x509-parser

x509-parser decodes X.509 v3 certificates, certificate signing requests, and certificate revocation lists from DER or PEM encoding into typed Rust structs that mirror the RFC 5280 data model directly, so fields like issuer, validity period, and extensions are accessed by walking the struct rather than through an opaque API. It’s built on the nom parser-combinator framework and part of the broader Rusticata network-protocol-parsing project, with a deliberate focus on security: recursion limits, defensive programming, fuzzing, and a goal of being panic-free, since certificate parsing routinely processes untrusted, adversarial input from TLS handshakes and other network protocols. Optional verify/verify-aws features add cryptographic signature verification via ring or aws-lc, and a validate feature adds structural validation beyond parsing.

What You Get

• X509Certificate::from_der() (via the FromDer trait) — the primary entry point for parsing a DER-encoded certificate into a fully typed struct
• X509CertificateParser for cases needing custom parsing options, such as skipping automatic extension-content parsing
• PEM support via the pem module for certificates encoded in the more common container format
• CertificateRevocationList::from_der() for parsing CRLs and iterating revoked certificate entries with their reason codes
• Optional verify/verify-aws features adding X509Certificate::verify_signature() for cryptographic signature verification (via ring or aws-lc), and a validate feature for structural validation

Common Use Cases

• Parsing and inspecting TLS certificate chains in a custom TLS stack, proxy, or network-traffic analysis tool
• Extracting certificate metadata (issuer, subject, validity dates, SANs) for certificate-transparency or inventory tooling
• Verifying certificate signatures and validating certificate structure in a security-sensitive Rust service
• Parsing CRLs to check revocation status and reason codes as part of a PKI validation pipeline

Under The Hood

Architecture - The crate is organized around parser modules matching the ASN.1 structure of an X.509 certificate: certificate.rs for the top-level X509Certificate/TbsCertificate, extensions/ for the many standard and custom certificate extensions, signature_algorithm.rs/signature_value.rs for algorithm identifiers and signatures, revocation_list.rs for CRLs, certification_request.rs for CSRs, and pem.rs for the PEM container format; all parsing is built on nom combinators and returns zero-copy references into the original byte buffer wherever possible, minimizing allocation. A visitor/ module provides a visitor-pattern trait (X509CertificateVisitor) for traversing parsed certificate structures. Tech Stack - Nearly 100% Rust (99.6%), depending on the nom/der-parser parser-combinator stack, asn1-rs for ASN.1 primitives, and optionally ring or aws-lc-rs for the verify/verify-aws features; MSRV is Rust 1.67.1, and the crate is part of the Rusticata organization’s broader family of network-protocol parsers. Code Quality - Security is treated as a first-class concern: the README explicitly calls out recursion-limit defenses, defensive programming against malformed input, a fuzzing harness (fuzz/ directory), and a goal of being panic-free — all critical properties for a parser that routinely handles adversarial, network-sourced input; CI runs on GitHub Actions, and the crate ships extensive tests/ and examples/ (including a print-cert.rs example) alongside real-world certificate fixtures in assets/. API Design - The parsed struct hierarchy mirrors RFC 5280 field-for-field, so anyone familiar with the X.509 spec can navigate the API directly (cert.tbs_certificate.issuer), while convenience methods like .issuer() shortcut the most common accesses; feature flags (verify, validate) keep the core parsing dependency-light while making stronger guarantees opt-in.