rust -#rustc 1.98.1 (48a229cea 2026-09-01)m6GÂn62-64f5f36fb0927694RL.SAwjL-df1bddb45adbe94b1 Xr*-1ad4f876c768bda9<%Z>64V`-2d2ab9fb0fe1def5G g{(3iF-06449a08aaab5e30rustc_std_workspace_core{`"Ei%G-cb0d4d77988d81b5")pE͗E-3ec41d3a5a80a4a4 miniz_oxide8bž LƨJ-e44eaef1807e5fc0adler29lyA6P/D$UB-dca52f01a59c33e7 hashbrownX {e-143c77bb957d9940rustc_std_workspace_alloc _z%-145a318e0772276c std_detectK(0*8D?-f99feda5ce9e492arustc_demangle%jerV-cfd0ab54bb33760ecfg_if}λ՞Co-360da4ba13154744 addr2linecY\G--09755979c57b7e64gimliQ`Dy-9a1fede77fbbf2f0objectF λv.z-7ff85ea729a864ffmemchr]1<=UO-0e3477fb2664a277 jlToKG-549498e8b2e4d924rustls*:`-Zh]/-dd34ca9d1487a0ebrustls_pki_typesi&}16al-a9c4cf58fe1775a8zeroizeZbWJCw-0ae2e9de1fce3072 aws_lc_rs4{ (7( %-39ce43203c4945d3 aws_lc_sys+3 K-10f67b41e8954029webpkiXgv dP=D-f6aa7d34e64b5f06 untrustedAu*F-6046503770adb7b5subtleRB>-d2b64395c76666cblog|O=<-3e104b0ce6b0ff02rustls_native_certs c⮷Xcg-a20dd7f375a685e2 openssl_probep/w-$ |-5aeca0b807d90d4cCryptoProvidertdbg|CertificateDert | K=< apple "  ,  VerifierD  android<   D  <<  D< invalid_certificate <   " ALLOWED_EKUSd d  <docsrs4l )tests,$ ffi-testingverifier_for_dbg  |  verification others                       new_with_extra_roots> new_inner  "verify_server_cert# "verify_tls12_signature"verify_tls13_signature"supported_verify_schemes map_webpki_errors  *  log_server_certBuilderVerifierExt/with_platform_verifier1ConfigVerifierExt35  7inner 9 EkuError;  =  @:8:8:8#8#8#8#8#8#8#8#8%8%8%8%8%8&8&8&8&8&8'8>8>8>8A8A8+8+8+8-8-8/3g77 8 t|P g;;< bgW8hg/KK ConfigBuilderKKproviderK time_providerKsideٟ4DVV ClientConfigValpn_protocolsVcheck_selected_alpnV resumptionVmax_fragment_sizeVclient_auth_cert_resolverV enable_sniVkey_logVenable_secret_extractionVenable_early_dataV require_emsVV!Vversions!Vverifier!Vcert_decompressorsVcert_compressorsVcert_compression_cacheVech_mode!Vsend_ticket_requestC1KK WantsVerifierKKclient_ech_modeis843397=;"7?;@;*;,;1K5Vg/ g/3  KKKK 7Kphantom7K736UUWebPkiServerVerifierUrootsUcrlsUrevocation_check_depthUunknown_revocation_policyUrevocation_expiration_policyU supported=]FFFGlobal ě +w g( g % "@ :mÜĜŜƜǜȜ_wĤĤŤError :M  ggg cgbufcثq1ȡE!  $m{$!3"$  ř  V ~N 3 \ r| 2   ÜĜŜƜǜȜ_wFFInappropriateMessageF expect_typesFgot_typeFInappropriateHandshakeMessageF&F&FFInvalidEncryptedClientHelloFFFInvalidMessageFFFNoCertificatesPresentedFFUnsupportedNameTypeFF DecryptErrorFF EncryptErrorFFPeerIncompatibleFFFPeerMisbehaved FFF AlertReceived FFFInvalidCertificate FFFInvalidCertRevocationList FFGGeneral GGGFailedToGetCurrentTimeGGFailedToGetRandomBytesGGHandshakeNotCompleteGGPeerSentOversizedRecordGGNoApplicationProtocolGGBadMaxFragmentSizeGGInconsistentKeysGGGGVfϢ\$ &\ KKKK 7K7K736FF F cipher_suitesF kx_groupsF!signature_verification_algorithmsF secure_randomF key_provider9Ԩ#ͫ!| řǙșəʙ˙G*R{9 % extra_rootsQcrypto_providerf%HtUKK"K C TrustAnchorsubjectsubject_public_key_infoname_constraintsXJ!Z((RawVec+,_markerXՔ1!եK UK KK(FJX(   P&\3-28^NTZib  QP&,   $  %)  T     + $ ,L( 3  zL%η$L Uȷ$L54RX4(   32 I  T  d  CCC#=C=%! 7  7u 1'   ,  3<  3  \   3)  "  "  S,2R2S  ``Va`68Rt32UiL3T%5US22 UnsafeCell2.\*="```Align8`` x:B+}33TU 3L߮!3  a3T GFݱ}L)LR61$ #  #- 8, ,#- H,  ]a?Y"a?Z VbA]"bBZ ] 3f*ہ#a?[ a?\!a?\u g3 3 ggg cg#cثq1ȡ"Ba@[ \> ggg cg#cثq1ȡ" a?