Struct RelayPinVerifier 

pub struct RelayPinVerifier { /* private fields */ }

A rustls SERVER-certificate verifier that PINS the relay’s OUTER leaf cert by its SHA-256 fingerprint instead of chaining to a CA (threat A2: the outer TLS is a metadata boundary, not the RPC boundary; the inner mTLS is the real one).

Two modes:

• RelayPinVerifier::pinned: the presented leaf MUST match the expected fingerprint, else the connection is refused. The handshake signature is still verified against the leaf’s key, so a pin is a real cryptographic bind.
• RelayPinVerifier::tofu: trust-on-first-use - accept the first leaf seen and RECORD its fingerprint (read back with observed_pin and persist it), so the next connection is pinned. Opt-in only; never a silent default.

The server NAME is intentionally not checked: pinning the exact leaf already fixes the identity, which suits a self-hosted relay reached by IP.

Implementations

impl RelayPinVerifier

pub fn pinned(expected_sha256_hex: impl Into<String>) -> Self

Require the relay’s outer leaf to match expected_sha256_hex.

pub fn tofu() -> Self

Trust-on-first-use: accept the first leaf and record its fingerprint.

pub fn observed_pin(&self) -> Option<String>

The leaf fingerprint observed during a TOFU handshake, if any. Persist it so later connections pin instead of re-trusting.

Trait Implementations

impl Debug for RelayPinVerifier

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl ServerCertVerifier for RelayPinVerifier

fn verify_server_cert( &self, end_entity: &CertificateDer<'_>, _intermediates: &[CertificateDer<'_>], _server_name: &ServerName<'_>, _ocsp_response: &[u8], _now: UnixTime, ) -> Result<ServerCertVerified, Error>

Verify the end-entity certificate end_entity is valid for the hostname dns_name and chains to at least one trust anchor.

fn verify_tls12_signature( &self, message: &[u8], cert: &CertificateDer<'_>, dss: &DigitallySignedStruct, ) -> Result<HandshakeSignatureValid, Error>

Verify a signature allegedly by the given server certificate.

fn verify_tls13_signature( &self, message: &[u8], cert: &CertificateDer<'_>, dss: &DigitallySignedStruct, ) -> Result<HandshakeSignatureValid, Error>

Verify a signature allegedly by the given server certificate.

fn supported_verify_schemes(&self) -> Vec<SignatureScheme>

Return the list of SignatureSchemes that this verifier will handle, in verify_tls12_signature and verify_tls13_signature calls.

fn requires_raw_public_keys(&self) -> bool

Returns whether this verifier requires raw public keys as defined in RFC 7250.

fn root_hint_subjects(&self) -> Option<&[DistinguishedName]>

Return the [DistinguishedName]s of certificate authorities that this verifier trusts.