webpki-ccadb: add V5 certificate records - #130
Open
elichai wants to merge 1 commit into
Open
Conversation
djc
reviewed
Aug 11, 2026
| // Returns an ordered BTreeMap of the root certificates, keyed by the SHA256 fingerprint of the | ||
| // certificate. Panics if there are any duplicate fingerprints. | ||
| pub async fn fetch_ccadb_roots() -> BTreeMap<String, CertificateMetadata> { | ||
| fn ccadb_client() -> reqwest::Client { |
Member
There was a problem hiding this comment.
Extracting this should be in a separate commit (or PR), and this function should be at the bottom of the module. If we're going to do this, I suggest we wrap the reqwest::Client in a newtype wrapper to avoid exposing reqwest in our public API.
Contributor
Author
There was a problem hiding this comment.
sure, just note that ccadb_client is a private function :) so reqwest is not publicly exposed
Member
There was a problem hiding this comment.
Ahh, fair, never mind about the wrapper then.
Comment on lines
+86
to
+89
| /// Fetches certificate records from the CCADB All Certificate Records V5 report. | ||
| /// | ||
| /// Records are returned in report order. The report can contain more than one record with the | ||
| /// same certificate fingerprint, so the result is not keyed by fingerprint. |
Member
There was a problem hiding this comment.
IIRC this CSV API is deprecated in favor of a new REST API? Worth checking whether that applies to this?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The first thing necessary in order to make
rustls-platform-verifieruse this crate in order to build a list of all CRLsThis uses https://www.ccadb.org/resources "All Certificate Information Reports" V5.
It cannot be merged with the existing endpoint as they return different things where the V5 endpoint can return "duplicate" certificate fingerprints(e.g. one for a root cert and one for an intermediate cert), e.g.:
The plan is to use this in
rustls-platform-verifiertests in order to keep an up-to-date CRL list.Based on: rustls/rustls-platform-verifier#221 (comment)
I will create a follow-up PR in
rustls-platform-verifierin the following days, showing how this is used