rcgen

rcgen is a Rust library for generating X.509 certificates, certificate signing requests (CSRs), and certificate revocation lists (CRLs) without shelling out to OpenSSL. It ships high-level helpers like generate_simple_self_signed for the common case of a self-signed certificate covering a set of subject alternative names, while also exposing lower-level Certificate, CertificateParams, KeyPair, and Issuer types for building certificate chains, custom extensions, and CA hierarchies.

Maintained under the rustls GitHub organization, rcgen is widely used as the certificate-generation backbone for local development tooling (mkcert-style workflows), test fixtures for TLS libraries, and QUIC/rustls-based servers that need to mint certificates on the fly. The workspace also includes rustls-cert-gen, a small CLI built on top of rcgen for generating certificates from the command line.

What You Get

• A one-line generate_simple_self_signed helper that produces a self-signed certificate for a list of subject alternative names, returning both the certificate and its signing key.
• Lower-level CertificateParams, Certificate, Issuer, and KeyPair types for constructing CA hierarchies, custom distinguished names, key usages, and extensions.
• Certificate signing request (CSR) generation and parsing via the csr module, plus certificate revocation list (CRL) generation via the crl module.
• Pluggable cryptography backends (ring or aws-lc-rs) selected via Cargo features, so consumers can match whichever crypto provider their project already depends on.
• A companion rustls-cert-gen CLI crate in the same workspace for generating certificates directly from the command line without writing Rust code.

Common Use Cases

• Generating a throwaway self-signed TLS certificate for local development servers, similar to mkcert.
• Minting test certificates and CA chains in the test suite of a TLS/QUIC library or application (as quinn and other rustls-ecosystem crates do).
• Building a lightweight internal CA that issues short-lived certificates for services or devices at runtime.
• Generating CSRs and CRLs programmatically as part of a certificate-management or PKI automation pipeline.

Under The Hood

Architecture: The crate centers on CertificateParams (subject alt names, distinguished name, key usages, extensions) which is combined with a KeyPair and, for non-self-signed certs, an Issuer to produce a signed Certificate (see src/certificate.rs, 1500+ lines). src/csr.rs and src/crl.rs implement the parallel CSR and CRL flows on the same underlying types, and src/sign_algo.rs abstracts over the supported signature algorithms so the rest of the crate doesn’t need to special-case RSA vs. ECDSA vs. Ed25519. src/ring_like.rs isolates the thin shim between the two supported crypto backends.

Tech Stack: Rust 2021 edition, MSRV policy targeting Rust releases roughly 7 months old (currently 1.88). Core dependencies are yasna (ASN.1/DER encoding), pem (PEM encoding), time (validity periods), x509-parser (parsing), and a choice of ring or aws-lc-rs for the actual cryptographic signing, selected via Cargo features so consumers aren’t forced onto a crypto backend they don’t already use elsewhere in their dependency tree.

Code Quality: The workspace includes a dedicated verify-tests crate whose job is to round-trip rcgen’s output through OpenSSL, x509-parser, and other independent implementations to catch encoding bugs that unit tests alone might miss; individual modules also carry inline #[test] coverage. codecov.yml indicates CI-tracked coverage, and the crate has a strong track record as a dependency of security-sensitive projects (rustls, quinn) that would surface regressions quickly.

API Design: The generate_simple_self_signed(names) -> CertifiedKey { cert, signing_key } entry point covers the common case in a single call and is prominently demonstrated in the README, while CertificateParams/Issuer give escape hatches for CA chains and custom extensions without requiring a different crate. PEM/DER output methods are attached directly to the returned types (cert.pem(), signing_key.serialize_pem()), minimizing the boilerplate needed to get a usable certificate.