Method validate

gateway/src/kv/https_client.rs:298–321

(&self, cert_der: &[u8])

impl CertValidator for AppIdValidator {
    fn validate(&self, cert_der: &[u8]) -> Result<(), String> {
        use ra_tls::traits::CertExt;

        let (_, cert) = x509_parser::parse_x509_certificate(cert_der)
            .map_err(|e| format!("failed to parse certificate: {e}"))?;

        let peer_app_id = cert
            .get_app_id()
            .map_err(|e| format!("failed to get app_id: {e}"))?;

        let Some(peer_app_id) = peer_app_id else {
            return Err("peer certificate does not contain app_id".into());
        };

        if peer_app_id != self.expected_app_id {
            return Err(format!(
                "app_id mismatch: expected {}, got {}",
                hex::encode(&self.expected_app_id),
                hex::encode(&peer_app_id)
            ));
        }

        Ok(())
    }
}