| 72 | |
| 73 | impl ServerCertVerifier for CustomCertVerifier { |
| 74 | fn verify_server_cert( |
| 75 | &self, |
| 76 | end_entity: &CertificateDer<'_>, |
| 77 | intermediates: &[CertificateDer<'_>], |
| 78 | server_name: &ServerName<'_>, |
| 79 | _ocsp_response: &[u8], |
| 80 | now: UnixTime, |
| 81 | ) -> Result<ServerCertVerified, rustls::Error> { |
| 82 | // First, do standard certificate verification |
| 83 | let verifier = rustls::client::WebPkiServerVerifier::builder(self.root_store.clone()) |
| 84 | .build() |
| 85 | .map_err(|e| rustls::Error::General(format!("failed to build verifier: {e}")))?; |
| 86 | |
| 87 | verifier.verify_server_cert(end_entity, intermediates, server_name, &[], now)?; |
| 88 | |
| 89 | // Then run custom validation |
| 90 | self.validator |
| 91 | .validate(end_entity.as_ref()) |
| 92 | .map_err(rustls::Error::General)?; |
| 93 | |
| 94 | Ok(ServerCertVerified::assertion()) |
| 95 | } |
| 96 | |
| 97 | fn verify_tls12_signature( |
| 98 | &self, |