33 releases

new 0.103.1 Mar 25, 2025
0.102.8 Sep 9, 2024
0.102.6 Jul 22, 2024
0.102.2 Feb 2, 2024
0.100.1 Mar 28, 2023

#51 in Cryptography

Download history 2813408/week @ 2024-12-06 2556811/week @ 2024-12-13 1279589/week @ 2024-12-20 1274579/week @ 2024-12-27 2385069/week @ 2025-01-03 2893501/week @ 2025-01-10 2616304/week @ 2025-01-17 2765177/week @ 2025-01-24 2999540/week @ 2025-01-31 3158104/week @ 2025-02-07 3065782/week @ 2025-02-14 3556490/week @ 2025-02-21 3767441/week @ 2025-02-28 3832350/week @ 2025-03-07 3867138/week @ 2025-03-14 3917575/week @ 2025-03-21

16,040,723 downloads per month
Used in 5,773 crates (75 directly)

ISC license

1MB
6K SLoC

Build Status Coverage Status (codecov.io) Documentation Chat

webpki is a library that validates Web PKI (TLS/SSL) certificates. It's used by Rustls to handle certificate-related tasks required for implementing TLS clients and servers.

webpki is written in Rust and uses ring for cryptographic operations and low-level parsing.

This is a fork of the original webpki project which adds a number of features required by the rustls project. This fork is released as the rustls-webpki crate, with versions starting 0.100.0 so as to not confusingly overlap with webpki versions.

Features

  • Representing trust anchors - webpki requires the caller to bootstrap trust by explicitly specifying a set of trust anchors using the TrustAnchor type.

  • Parsing certificates - webpki can convert from the raw encoded form of a certificate into something that can be used for making trust decisions.

  • Path building - webpki can determine if a certificate for an end entity like a website or client identity was issued by a trust anchor, or a series of intermediate certificates the trust anchor has endorsed.

  • Name/usage validation - webpki can determine if a certificate is valid for a given DNS name or IP address by considering the allowed usage of the certificate and additional constraints.

Limitations

webpki offers a minimal feature set tailored to the needs of Rustls. Notably it does not offer:

  • Support for self-signed certificates
  • Certificate or keypair generation
  • Access to arbitrary certificate extensions
  • Parsing/representation of certificate subjects, or human-friendly display of these fields

For these tasks you may prefer using webpki in combination with libraries like x509-parser and rcgen.

Changelog

Release history can be found on GitHub.

Demo

See https://github.com/rustls/rustls#example-code for an example of using webpki.

License

See LICENSE. This project happily accepts pull requests without any formal copyright/contributor license agreement.

Bug Reporting

Please refer to the SECURITY policy for security issues. All other bugs should be reported as GitHub issues.

Dependencies

~0.1–23MB
~512K SLoC