wire_e2e_identity/acquisition/
initial.rs

1use std::sync::Arc;
2
3use obfuscate::Obfuscated;
4use rusty_jwt_tools::prelude::Pem;
5
6use super::{CiphersuiteExt as _, X509CredentialAcquisition, X509CredentialConfiguration, states};
7use crate::{
8    error::{E2eIdentityError, E2eIdentityResult},
9    pki_env::PkiEnvironment,
10    utils::{generate_key, public_jwk_from_pem_keypair},
11};
12
13impl X509CredentialAcquisition<states::Initialized> {
14    /// Create the acquisition object.
15    ///
16    /// Generates the signing and ACME keypairs, but does not perform
17    /// any network I/O.
18    pub fn try_new(pki_env: Arc<PkiEnvironment>, config: X509CredentialConfiguration) -> E2eIdentityResult<Self> {
19        let sign_alg = config
20            .cipher_suite
21            .jws_algorithm()
22            .ok_or(E2eIdentityError::UnsupportedCipherSuite(config.cipher_suite))?;
23        let sign_kp = generate_key(sign_alg)?;
24        let acme_kp = generate_key(sign_alg)?;
25        let acme_jwk = public_jwk_from_pem_keypair(sign_alg, &acme_kp)?;
26
27        log::info!(
28            "created acquisition({:?}), cipher_suite = {:?}, acme_url = {}",
29            Obfuscated::from(&sign_kp),
30            config.cipher_suite,
31            config.acme_directory_url
32        );
33        Ok(Self {
34            pki_env,
35            config,
36            sign_alg,
37            sign_kp,
38            acme_kp,
39            acme_jwk,
40            data: states::Initialized,
41        })
42    }
43
44    /// Create the acquisition object using an existing sign keypair.
45    /// This API is temporary until our system decouples client identities from a client's public signature key.
46    /// See <https://wearezeta.atlassian.net/wiki/x/RABtrQ>.
47    //
48    // We're intentionally not factoring this into `try_new()`, so that this can be removed more cleanly.
49    pub fn try_new_from_pem(
50        pki_env: Arc<PkiEnvironment>,
51        config: X509CredentialConfiguration,
52        sign_kp: Pem,
53    ) -> E2eIdentityResult<Self> {
54        let sign_alg = config
55            .cipher_suite
56            .jws_algorithm()
57            .ok_or(E2eIdentityError::UnsupportedCipherSuite(config.cipher_suite))?;
58        let acme_kp = generate_key(sign_alg)?;
59        let acme_jwk = public_jwk_from_pem_keypair(sign_alg, &acme_kp)?;
60        log::info!(
61            "created acquisition from existing {:?}, cipher_suite = {:?}, acme_url = {}",
62            Obfuscated::from(&sign_kp),
63            config.cipher_suite,
64            config.acme_directory_url
65        );
66
67        Ok(Self {
68            pki_env,
69            config,
70            sign_alg,
71            sign_kp,
72            acme_kp,
73            acme_jwk,
74            data: states::Initialized,
75        })
76    }
77}
wire_e2e_identity/acquisition/initial.rs

wire_e2e_identity/acquisition/
initial.rs
