Struct ReenrollRequest 

pub struct ReenrollRequest { /* private fields */ }

Re-enrollment request (RFC 7030 §4.2.2).

Identical wire format to EnrollRequest, but with additional requirements:

• The client MUST present a valid certificate via mTLS
• The CSR subject MUST match the mTLS certificate subject
• The CSR public key MAY differ (key rotation)

Subject matching is enforced by the EST server before processing.

Implementations

impl ReenrollRequest

pub fn new(csr_der: Vec<u8>) -> Self

Creates a new re-enrollment request from a DER-encoded PKCS#10 CSR.

pub fn from_enroll_request(inner: EnrollRequest) -> Self

Creates from an existing EnrollRequest.

pub fn inner(&self) -> &EnrollRequest

Returns the inner enrollment request.

pub fn into_inner(self) -> EnrollRequest

Consumes self and returns the inner enrollment request.

pub fn csr_der(&self) -> &[u8]

Returns the raw DER-encoded CSR.

pub fn into_csr_der(self) -> Vec<u8>

Consumes self and returns the DER-encoded CSR.

pub fn to_base64(&self) -> String

Encodes the request as base64 for HTTP transport.

pub fn from_base64(base64_data: &str) -> EstResult<Self>

Decodes a base64-encoded re-enrollment request.

pub fn validate(&self) -> EstResult<()>

Validates the CSR structure.

pub fn validate_subject_match( &self, mtls_subject: &str, csr_subject: &str, ) -> EstResult<()>

Validates subject matching between CSR and mTLS client certificate.

Arguments

• mtls_subject - Distinguished name from mTLS client certificate
• csr_subject - Distinguished name from CSR (parsed by caller)

Errors

Returns EstError::SubjectMismatch if subjects don’t match.

Note

Subject parsing is delegated to the caller (CA module) since it requires full X.509 ASN.1 parsing. This method only compares the pre-parsed values.

pub fn contains_ml_dsa(&self) -> bool

Checks if the CSR appears to contain an ML-DSA public key.

pub fn contains_ml_kem(&self) -> bool

Checks if the CSR appears to contain an ML-KEM public key.

pub fn to_certification_request(&self) -> CertificationRequest

Returns a parsed CertificationRequest from the inner DER-encoded CSR.

Delegates to EnrollRequest::to_certification_request. The CA module populates the struct fields from actual ASN.1 parsing.

Trait Implementations

impl Clone for ReenrollRequest

fn clone(&self) -> ReenrollRequest

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ReenrollRequest

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ReenrollRequest

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for ReenrollRequest

fn eq(&self, other: &ReenrollRequest) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for ReenrollRequest

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for ReenrollRequest

impl StructuralPartialEq for ReenrollRequest