Struct CertificateManager 

pub struct CertificateManager {
    app_id: String,
    ca_cert: Option<Vec<u8>>,
    ca_key: Option<Vec<u8>>,
    server_certs: Arc<RwLock<HashMap<String, ServerCertData>>>,
}

Main certificate manager for TLS infrastructure

Manages a root CA certificate and generates server certificates as needed. The CA certificate is persisted in the OS keyring for security.

Fields

app_id: String

Application identifier for keyring storage

ca_cert: Option<Vec<u8>>

CA certificate PEM (cached from keyring)

ca_key: Option<Vec<u8>>

CA private key PEM (cached from keyring)

server_certs: Arc<RwLock<HashMap<String, ServerCertData>>>

Cached server certificates (hostname -> cert data)

Implementations

impl CertificateManager

const KEYRING_SERVICE: &'static str = "CodeEditorLand-TLS"

Keyring service name for certificate storage

const KEYRING_CA_CERT: &'static str = "ca_certificate"

Keyring entry name for CA certificate

const KEYRING_CA_KEY: &'static str = "ca_private_key"

Keyring entry name for CA private key

const CA_VALIDITY_DAYS: i64

Certificate validity period for CA (10 years)

const SERVER_VALIDITY_DAYS: i64 = 365

Certificate validity period for server certs (1 year)

pub const RENEWAL_THRESHOLD_DAYS: i64 = 30

Renewal threshold (renew if expiring within 30 days)

pub async fn new(app_id: &str) -> Result<Self>

Create a new CertificateManager instance

Arguments

• app_id - Application identifier for keyring storage

Example

let cert_manager = CertificateManager::new("myapp").await?;

pub async fn initialize_ca(&mut self) -> Result<()>

Initialize or load the CA certificate

This method attempts to load the CA certificate from the keyring. If not found, it generates a new self-signed CA and stores it.

Example

let mut cert_manager = CertificateManager::new("myapp").await?;
cert_manager.initialize_ca().await?;

fn generate_ca_cert(&self) -> Result<(Vec<u8>, Vec<u8>)>

Generate a new self-signed CA certificate

Returns (certificate PEM, private key PEM) tuple.

The CA certificate:

• Uses ECDSA P-256 curve for consistency with DNSSEC
• Has CA:TRUE basic constraint
• Allows keyCertSign and CRLSign key usage
• Valid for 10 years
• Includes proper extensions for CA functionality

pub async fn get_server_cert(&self, hostname: &str) -> Result<Arc<ServerConfig>>

Get or generate a server certificate for a specific hostname

Arguments

• hostname - The hostname (e.g., “code.editor.land”)

Returns

A rustls ServerConfig ready for HTTPS serving

Example

let mut cert_manager = CertificateManager::new("myapp").await?;
cert_manager.initialize_ca().await?;
let server_config = cert_manager.get_server_cert("code.editor.land").await?;

fn generate_server_cert(&self, hostname: &str) -> Result<ServerCertData>

Generate a server certificate signed by the CA

The certificate includes:

• Specified hostname as Common Name
• Subject Alternative Names: DNS hostname, 127.0.0.1, ::1
• Valid for 1 year with automatic renewal
• Server authentication EKUs

fn load_ca_from_keyring(&self) -> Result<Option<(Vec<u8>, Vec<u8>)>>

Load CA certificate and key from keyring

Returns Some((cert_pem, key_pem)) if found, None otherwise.

fn save_ca_to_keyring(&self, cert: &[u8], key: &[u8]) -> Result<()>

Save CA certificate and key to keyring

pub fn should_renew(&self, cert_pem: &[u8]) -> bool

Check if a certificate should be renewed

Returns true if the certificate is expiring within RENEWAL_THRESHOLD_DAYS.

pub async fn renew_certificate(&mut self, hostname: &str) -> Result<()>

Force renewal of a server certificate

Arguments

• hostname - The hostname whose certificate should be renewed

Example

let mut cert_manager = CertificateManager::new("myapp").await?;
cert_manager.initialize_ca().await?;
cert_manager.renew_certificate("code.editor.land").await?;

pub async fn build_server_config( &self, hostname: &str, ) -> Result<Arc<ServerConfig>>

Build a ServerConfig for a specific hostname

This is a convenience wrapper around get_server_cert().

Arguments

• hostname - The hostname (e.g., “code.editor.land”)

Example

let mut cert_manager = CertificateManager::new("myapp").await?;
cert_manager.initialize_ca().await?;
let server_config = cert_manager.build_server_config("code.editor.land").await?;

pub fn get_ca_cert_pem(&self) -> Option<Vec<u8>>

Get the CA certificate in PEM format

This can be used to install the CA in the system trust store or configure the webview to trust it.

Returns

CA certificate PEM, or None if CA is not initialized

Example

let mut cert_manager = CertificateManager::new("myapp").await?;
cert_manager.initialize_ca().await?;
let ca_cert = cert_manager.get_ca_cert_pem().unwrap();
println!("CA Certificate:\n{}", String::from_utf8_lossy(&ca_cert));

pub fn get_server_cert_info(&self, hostname: &str) -> Option<CertificateInfo>

Get information about a server certificate

Arguments

• hostname - The hostname (e.g., “code.editor.land”)

Returns

CertificateInfo if the certificate exists

Example

let mut cert_manager = CertificateManager::new("myapp").await?;
cert_manager.initialize_ca().await?;
cert_manager.get_server_cert("code.editor.land").await?;
let info = cert_manager.get_server_cert_info("code.editor.land").unwrap();
println!("Certificate valid until: {}", info.valid_until);

pub fn get_all_certs(&self) -> HashMap<String, CertificateInfo>

Get all cached server certificates

Returns

A HashMap mapping hostnames to certificate info

Example

let mut cert_manager = CertificateManager::new("myapp").await?;
cert_manager.initialize_ca().await?;
cert_manager.get_server_cert("code.editor.land").await?;
cert_manager.get_server_cert("api.editor.land").await?;
let all_certs = cert_manager.get_all_certs();
for (hostname, info) in all_certs {
	println!("{}: valid until {}", hostname, info.valid_until);
}

fn cert_der_to_pem(der: &[u8]) -> Result<Vec<u8>>

Convert DER certificate to PEM format

fn private_key_der_to_pem(der: &[u8]) -> Result<Vec<u8>>

Convert DER private key to PEM format

fn pem_to_der(pem: &[u8], label: &str) -> Result<Vec<u8>>

Convert PEM to DER

fn extract_cert_info( &self, cert_der: &[u8], hostname: &str, is_ca: bool, ) -> Result<CertificateInfo>

Extract certificate information from DER data

fn check_cert_validity(&self, cert_pem: &[u8]) -> Result<CertValidityResult>

Check certificate validity and renewal status

fn parse_not_after(not_after: &ASN1Time) -> Result<DateTime<Utc>>

Parse X.509 not_after time to chrono DateTime

fn not_as_unix_timestamp(not_after: &ASN1Time) -> Option<i64>

Helper function to convert ASN1Time to Unix timestamp