Module csr 

Platform-abstracted client CSR generation.

A client’s inner-mTLS private key SHOULD be non-exportable and hardware-backed (iOS Secure Enclave / Android Keystore) so it cannot be exfiltrated even if the device is compromised (threat A5). Those keystores expose only ECDSA P-256, so that is the default client suite; the CA signs P-256 leaves and mixed-algorithm chains are fine in rustls/webpki.

This module is the seam. CsrSigner produces a PKCS#10 CSR while the private key stays wherever the platform holds it. The in-tree SoftwareP256Signer is the desktop path: an extractable rcgen P-256 key the caller persists locally. Mobile clients implement CsrSigner against their keystore and return a ClientKey::HardwareAlias. In either case only the CSR ever leaves the device; the issuer overrides the requested subject with the device id it assigns (A7), so a client cannot choose its own identity.

Structs

ClientCsr

A generated client CSR plus the handle to its private key.

SoftwareP256Signer

The desktop signer: an extractable ECDSA P-256 keypair generated in software via rcgen. The key is returned to the caller to persist locally.

Enums

ClientKey

Where a freshly generated client private key lives after CSR creation.

Traits

CsrSigner

Produces a client CSR while holding the private key per the platform.