rustls-pemfile

rustls-pemfile is a small, focused Rust crate for parsing .pem files containing cryptographic material — certificates, private keys, certificate signing requests, and revocation lists. It reads the base64-armored PEM sections and hands back their raw DER encodings without attempting to decode the DER itself, leaving that to callers such as rustls or rustls-pki-types.

The crate is maintained under the rustls organization and is a common companion to rustls-based TLS setups, used to load server certificates and private keys from disk before constructing a TLS configuration. As of 2.2.0 its core logic has been absorbed into rustls-pki-types, with this crate now acting as a stable, familiar API wrapper around that newer implementation.

What You Get

• Streaming (read_one) and bulk (read_all) PEM section parsing from any io::BufRead
• Convenience iterators for certificates, RSA/PKCS8/SEC1 private keys, CSRs, and CRLs
• A read_one_from_slice API for no-std environments working on in-memory buffers
• Zero unsafe code (#![forbid(unsafe_code)]) and no-std support via an opt-out std feature
• Direct interoperability with rustls-pki-types DER wrapper types

Common Use Cases

• Loading a server’s certificate chain and private key from disk to configure rustls
• Extracting a CSR or CRL from a PEM bundle in a certificate-management tool
• Parsing PEM content in embedded or no-std contexts where no file I/O is available
• Migrating legacy PEM-parsing code onto the newer rustls-pki-types PEM APIs

Under The Hood

Architecture - The crate is intentionally tiny: pemfile.rs implements the core line-oriented PEM section reader (read_one, read_all, read_one_from_slice) that scans for -----BEGIN ... -----/-----END ... ----- markers, base64-decodes the body, and classifies the section into an Item enum (X509Certificate, Pkcs1Key, Pkcs8Key, Sec1Key, Crl, Csr, SubjectPublicKeyInfo). lib.rs is a thin convenience layer on top, exposing certs(), private_key(), csr(), crls(), and per-key-type iterators that filter the general read_one stream down to one item kind.

Tech Stack - The only runtime dependency is rustls-pki-types, which supplies the DER-wrapper newtypes (CertificateDer, PrivateKeyDer, etc.) that this crate’s functions return; base64 decoding and DER handling as of 2.2.0 are delegated to that crate’s PEM implementation rather than a local base64 dependency, shrinking the dependency tree. The crate is #![no_std] by default with an opt-in std feature gating anything that needs io::BufRead, and forbids unsafe code entirely.

Code Quality - Despite its small size (~540 lines including tests), the crate has a dedicated tests.rs module plus an integration test target and a criterion-style bencher benchmark, and enables strict lint gates (missing_docs, unused_qualifications, trivial_casts) at the crate root, meaning every public item must be documented. Error handling is expressed via a small Error enum surfaced through io::Error, rather than panics.

API Design - The public surface is deliberately narrow and example-driven: the crate-level doc comment shows the exact iter::from_fn(|| read_one(&mut reader).transpose()) pattern used throughout the ecosystem, and convenience functions like certs()/private_key() cover the 90% use case without requiring callers to match on the Item enum themselves. The main friction point is that the crate is now positioned as a legacy-compatible shim over rustls-pki-types’s newer PEM APIs, so new adopters are nudged toward migrating away eventually.