\j?Y Z[j!!! PhantomDatao$z - #  a?[ ?Z a? Y  a?Y  ]  Argumentf0m֔49d ,$ p w ż D^ D^ b 3< 3f*ہB D_ D_  3f*ہAL D ^_  D_ D^  $O  $N  $  5$F  7 %  %      "    %  "  h- !l    I+ CCC#=C=66"7context8D^ !((1+,2XՔF!-- RawVecInner/ 0cap1#,PMc!Unique 2]8"OBC FGGUsizeNoHighBit  HB F3 b d I`]`  3f*ہF-Ê Ja$b`a  FՋ KcËoe oeI$I$I3+oe ڋoepcaՋ Kbc F Kc@vd 3 AM! ?F!`!!!@o$z -Fd ManuallyDrop~$!`b Ja I` d b-    " "!-t#$ $" Q??IntoIter?#=?=?F=?=? =?=_O F!$#+%#% ,&&#F"'"( g f g: i h ig: hi;= <h < f8*i -$ # "1$ #(#-*(/+&/#-,8/- q m n q+ n q> o p p gF F?"B\ o p? po m no@on- mmq, A- /$-.".,rr  B3&Casis .C3* rs0s8r.$O/$N0$10D19F %* %1 0/,"F( %'&+&$#L " !UKtEtCCC#=C=1!37u?utqq36u3u! t t!z 2"; 3Lv}Lww ."  B~ ٙx=ߙxw)|49} σM F!xE ! Uninitialized"#Zeroed{uS!-ˣ]<1  t"4"5 :SRP:o;<<l?1$ #5#-7(1#81#-981#: kgd8d >51/>? ?} @KTL: H9 A: 1$:;;9   B30C   ;C 7   ;$O<$N=$> D>@  %7 %> =<9" E5  %4 #  %?2%@%A%B%C&DT&EJE] ʃaL 3:3 8UU RootCertStoreUXB CE 88ArcInner8strong7878data71%wxdbA3 &FD  CB"3<& &C'5%BUFE ')t{%*&-8'K(.[)' &+ "13./F3I30- J-2 $M $M '5&N &N ^f'M՚& ÜĜŜƜǜȜ_wg'#N &N $ML) *  [hOQE'Ou'QO#'Q ڻ'P 'P'( 'P 'PQQQO  6 =DM$3QL < p w~^ L3Tm2U<2 ROff"WarnInfoqTracewd~ 2R| S_7X=X^3_>W3X=7Xm_;Vw,_<VW_;V _;V     ." ."   #  # GlobalLogger ВQCn v3"kkqk5Eꊦn $# % 1 hi( fkfgll(k3l+ljjk'jmj '0  ." ."1/0#nnv3*o$/#%)*_ Uz%i~wiz~ Buɜ{Eиv((1+,2XՔB!GHC{  B7z{x ܜ{ zѣv3x; y ͝xbj~3 Iv Lw v 2 F 3 " 3! '2 " 2   %ɃS>=چ IITryReserveErrorI ?t r1&%}G-,3!E }H{ 3 :#^3 @x#ú @  4| (B!}!!!@o$z -B 5}>v CB!|3 |=y yx3-y;: &&5 k534m'4=  ." ."><=#nnv37o$<2#%61_ Є  G 2]8"Oc 3f*ہce   c ]Yb YbYb  Yb\)D Kb!!!!@o$z -c!   &E&F<&EE%b 3f*ہ88b8b7878b71%wxd.M'  iLAL::M 3< : 33ԫի֫׫ث٫ګ۫ܫGݫޫ߫F c1 3 D=  E F K.!!!!@o$z -!    DFC!3 Lլ 30CB  BVVV NoRootAnchorsVV InvalidCrlV;oCh-'\'  8F 88b8b7878b71%wxd3G3 ֌ B-܌A ' D 'B  A@ h 2'A%H@m? 7H% '? '?@#.2A>;DG 2]8"O 3f*ہ;  9642 ߍ1/ K!!!!@o$z -!/,NWKKKK 7K7K736 ! ' J ''( F 'UA '  x4B6?A'8A g''@ h\A3'G G@[hGiG' '}G?@'L^^ " M M # #"'"."" AKMC1B!F41m:>1!!W1<ѭU!<0DѮ!bB5 pBL`#'Q!$$$$$`''Qֻ''$('m'f_ ok "n*WLessGreater%ӡy _*}n++HB,#%n+C_-4-v_.E_.*&*^Ճ_00 kLɭ22L `3AL342;)L 4>4;31L 4 oka7W9768839#-8*:Z:';#; 7&/7== ta f3Xa??Ub?3ُa?b?3#1a?|bB3EbB  g3<3ME !5hEZEވ  DF!Z" GGЉ HG IG JG KG tLG4o}GF G_~NF͇5}NU9}HFu G8~PFEU}PHHCF!] G]QRHF!]R;S_!]^SH! GH!܉ ,GV!VIF5 GXFXZWIFF!U G[Z\!FU[Z-[BF5ٸ[k\BF5.\e]Ba]#M[F[JFEϊ GKFE GaFaKCF!- GccKFݔ G'eFBeeeBegBg eBFekiFu"i&iF#!8iKFEߋ GlFlKCF!- Gnn KFmۋ GLF5 GqFq\`LGF!U GjsFu]ss^!\s@ uUuTok"PwWwxxy#xz z{{w&w}}Y'2;;3JokO'BW#&fF<(FF#Fg3&31()Z>K T!;K-K[C1!-KWLo 4T"UL:3BULօe3BE3B!a5L73B!*ՙMB!!4FB!+UiwBECB!e˜YIEB!-NZ!B-Z\!B}BB, BB% B" BO BEB+B&*9x$P[P4oBuMB}CB!eòICB!UGB!UB^!F!+ֆi!'8;5^!:n^> ΅E9a$8ok"4W   #      &$   ,    2;  ;3 >ok,6W#&% f3-  3  3#  3  g303- , Z 0bKKKK 7K7K736b!4&1;bm8b,Lݘ c!er  c!  b B oBoxljk#c! WE} D~EW} !} =B! >!>! c5Ԕ?bcZXbcbXs8b%[~8b!X 9.! 9.!=ѬbEb'CebL `2;;3 a33L%88.!϶1)M F=_'!&'U#c/uӌ',!&#m8id^w\Y!URN!JFA=ljk#!852/,* !'$! !! ߍl 8 8!0`'0+)'`''0"!'&&\0[.|b:4v4v0v 4vi^%3m[}OD^h#QÜĜŜƜǜȜ_w#'Z bbh(1//CertificateResult0certs1errors܀R|S3 3  33+H7])akk#/ Argumentstemplateccg@# 3 3>A3M AX M "" LocationfilenameZZcolZ _filenameZA !!!NZ"NZ" řǙșəʙ˙G*R{9 FZ" NZ"iK&F1'O'kY'#.( F"(1(A<(1()))'c+III4 Kl+,k,#)---A--d/o/z/0m[}OD^h0ÜĜŜƜǜȜ_w'0ÜĜŜƜǜȜ_w'0UUServerCertVerifierBuilderUUUUUUsupported_algsx.Y10;0bC0.)hX!