Struct KraClient 

pub struct KraClient { /* private fields */ }

Implementations

impl KraClient

pub fn new(config: &DogtagConfig) -> DogtagResult<Self>

pub async fn login(&self)

pub async fn generate_key( &self, key_type: &str, key_size: u32, ) -> DogtagResult<KeyGenResult>

pub async fn archive_key( &self, key_data: &[u8], algorithm: &str, ) -> DogtagResult<String>

pub async fn recover_key(&self, key_id: &str) -> DogtagResult<Vec<u8>>

pub async fn recover_key_p12( &self, key_id: &str, cert_der: &[u8], ) -> DogtagResult<Vec<u8>>

Recover a private key via PKCS#12 passphrase path.

Three-call flow per Dogtag KeyClient.retrieveKeyByPKCS12():

1. Submit recovery request (keyId + certificate)
2. Approve the recovery (mandatory, even with single agent)
3. Retrieve PKCS#12 (keyId + requestId + passphrase)

Returns the PKCS#8 DER-encoded private key.

pub async fn recover_key_no_cert(&self, key_id: &str) -> DogtagResult<Vec<u8>>

Recover a private key via PKCS#12 without requiring a certificate.

Variant for freshly KRA-generated keys (SSKG flow: generate → recover → build CSR → enroll). Returns PKCS#8 DER.

pub async fn get_transport_cert(&self) -> DogtagResult<Vec<u8>>

Fetch the KRA transport certificate as DER.

The transport cert’s ML-KEM-1024 public key is used by clients to encapsulate the shared secret for key archival.

pub async fn search_keys( &self, client_key_id: Option<&str>, max_results: u32, ) -> DogtagResult<Vec<KeySearchEntry>>

Search for archived keys on the KRA.

Returns the most recent key matching the query. The KRA stores keys with a clientKeyID that typically contains the cert subject DN. If no query is given, returns the most recently archived key.