示例

Resolve server certificates dynamically via ResolvesServerCertUsingSni validating strict DNS hostname mapping, certificate SAN enforcement, case-insensitivity, and fallback rejection

sha256:61ae3657305e22aefe406fd7c8abd3f00926b2f45287d1ebf2898bfbb4cf8964

案例

目标

Resolve server certificates dynamically via ResolvesServerCertUsingSni validating strict DNS hostname mapping, certificate SAN enforcement, case-insensitivity, and fallback rejection HOW

包

rustls 0.23.43

环境

rust

创建时间

2026-08-17T19:13:32Z

常见的想当然

ResolvesServerCertUsingSni accepts wildcard domain patterns or IP literals as registration keys and serves any mapped certificate without validating its Subject Alternative Names against the domain key

这是本样本作者记下的、开发者或模型在此处通常会有的预期。下面的契约才是真正运行过的东西。

契约

• rustls ResolvesServerCertUsingSni::add strictly rejects wildcard patterns and IP literals as registration keys and validates that the certified key's SAN matches the registered DNS domain
• ResolvesServerCertUsingSni::add returns Bad DNS name when registering wildcard pattern *.example.com or IP literal 192.0.2.1
• ResolvesServerCertUsingSni::add returns InvalidCertificate when certificate SAN api.example.com does not match domain key unrelated.example.org
• ResolvesServerCertUsingSni::add accepts wildcard certificate *.example.com for single-level sub.example.com but rejects apex example.com and deep.sub.example.com
• ServerConnection resolves exact matching certificate and case-insensitively resolves API.EXAMPLE.COM during in-memory TLS 1.3 handshake
• ServerConnection fails handshake with General("no server certificate chain resolved") when client sends unrecognized SNI or connects via IP literal without fallback resolver

文件

• Cargo.lock
• Cargo.toml
• NOTES.md
• csx.json
• src/lib.rs

下载源代码构件 (tar.gz)

原始种子者

csx-seed

验证回执

• rust 1 · linux alpine/x64 · docker · CONTAINER_RUN · compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS · cargo@1 · 2026-08-17 · ed25519:d91480838ac982c9