pub struct KraClient { /* private fields */ }Expand description
Client for Dogtag KRA REST API operations.
Manages a separate HTTP client configured for the KRA subsystem.
The KRA may run on the same host as the CA but uses a different
subsystem path (/kra/rest/...).
Implementations§
Source§impl KraClient
impl KraClient
Sourcepub fn new(config: &DogtagConfig) -> DogtagResult<Self>
pub fn new(config: &DogtagConfig) -> DogtagResult<Self>
Create a new KRA client from the Dogtag configuration.
Uses the same agent credentials as the CA client but connects
to the KRA subsystem URL. Returns an error if kra_url is not
configured.
Sourcepub async fn generate_key(
&self,
key_type: &str,
key_size: u32,
) -> DogtagResult<KeyGenResult>
pub async fn generate_key( &self, key_type: &str, key_size: u32, ) -> DogtagResult<KeyGenResult>
Generate a key pair on the KRA.
Sends POST /kra/rest/agent/keys/generate to create a new key pair.
The private key is archived in the KRA and the public key is returned
for inclusion in the certificate request.
§Supported Algorithms
- RSA:
key_type = "RSA",key_size = 2048 | 3072 | 4096 - ECDSA:
key_type = "EC",key_size = 256 | 384 | 521 - ML-KEM:
key_type = "ML-KEM-512" | "ML-KEM-768" | "ML-KEM-1024",key_size = 0
Sourcepub async fn archive_key(
&self,
key_id: &str,
wrapped_key: &[u8],
) -> DogtagResult<String>
pub async fn archive_key( &self, key_id: &str, wrapped_key: &[u8], ) -> DogtagResult<String>
Archive a private key in the KRA.
Sends POST /kra/rest/agent/keys/archive to store a wrapped
private key for later recovery. Returns the KRA key identifier.
Sourcepub async fn recover_key(&self, key_id: &str) -> DogtagResult<Vec<u8>>
pub async fn recover_key(&self, key_id: &str) -> DogtagResult<Vec<u8>>
Recover an archived private key from the KRA.
Sends POST /kra/rest/agent/keys/{key_id}/recover to retrieve
a previously archived key. The key is returned in its wrapped form.