$/ 2VBi-$'%3$hE3$i5ֻ''u4'I4'3{2:2;3 :可5m4;(=35= Placeholderf formatterf _lifetimefCountf&<$g?>t?????;mVbAC DC4!DIf$IJ$JK/%GJ$G3 L$n3{:;=m5;38g>t?RKC C4!3*$CCC#=C=B!u+X+3+/s3t3s+G+ XiC3ÜĜŜƜǜȜ_wGv+iE11v2E23131H13{:; m16 3g>t??;C C4!w0c0:v/ c./3.0+5,,՟b,.Ѓ-i-ӌ)K+'*JJJ OtherErrorJ ]92++KKKK 7K7K736!b+w00ߍ0) 0ߍ0*'%3hE3iQ'u4I43c"Hc"Cc"/  test_root?&0  root_store:vcert3  4d&#  added ignored  lvl " oM M Z""error1'&"o1(+1(,"o-8-9 (G,H2 "k"k"k;<?1!##*1J_inner_repr_trick#M^HEǯ%HM FʋF3F3p F3Uݹħ3F13M5BZEB3ޜ!B3iB3dħ3pħ3e83D4v4v6Z447 8+n6NZ"N'n8F'n!510d'0. 20 2b 2. 20 2F'N'4. 20 21F/b 2& 2! <! ݯ n<>D! BĖ%3<?RD! wB+9!9 x% M%Y+wF9G Ȇ a%<>D!c1b4Dž2 33 9 33 9 33 : 33 :3 c11X5ki+ kk k09kGV+sk{kkk,kk 2222 w000 3:0 8 τ10188 8 8 ߍ78  08 +8 '8  "8  ߍ8 8 K! !7 7 4 4`064 JZ0W0 FR0'!#v84ohay]Y!TPJ!E@93 )) )   ) ))b) !!B*!<*!9*Oߍ88! '' 'o6n6w6w00:Oߍ;B4;ߍ;ew61:($ g "&.$>F"Q [#bkxH%%A*4<DM Zd     /3KuKWantsClientCert|VdVlKlK D7.)'&# rustls-platform-verifier [![crates.io version](https://img.shields.io/crates/v/rustls-platform-verifier.svg)](https://crates.io/crates/rustls-platform-verifier) [![crate documentation](https://docs.rs/rustls-platform-verifier/badge.svg)](https://docs.rs/rustls-platform-verifier) ![MSRV](https://img.shields.io/badge/rustc-1.85+-blue.svg) [![crates.io downloads](https://img.shields.io/crates/d/rustls-platform-verifier.svg)](https://crates.io/crates/rustls-platform-verifier) ![CI](https://github.com/1Password/rustls-platform-verifier/workflows/CI/badge.svg) A Rust library to verify the validity of TLS certificates based on the operating system's certificate facilities. On operating systems that don't have these, `webpki` and/or `rustls-native-certs` is used instead. This crate is advantageous over `rustls-native-certs` on its own for a few reasons: - Improved correctness and security, as the OSes [CA constraints](https://support.apple.com/en-us/HT212865) will be taken into account. - Better integration with OS certificate stores and enterprise CA deployments. - Revocation support via verifying validity via OCSP and CRLs. - Less I/O and memory overhead because all the platform CAs don't need to be loaded and parsed. This library supports the following platforms and flows: | OS | Certificate Store | Verification Method | Revocation Support | |----------------|-----------------------------------------------|--------------------------------------|--------------------| | Windows | Windows platform certificate store | Windows API certificate verification | Yes | | macOS (10.14+) | macOS platform roots and keychain certificate | macOS `Security.framework` | Yes | | iOS | iOS platform roots and keychain certificates | iOS `Security.framework` | Yes | | Android | Android System Trust Store | Android Trust Manager | Sometimes[^1] | | Linux | System CA bundle, or user-provided certs[^3] | webpki | No[^2] | | WASM | webpki roots | webpki | No[^2] | [^1]: On Android, revocation checking requires API version >= 24 (e.g. at least Android 7.0, August 2016). When available, revocation checking is only performed for the end-entity certificate. If a stapled OCSP response for the end-entity cert isn't provided, and the certificate omits both a OCSP responder URL and CRL distribution point to fetch revocation information from, revocation checking may fail. [^2]: The fall-back