Module cert_pinning 

Upstream TLS certificate pinning (DW-109, SEC-04).

When enabled, the gateway pins upstream TLS certificates by their SubjectPublicKeyInfo (SPKI) hash. During the TLS handshake, the verifier extracts the upstream cert’s SPKI, computes its SHA-256, and compares it against the configured pins. A mismatch rejects the connection (fail-closed: no fallback to CA-based verification).

Behind the cert_pinning cargo feature (default OFF). The config schema (Upstream.cert_pinning) is always present so configs round-trip without the feature; when the feature is off the block is accepted but inert (validation warns).

Config shape

upstreams:
  - name: api
    protocol: https
    cert_pinning:
      pins:
        - spki_sha256: "abcdef0123456789..."

Structs

CertPin

A certificate pin: the SHA-256 hash of the upstream certificate’s SubjectPublicKeyInfo (SPKI). The SPKI is the DER-encoded SubjectPublicKeyInfo structure from the X.509 certificate; pinning the SPKI (rather than the full certificate) allows rotation of the leaf certificate as long as the key pair is unchanged.

CertPinVerifier

The certificate pin verifier: holds the set of allowed SPKI hashes and checks a peer certificate against them. Built from the upstream’s cert_pinning config block at compile time. Implements rustls::client::danger::ServerCertVerifier so it can be installed via ClientConfig::builder().dangerous().with_custom_certificate_verifier(...).

Enums

CertPinError

Certificate pin verification error.

Functions

client_config_with_pinning

Build a rustls ClientConfig that uses the pin verifier instead of the normal CA-based verification. The verifier is fail-closed: only a cert whose SPKI matches a configured pin is accepted. There is no fallback to CA verification (pinning REPLACES CA trust, it does not augment it — a pinned upstream that rotates its key pair MUST update its pins).