$ show rustls/rcgen
rcgen is a Rust library for X.509 certificate generation, part of the rustls ecosystem. It provides a programmatic API to create self-signed certificates, CA-signed certificates, certificate signing requests (CSRs), and certificate revocation lists (CRLs) with full RFC 5280 compliance. The library supports multiple cryptographic backends (ring, aws-lc-rs), a wide range of signature algorithms (ECDSA, Ed25519, RSA, ML-DSA), and extensible extension handling. It is architected around traits like `SigningKey` and `PublicKeyData` for key abstraction, and uses `yasna` for DER encoding and `pki-types` for standard PKI types. The repository also includes a CLI tool `rustls-cert-gen` for quick certificate generation, and a verification test suite that validates generated certificates against OpenSSL, Botan, and webpki. The codebase demonstrates strong adherence to RFCs, careful error handling, and modular design.
The LLM identified 3 files worth highlighting for reuse:
Defines ASN.1 string types (PrintableString, Ia5String, TeletexString, BmpString, UniversalString) with strict validation rules per RFC 5280. Each type implements TryFrom, Display, PartialEq, and other traits, making them easily reusable in any project needing compliant ASN.1 string handling. The implementation handles UTF-8 to UTF-16/UTF-32 conversions and validates character sets without external dependencies.
Implements the full X.509v3 extension framework using a trait-based design (StaticExtension, Extension). Provides implementations for SubjectAlternativeName, KeyUsage, ExtendedKeyUsage, NameConstraints, SubjectKeyIdentifier, AuthorityKeyIdentifier, and CRLDistributionPoints. Each extension handles its own OID, criticality, and DER encoding. The design allows easy addition of new extensions by implementing the Extension trait. The CRL distribution points and issuing distribution point handling are particularly well-crafted.
Defines all supported signature algorithms as static constants (e.g., RSA_PKCS1_SHA256, ECDSA_P256_SHA256, ED25519) with associated OIDs and parameters. Each algorithm specifies its signing mechanism, algorithm identifier encoding, and public key algorithm OIDs. The module provides an iterator and OID lookup function, making it easy to extend with new algorithms. This is a clean pattern for defining algorithm registries in cryptographic libraries.