webpki verifier configured for Linux/WASM does not support providing CRLs for revocation checking. If you require revocation checking on these platforms, prefer constructing your own `WebPkiServerVerifier`, providing necessary CRLs. See the Rustls [`ServerCertVerifierBuilder`] docs for more information. [^3]: On Linux the [rustls-native-certs] and [openssl-probe] crates are used to try and discover the system CA bundle. Users may wish to augment these certificates with [webpki-roots] using [`Verifier::new_with_extra_roots`] in case a system CA bundle is unavailable. [`ServerCertVerifierBuilder`]: https://docs.rs/rustls/latest/rustls/client/struct.ServerCertVerifierBuilder.html [`Verifier::new_with_extra_roots`]: https://docs.rs/rustls-platform-verifier/latest/rustls_platform_verifier/struct.Verifier.html#method.new_with_extra_roots [rustls-native-certs]: https://github.com/rustls/rustls-native-certs [openssl-probe]: https://github.com/alexcrichton/openssl-probe [webpki-roots]: https://github.com/rustls/webpki-roots ## Deployment Considerations When choosing to use `rustls-platform-verifier` or another trust store option, these differences are important to consider. They are primarily about root certificate availability: | Backend | Updates | Roots used | Supports system-local roots | |-------------------------------------------------|---------------------------------|-------------------------------------------------------------------------------------------------------|------------------------------| | `rustls-platform-verifier` (non-Linux/BSD) | Updated by OS | System store, with full (dis)trust decisions from every source available. | Yes | | `rustls-native-certs` + `webpki` | Updated by OS | System store, with no (dis)trust decisions. All roots are treated equally regardless of their status. | Yes, with exceptions | | `webpki-roots` + `webpki` | Static, manual updates required | Hardcoded Mozilla CA roots, limited support for constrained roots. | No | **In general**: It is the opinion of the `rustls` and `rustls-platform-verifier` teams that this is the best default available for client-side libraries and applications making connections to TLS servers when running on common operating systems. This is because it gets both live trust information (new roots, explicit markers, and auto-managed CRLs) and better matches the common expectation of apps running on that platform (to use proxies, for example). Otherwise, it becomes your maintenance burden to ship updates right away in order to handle increasing numbers of positive and negative trust events in the WebPKI/certificate ecosystem, or risk availability and security concerns. #### Linux/BSD As of the time of writing, `rustls-platform-verifier` on these OSes only loads the trust stores from the OS once upon startup. This is the same behavior as `rustls-native-certs`, but the abstraction allows better behavior on the other platforms without extra work for downstreams. #### Other Alternatively, there is a clear answer to use static `webpki-roots` in your application instead if you are deploying containerized applications frequently, where root store changes will make it to production faster and any possibly used trust root is static by definition. Even though