Module issue 

Certificate issuance from CSR with CA/B Forum compliance.

Implements RFC 7030 §4.2 enrollment and applies profile-based constraints. Validates CSR contents against CA/B Forum Baseline Requirements before signing.

Certificate signing uses the synta-certificate CertificateBuilder with OpensslCertificateSigner for the actual cryptographic operations.

Structs

EnrollmentProfile

Enrollment profile defining constraints for issued certificates.

IssuanceResult

Result of a successful certificate issuance.

Enums

CaSigningKey

CA signing key — either a PEM key from disk or an HSM-backed key.

IssuanceError

Errors during certificate issuance.

ResolvedSigningKey

Owned signing key — either PEM bytes from disk or an HSM context + label.

Constants

OID_TLS_FEATURE

OID for the TLS Feature Extension (id-pe-tlsfeature).

TLS_FEATURE_MUST_STAPLE_DER

DER-encoded TLS Feature Extension value for must-staple certificates.

Functions

cab_forum_max_validity_days

CA/B Forum maximum validity period per Ballot SC-081v3.

issue_certificate

Issue a certificate from a CSR.

resolve_signing_key

Resolve the CA signing key from configuration (async — uses tokio::fs::read).

resolve_signing_key_sync

Resolve the CA signing key from configuration (sync — uses std::fs::read).