Enum KipukaError 

pub enum KipukaError {
    Config(String),
    Tls(String),
    Db(String),
    Hsm(String),
    Auth(String),
    Est(String),
    Ca(String),
    Audit(String),
    Io(String),
    NotFound,
    MethodNotAllowed,
    PayloadTooLarge,
    UnsupportedMediaType,
    Forbidden(String),
    BadRequest(String),
    ServiceUnavailable(String),
    Internal(String),
}

Unified error type for the Kipuka EST server.

Each variant maps to a specific failure domain. The [IntoResponse] implementation translates these into HTTP responses suitable for EST clients per RFC 7030 §4.2.3.

Variants

Config(String)

Configuration file parse or validation error.

Tls(String)

TLS setup failure (certificate loading, cipher negotiation, etc.).

Db(String)

Database connection or query failure.

Hsm(String)

HSM / PKCS#11 session error.

Auth(String)

Authentication or authorization failure.

RFC 7030 §3.2.3: EST server MUST respond with 401 when the client fails HTTP-based or certificate-based authentication.

Est(String)

EST protocol-level error (bad CSR, unsupported operation, etc.).

RFC 7030 §4.2.3: the server MAY return a CMC response body with a Full PKI Response indicating the failure reason.

Ca(String)

CA signing or certificate issuance error.

Audit(String)

Audit subsystem failure.

NIAP CA PP FAU_STG.4: when the audit trail is full and the overflow policy is halt, EST operations MUST be rejected.

Io(String)

I/O error (file system, socket, etc.).

NotFound

Resource not found (unknown EST label, unknown CA, etc.).

MethodNotAllowed

HTTP method not allowed on this endpoint.

PayloadTooLarge

Request payload exceeds configured max_body_size.

UnsupportedMediaType

Content-Type is not application/pkcs10 or another expected EST type.

RFC 7030 §4.2: EST endpoints expect specific MIME types.

Forbidden(String)

Forbidden: the client is authenticated but not authorized.

RFC 7231 §6.5.3: the server understood the request but refuses to authorize it. Used for EKU policy violations, identity mismatches, and revoked-certificate enrollment attempts.

BadRequest(String)

Bad request: malformed CSR, missing fields, etc.

ServiceUnavailable(String)

Service temporarily unavailable (HSM offline, DB unreachable, etc.).

Internal(String)

Catch-all internal server error.

Trait Implementations

impl Debug for KipukaError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for KipukaError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for KipukaError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl From<Error> for KipukaError

fn from(e: Error) -> Self

Converts to this type from the input type.

impl From<Error> for KipukaError

fn from(e: Error) -> Self

Converts to this type from the input type.

impl From<IssuanceError> for KipukaError

fn from(e: IssuanceError) -> Self

Classify an issuance failure into the correct HTTP domain.

A fault in the client-supplied CSR (bad self-signature/PoP, undersized key, disallowed algorithm, prohibited DN attribute) is a BadRequest → 400: the requester can fix the CSR and retry, and the specific reason is safe to return. Every other failure — signing, storage, or a server-side profile misconfiguration — is a Ca error → 500, whose detail is logged but never exposed to the client.

The client/server split is owned by IssuanceError::is_client_error so HTTP and CoAP transports classify identically.

impl IntoResponse for KipukaError

fn into_response(self) -> Response

Create a response.