platform verifiers are sometimes implemented in memory-unsafe languages, it is very unlikely that Rust apps using this library will become a point of weakness. This is due to either using a smaller set of servers or just being less exposed then other critical functions of the operating system, default web browser, etc. But if your activity is identical or close to one of the following examples that process large amounts of untrusted input, a 100% Rust option like `webpki` is a more secure option: - Seeing how many TLS servers `rustls` with a specific configuration can connect to. - Harvesting data from various untrusted TLS endpoints exposed on the internet. - Extracting info from a known-evil endpoint. - Scanning all TLS certificates on the open internet. `rustls-platform-verifier` is widely deployed by several applications that use the `rustls` stack, such as 1Password, Bitwarden, Signal, and `rustup`, on a wide set of OSes. This means that it has received lots of exposure to edge cases and has real-world experience/expertise invested into it to ensure optimal compatibility and security. ## Installation and setup On most platforms, no setup should be required beyond adding the dependency via `cargo`: ```toml rustls-platform-verifier = "0.5" ``` To get a rustls `ClientConfig` configured to use the platform verifier use: ```rust use rustls::ClientConfig; use rustls_platform_verifier::ConfigVerifierExt; let config = ClientConfig::with_platform_verifier(); ``` This crate will use the [rustls process-default crypto provider](https://docs.rs/rustls/latest/rustls/crypto/struct.CryptoProvider.html#using-the-per-process-default-cryptoprovider). To construct a `ClientConfig` with a different `CryptoProvider`, use: ```rust use rustls::ClientConfig; use rustls_platform_verifier::BuilderVerifierExt; let arc_crypto_provider = std::sync::Arc::new(rustls::crypto::ring::default_provider()); let config = ClientConfig::builder_with_provider(arc_crypto_provider) .with_safe_default_protocol_versions() .unwrap() .with_platform_verifier() .unwrap() .with_no_client_auth(); ``` ### Android Some manual setup is required, outside of `cargo`, to use this crate on Android. In order to use Android's certificate verifier, the crate needs to call into the JVM. A small Kotlin component must be included in your app's build to support `rustls-platform-verifier`. If distributing a library, that component will need to be bundled into your release jar [as it is not yet available on Maven](https://github.com/rustls/rustls-platform-verifier/issues/115). #### Gradle Setup `rustls-platform-verifier` bundles the required native components in the crate, but the project must be setup to locate them automatically and correctly. These steps assume you are using `.gradle` Groovy files because they're the most common, but if you are using Kotlin scripts (`.gradle.kts`) for configuration instead, an example snippet is included towards the end of this section. Inside of your project's `build.gradle` file, add the following code and Maven repository definition. If applicable, this should only be the one "app" sub-project that will actually be using this crate at runtime. With multiple projects running this, your Gradle configuration performance may degrade.
