rustls-pki-types

rustls-pki-types is a small crate defining common types for representing X.509 certificates, private keys, DNS/server names, and other PKI primitives shared across the rustls ecosystem — rustls, rustls-webpki, rcgen, and others. Before this crate existed, each of those crates defined its own trivial DER-bytes wrapper, which created unnecessary, incompatible dependency edges between otherwise-related crates.

By centralizing these types with a long-term-stable API and zero required dependencies, downstream crates can interoperate without forcing consumers to convert between near-identical types. The crate deliberately does not implement Clone on private-key types to reduce accidental exposure of key material in memory, offering clone_key() or Rc/Arc wrapping instead, and supports no_std environments with optional alloc support.

What You Get

• Types for DER-encoded certificates, private keys, and certificate revocation lists shared across the rustls crate family
• PEM parsing/encoding support alongside the primary DER representation
• A ServerName type for representing and validating TLS server names (DNS names, IP addresses)
• no_std compatibility with an optional alloc feature, plus a web feature for WASM targets via web-time
• Security-conscious private key handling: no Clone impl on key types, with an explicit clone_key() method instead

Common Use Cases

• Passing certificates and private keys between rustls and companion crates (rustls-webpki, tokio-rustls, rcgen) without manual type conversion
• Building custom TLS tooling or certificate-management utilities that need to interoperate with the rustls ecosystem’s types
• Embedded or no_std Rust projects needing PKI types without pulling in a full TLS stack
• WASM-targeted applications needing certificate/name types via the web feature

Under The Hood

Architecture - The crate is organized around a handful of focused modules: server_name.rs defines ServerName and its DNS/IP-address validation logic, pem.rs and base64.rs handle PEM encoding/decoding on top of the DER primitives, alg_id.rs defines algorithm-identifier constants used in X.509 structures, and lib.rs ties together the core certificate/key newtypes. A src/data/ directory holds .der-format test fixtures used across the test suite. The design goal is explicitly interoperability: these types exist so rustls, rustls-webpki, and similar crates share one vocabulary instead of each defining incompatible DER wrappers.

Tech Stack - Pure Rust (100% of the repo), edition 2021, minimum Rust version 1.60 for broad compatibility, with zeroize as the only (optional, alloc-gated) dependency for securely wiping key material from memory, and web-time optionally pulled in for WASM targets via the web feature. Dual-licensed MIT OR Apache-2.0, matching the wider rustls project’s licensing.

Code Quality - Four dedicated test files (key_type.rs, server_name.rs, dns_name.rs, pem.rs) cover the crate’s core types, backed by real .der/key fixture data under tests/data and tests/keys. The repo lints with elided_lifetimes_in_paths = "warn" in Cargo.toml, and includes a deny.toml for cargo-deny dependency/license auditing plus a fuzz/ directory for fuzz testing PEM/DER parsing — an appropriate quality bar for a crate that parses untrusted certificate data.

API Design - Because this crate’s entire purpose is to be a stable, minimal dependency shared by many other crates, its API surface is intentionally small and conservative — new breaking changes are rare given how many downstream crates (rustls, webpki, rcgen) would need to co-release. The choice to omit Clone from private key types and instead require an explicit clone_key() call is a deliberate ergonomic trade-off that nudges callers toward Rc/Arc sharing rather than silently duplicating sensitive key material.