Function write_trusted_ca

nodedb/src/control/cluster/tls.rs:234–244

Write a PEM-encoded CA cert into `tls_dir/ca.d/ .crt`. Called by the production applier when a `CaTrustChange { add: ... }` entry commits.

(tls_dir: &Path, ca_der: &[u8])

/// Called by the production applier when a `CaTrustChange { add: ... }`
/// entry commits.
pub fn write_trusted_ca(tls_dir: &Path, ca_der: &[u8]) -> crate::Result<[u8; 32]> {
    let dir = tls_dir.join(CA_TRUST_DIR);
    fs::create_dir_all(&dir).map_err(|e| crate::Error::Config {
        detail: format!("create ca.d dir {}: {e}", dir.display()),
    })?;
    let cert = CertificateDer::from(ca_der.to_vec());
    let fp = nodedb_cluster::ca_fingerprint(&cert);
    let path = dir.join(format!("{}.crt", nodedb_cluster::ca_fingerprint_hex(&fp)));
    write_pem_cert(&path, ca_der)?;
    Ok(fp)
}

/// Delete the overlap-CA file identified by `fp` from `tls_dir/ca.d/`.
/// No-op (and returns `Ok(())`) when the file isn't present — applier