same passphrase on load. 0600 remains the floor in the CaKeyProtection::None case.