Ejemplo
Resolve server certificates dynamically via ResolvesServerCertUsingSni validating strict DNS hostname mapping, certificate SAN enforcement, case-insensitivity, and fallback rejection
sha256:61ae3657305e22aefe406fd7c8abd3f00926b2f45287d1ebf2898bfbb4cf8964
PUBLISHED
L3_CONTRACT_PASS
MIT-0
Evidencia de ejecución
Separamos el entorno declarado de las ejecuciones firmadas para mostrar qué se demostró.
Base de evidenciaContrato firmado aprobado
Recibos de verificación1
Nivel de verificaciónL3_CONTRACT_PASS
Entorno declarado
- Contexto de ejecución
- rust
- Sistema operativo
- linux
- Arquitectura
- x64
- Runtime
- rust
- Lenguaje
- rust
- Gestor de paquetes
- cargo
Entornos de las ejecuciones de verificación
- Contexto de ejecución
- rust 1
- Sistema operativo
- linux alpine · musl
- Arquitectura
- x64
- Runtime
- rust 1
- Lenguaje
- rust
- Gestor de paquetes
- cargo
- Ejecución
- container · docker
CONTAINER_RUN · compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS · cargo@1 · 2026-08-17
Caso
- Objetivo
- Resolve server certificates dynamically via ResolvesServerCertUsingSni validating strict DNS hostname mapping, certificate SAN enforcement, case-insensitivity, and fallback rejection HOW
- Paquetes
-
rustls 0.23.43
- Entorno
- rust
- Creado
- 2026-08-17T19:13:32Z
Lo que suele suponerse
ResolvesServerCertUsingSni accepts wildcard domain patterns or IP literals as registration keys and serves any mapped certificate without validating its Subject Alternative Names against the domain key
El autor de la muestra anotó aquí lo que un desarrollador o un modelo esperaría. El contrato de abajo es lo que realmente se ejecutó.
Contrato
- rustls ResolvesServerCertUsingSni::add strictly rejects wildcard patterns and IP literals as registration keys and validates that the certified key's SAN matches the registered DNS domain
- ResolvesServerCertUsingSni::add returns Bad DNS name when registering wildcard pattern *.example.com or IP literal 192.0.2.1
- ResolvesServerCertUsingSni::add returns InvalidCertificate when certificate SAN api.example.com does not match domain key unrelated.example.org
- ResolvesServerCertUsingSni::add accepts wildcard certificate *.example.com for single-level sub.example.com but rejects apex example.com and deep.sub.example.com
- ServerConnection resolves exact matching certificate and case-insensitively resolves API.EXAMPLE.COM during in-memory TLS 1.3 handshake
- ServerConnection fails handshake with General("no server certificate chain resolved") when client sends unrecognized SNI or connects via IP literal without fallback resolver
Archivos
- Cargo.lock
- Cargo.toml
- NOTES.md
- csx.json
- src/lib.rs
Descargar el artefacto de código fuente (tar.gz)
Seeder de origen
csx-seed
Recibos de verificación
- rust 1 · linux alpine/x64 · docker · CONTAINER_RUN · compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS · cargo@1 · 2026-08-17 · ed25519:d91480838ac982c9