App Snippets `$PATH_TO_DEPENDENT_CRATE` is the relative path to the Cargo manifest (`Cargo.toml`) of any crate in your workspace that depends on `rustls-platform-verifier` from the location of your `build.gradle` file: ```groovy import groovy.json.JsonSlurper // ...Your own script code could be here... repositories { // ... Your other repositories could be here... maven { url = findRustlsPlatformVerifierProject() metadataSources.artifact() } } String findRustlsPlatformVerifierProject() { def dependencyText = providers.exec { it.workingDir = new File("../") commandLine("cargo", "metadata", "--format-version", "1", "--filter-platform", "aarch64-linux-android", "--manifest-path", "$PATH_TO_DEPENDENT_CRATE/Cargo.toml") }.standardOutput.asText.get() def dependencyJson = new JsonSlurper().parseText(dependencyText) def manifestPath = file(dependencyJson.packages.find { it.name == "rustls-platform-verifier-android" }.manifest_path) return new File(manifestPath.parentFile, "maven").path } ``` Then, wherever you declare your dependencies, add the following: ```groovy implementation "rustls:rustls-platform-verifier:latest.release" ```
Library Snippets ```groovy import groovy.json.JsonSlurper // ...Your own script code could be here... File findRustlsPlatformVerifierClasses() { def dependencyText = providers.exec { it.workingDir = new File("../") commandLine("cargo", "metadata", "--format-version", "1") }.standardOutput.asText.get() def dependencyJson = new JsonSlurper().parseText(dependencyText) def manifestFile = file(dependencyJson.packages.find { it.name == "rustls-platform-verifier-android" }.manifest_path) return new File(manifestFile.parentFile, "classes.jar") } ``` Then, wherever you declare your dependencies, add the following: ```groovy implementation files(findRustlsPlatformVerifierClasses()) ```
Cargo automatically handles finding the downloaded crate in the correct location for your project. It also handles updating the version when new releases of `rustls-platform-verifier` are published. If you only use published releases, no extra maintenance should be required. These script snippets can be tweaked as best suits your project, but the `cargo metadata` invocation must be included so that the Android implementation part can be located on-disk. ##### Kotlin and Gradle
Kotlin script App example `build.gradle.kts`: ```kotlin import kotlinx.serialization.decodeFromString import kotlinx.serialization.json.Json import kotlinx.serialization.json.JsonObject import kotlinx.serialization.json.jsonArray import kotlinx.serialization.json.jsonObject import kotlinx.serialization.json.jsonPrimitive buildscript { dependencies { classpath(libs.kotlinx.serialization.json) } } repositories { rustlsPlatformVerifier() } fun RepositoryHandler.rustlsPlatformVerifier(): MavenArtifactRepository { @Suppress("UnstableApiUsage") val manifestPath = let { val dependencyJson = providers.exec { workingDir = File(project.rootDir, "../") commandLine("cargo", "metadata", "--format-version", "1", "--filter-platform", "aarch64-linux-android", "--manifest-path", "$PATH_TO_DEPENDENT_CRATE/Cargo.toml") }.standardOutput.asText val path = Json.decodeFromString(dependencyJson.get()) .getValue("packages") .jsonArray .first { element -> element.jsonObject.getValue("name").jsonPrimitive.content == "rustls-platform-verifier-android" }.jsonObject.getValue("manifest_path").jsonPrimitive.content File(path) } return maven { url = uri(File(manifestPath.parentFile, "maven").path) metadataSources.artifact() } } dependencies { // `rustls-platform-verifier` is a Rust crate, but it also has a Kotlin component. implementation(libs.rustls.platform.verifier) } ``` `libs.version.toml`: ```toml # We always use the latest release because `cargo` keeps it in sync with the associated Rust crate's version. rustls-platform-verifier = { group = "rustls", name = "rustls-platform-verifier", version = "latest.release" } ```
Kotlin script Library example `build.gradle.kts`: ```kotlin import kotlinx.serialization.decodeFromString import kotlinx.serialization.json.Json import kotlinx.serialization.json.JsonObject import kotlinx.serialization.json.jsonArray import kotlinx.serialization.json.jsonObject import kotlinx.serialization.json.jsonPrimitive buildscript { dependencies { classpath(libs.kotlinx.serialization.json) } } fun findRustlsPlatformVerifierClasses(): File { val dependencyJson = providers.exec { workingDir = File(project.rootDir, "../") commandLine("cargo", "metadata", "--format-version", "1") }.standardOutput.asText val path = Json.decodeFromString(dependencyJson.get()) .getValue("packages") .jsonArray .first { element -> element.jsonObject.getValue("name").jsonPrimitive.content == "rustls-platform-verifier-android" }.jsonObject.getValue("manifest_path").jsonPrimitive.content val manifestFile = File(path) return File(manifestFile.parentFile, "classes.jar") } dependencies { implementation(files(findRustlsPlatformVerifierClasses())) } ```
#### Proguard If your Android application makes use of Proguard for optimizations, its important to make sure that the Android verifier component isn't optimized out because it looks like dead code. Proguard is unable to see any JNI usage, so your rules must manually opt into keeping it. The following rule can do this for you: ```text -keep, includedescriptorclasses class org.rustls.platformverifier.** { *; } ``` #### Crate initialization In order for the crate to call into the JVM, it needs handles from Android. These are provided either the `init_external` or `init_hosted` function. These give `rustls-platform-verifier` the resources it needs to make calls into the Android certificate verifier. As an example, if your Rust Android component which the "native" Android part of your app calls at startup has an initialization, like this: ```rust ,ignore #[export_name = "Java_com_orgname_android_rust_init"] extern "C" fn java_init( env: JNIEnv, _class: JClass, context: JObject, ) -> jboolean { // ... initialize your app's other parts here. } ``` In the simplest case, you should to insert a call to `rustls_platform_verifier::android::init_hosted()` here, before any networking has a chance to run. This only needs to be called once and the verifier will be valid for the lifetime of your app's process. ```rust ,ignore extern "C" fn java_init( env: JNIEnv, _class: JClass, context: JObject, ) -> jboolean { // ... initialize your app's other parts here. // Then, initialize the certificate verifier for future use. rustls_platform_verifier::android::init_hosted(&env, context); } ``` In more advanced cases, such as where your code already stores long-lived handles into the Android environment, you can alternatively use `init_external`. This function takes a `&'static` reference to something that implements the `android::Runtime` trait, which the crate then uses to obtain the access when required to the JVM. ## Credits Made with ❤️ by the [1Password](https://1password.com/) and `rustls` teams. Portions of the Android and Windows verifier implementations were adapted and referenced from Chromium's previous verifier implementations as well. #### License Licensed under either of Apache License, Version 2.0 or MIT license at your option.
Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in this crate by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.  /3FKFKFVFVFKFK F7.) G GGtjG4FFFFFFFd -;< D7)T$V\U }| ̜LlCw4 (7q,g  qg  K$K  HandshakeSignatureValidGK ServerCertVerified`K ServerCertVerifiert U  pki_typesL3  tF CertificateErrorI DigitallySignedStructK TlsErrorDF TJ J SignatureScheme|S | - |t.jmLO.1$'4 ,oqdlJFC Creates a new verifier whose certificate validation is provided by=: WebPKI, using root certificates provided by the platform..&B 0| F MJ WebPKI, using root certificates provided by the platform and augmented by )& the provided extra root certificates. &.&B& <P& 7P&  V ~N ) &/0moL &řǙșəʙ˙G*R{9 .&B  <7)%/%dI06d/1'!!!!'$#%&'#&'%((EFGHIJKL E F  V ~NG H   V ~NI JDnsName IpAddress/+K LXUnixTime JNÜĜŜƜǜȜ_wKKKK yF3۔'B" (" #$( end_entityT( intermediatesl( server_name\) ocsp_responsel)now*-#$$$$#$''U#..MNOPQ M NX O  V ~NP QKKЉKschemeKsig (bÜĜŜƜǜȜ_wKKKK C'C݇'B" ." %$. <.$.dss/00RSTUV R SX T  V ~NU VƚB" 0" &$0 <0$112:2W WCCC#=C=SSSRSA_PKCS1_SHA1SSECDSA_SHA1_LegacySSRSA_PKCS1_SHA256SSECDSA_NISTP256_SHA256SSRSA_PKCS1_SHA384SSECDSA_NISTP384_SHA384SSRSA_PKCS1_SHA512TTECDSA_NISTP521_SHA512TTRSA_PSS_SHA256TTRSA_PSS_SHA384 TTRSA_PSS_SHA512 TTED25519 TTED448 TT ML_DSA_44 TT ML_DSA_65TT ML_DSA_87TTUnknownTUWI!B" 2" '$23/3 ''B (err3$  ̡lw[#+g+B]^_ ] ^ggg cg#cثq1ȡ_"B* * +$ # G|  `a `  V ~Na#B  - _end_entity\ V  SP Extension trait to help configure [`ClientConfig`]s with the platform verifier. // /!000v =: Configures the `ClientConfig` with the platform verifier. \  ```rust  use rustls::ClientConfig; 52 use rustls_platform_verifier::BuilderVerifierExt; (% let config = ClientConfig::builder() ! .with_platform_verifier() .unwrap() .with_no_client_auth();< ```ÜĜŜƜǜȜ_wKKKKKKٟ4DVVV!V!V!yC9bP'B// 0$F202uB11 2$ܱPM Extension trait to help build a [`ClientConfig`] with the platform verifier.333!444CYV Build a [`ClientConfig`] with the platform verifier and the default `CryptoProvider`.\Ǩۨ41 use rustls_platform_verifier::ConfigVerifierExt;85 let config = ClientConfig::with_platform_verifier();<ÜĜŜƜǜȜ_w'B33 4'646BB55 6LI A TLS certificate verifier that uses the system's root store and WebPKI.Dt|P 8 , 77z :g:zzBCD B Cggg cg#cثq1ȡD"B99 :zzDbgW8h<.