Skip to main content

validate_pop_linking

kipuka::auth::mtls

Function validate_pop_linking 

Source 
pub fn validate_pop_linking(
    auth: &AuthResult,
    csr_subject: &str,
) -> Result<(), String>
Expand description

Validate that the mTLS client certificate identity matches the CSR subject.

RFC 7030 §3.5 (Proof-of-Possession): for /simplereenroll, the TLS client certificate subject MUST match the CSR subject to prove the client possesses the private key corresponding to the certificate being renewed.

The full formatted distinguished names are trimmed and compared case-insensitively. SAN hostname matching cannot authorize a subject change. CSR signature verification is performed separately by the issuer.

Returns Ok(()) if subjects match, Err with a description if not.