Function validate_cert_key_match

crates/stdlib/src/ssl/cert.rs:1258–1278

Validate that a certificate and private key match This function checks that the public key in the certificate matches the provided private key. This is a basic sanity check to prevent configuration errors. # Arguments `certs` - Certificate chain (first certificate is the leaf) `private_key` - Private key to validate against # Errors Returns error if: - Certificate chain is empty - Public key ex

(
    certs: &[CertificateDer<'_>],
    private_key: &PrivateKeyDer<'_>,
)

/// Note: This is a simplified validation. Full validation would require
/// signing and verifying a test message, which is complex with rustls.
pub fn validate_cert_key_match(
    certs: &[CertificateDer<'_>],
    private_key: &PrivateKeyDer<'_>,
) -> Result<(), String> {
    if certs.is_empty() {
        return Err("Certificate chain is empty".to_string());
    }

    // For rustls, the actual validation happens when creating CertifiedKey
    // We can attempt to create a signing key to verify the key is valid
    use rustls::crypto::aws_lc_rs::sign::any_supported_type;

    match any_supported_type(private_key) {
        Ok(_signing_key) => {
            // If we can create a signing key, the private key is valid
            // Rustls will validate the cert-key match when building config
            Ok(())
        }
        Err(_) => Err("PEM lib".to_string()),
    }
}

/// StrictCertVerifier: wraps a ServerCertVerifier and adds RFC 5280 strict validation
///