(;;2`">g>M`P`XYZ X Yggg cg#cثq1ȡZ"B=$= >``Z`#l`#AA``[\ [ \B@%@ A` `z (( )) )T) )) . ./ /w 0 11 1 ;Ab  +  K(https://docs.rs/rustls-platform-verifiercrates.io downloadsCA constraints&rustls process-default crypto providerFhttps://docs.rs/rustls/latest/rustls/crypto/struct.CryptoProvider.html#as it is not yet available on Maven-https://github.com/rustls/rustls-native-certs openssl-probe-https://github.com/alexcrichton/openssl-probecrate documentationκV]https://docs.rs/rustls-platform-verifier/latest/rustls_platform_verifier/struct.Verifier.htmlֻrustls-native-certsɼ https://1password.com/1https://crates.io/crates/rustls-platform-verifierŽκVerifier::new_with_extra_rootsQhttps://docs.rs/rustls/latest/rustls/client/struct.ServerCertVerifierBuilder.htmlɼ  1Passwordcrates.io versionŽ&https://github.com/rustls/webpki-roots(https://support.apple.com/en-us/HT212865 7=https://github.com/rustls/rustls-platform-verifier/issues/115 webpki-rootsֻ/3 P ####!!!PQPPQ6Verifierinner<9 platform CA root certificates were ignored due to errors<&#Error loading CA root certificate: &.No CA certificates were loaded from the system.0Loaded % CA root certificates from the system0.rustls_platform_verifier::verification::others.EkuError|x䨅!0 kRI Zy1_a;(rh<hS'm1ZZz-|Pb65I~ vqVݺbѷ~'kF {DP*W7aܙ H#cUnj׮ .d ӇF漰(o䌣sV=y讴 ,UzxfЀ||il5e!'`Pj@7c;.He 'Bmt k >@XxN(DE ^v#\ *9KG rϞ(ɑ)NAלO.HQ46u6O'i`8_Z .O亙)dxt3[CVx, cV+_wXfnW X_Tİ"|y5?[!Ge~w6Lh2,!mx#Xz=`0=KN^HW;MVWJw9_;x;Y}%MS/;gS :㵇@Drit_ 6~҆*RX$2p_MFh]y Edz*72o<\Oi:\8KѪ Oe ؎V** Un<}-A/8j &L G7veu=va (H-kBn54KCWjw"%i3+e'P޲_*w}Eݪc|03:>DJPWwqw}ŀņŌŔśŢŦūůŵŹŽŹ/h8͛8uьҞ.5 Ӑ֪֏0J~1+Fܧ_=<$9     (]k4PͳP~G׽bH]/ܩ|'-06:AGMSsntz}ŃʼnŏŗŞŢũŭűŷŻſų *b2͖3qчҙ*1Ӌ֥֊+Ez.(Cu{܁܇܍ܔܛܢܩܷܾܰ$*18>*3>DJPYþqwņŌŔśūůŵŹŽzS h8͛8.ӔfCץJ1Fx~܄܊ܑܘܟܦܭܴܻ !'.5;BţƌȞ#9n̙m$`pҔx֘Z8r ڽ"5`św ȉ3bˍaZdҎp֒H2jڰ/Sŧ';r̝q(btҖ|֚#:v"&7dl6QʹRcI^0m7QʹRcI^0~W l<͟<jN4If w5 p f8vz{6{uz{{7|uz{{vu,fx+zhgפWü1A0- -:>BFJNRVZ^bfjnrvz~   < Y x   ! ( / ; ? F U Y ] d h l s y      ! ' - AFKP=%: |||||| | |||||{||F"UA*?2+6#%&'9!+'.) + #$0*  "&(, % '|x䨙3h(]|x䨼^ -F|x䨭0L'`"$crate::__private_api::format_args#-] fmt_internalsfmt_arguments_from_str|x=D5 $crate::__log   |xdsQH0 3|xeA_  |xU'-(q,} core_intrinsicsfmt_helpers_for_derivegg|xD$& -|xŻȲ$crate::__log_logger *ͧv |xLk[@XxN(".HeDE #/;gSEDrit_Hi:\8KQOe S<}-AU7veuY_wX2=va ZKN>䌣sV=yr0 DP*W!m;҆*RXJw"%^3+`||il"|y64|5;rW#r'NoMvzTi,O)I7>/H/XpD45!7OrQ5H a]gNiD 3%-iq$^mE)/hl O |}!S."<Y@&2.9@KR.S.%5>A.2G\V! 93r)-ev}_j/root/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-platform-verifier-0.7.0/src/../README.mdY/root/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-platform-verifier-0.7.0j/root/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-platform-verifier-0.7.0/src/../README.md Gr;Wkrw;TrcTO?`9khi[m^m wr#qE?73^ \UP.6Y!L152YF+ ]Yf}z  * ,4 2#-*("Ez;A @  $ ,+*(B"Ez<A : , - .'-,-03J".6 K" pI?#W2no  1 .'-,-030*2BGlE"8? LRiLID63nQC3ACWX\? }g JAPPG$4=?lW  .x86_64-unknown-linux-gnu zM9'ڷArustls_platform_verifier-9481411cb67ce396|x   ժ!b448 !BBB9B59B54AbBbbbBBBBBBA4BhBBB4Ah<