- C-1: SelfSignedCert + generate_self_signed_cert document the
rcgen-default validity (1975→4096, never expires in practice), no
SANs (CA verification fails as designed — pairs with SHA256: pinning),
and the additive not_before/not_after route if tighter validity is
ever wanted
- C-4: RemoteIdentity::fingerprint + FingerprintPinVerifier document
case-/format-exactness (pins produced by fingerprint_from_cert_der,
lowercase hex, exact ed25519:/SHA256: prefixes); written from the
ADR-007-corrected chain — same-format-but-wrong pins fail closed at
the pin compare, cross-format mismatches fail earlier at cert-type
negotiation (the review's original pin-compare mechanism superseded)
- N-3: TlsServerConfig doc records the keep-non-Clone-for-v1 decision
(API identical across feature configurations; conditional Clone is
its own trap); N-3 closed in review 001
- N-4: "Client-cert-type negotiation" section on
VerifyPresentedCertVerifier (cross-referenced from
AcceptAnyCertVerifier): requires_raw_public_keys() stays trait-default
false on both server verifiers — do not fix to true (rejects X.509
clients); the raw-only-offer rejection can only arise from a foreign
resolver with only_raw_public_keys() == true — interop boundary of
the request-not-require shape, fail-closed, not a downgrade; pinned
by server_verifiers_keep_requires_raw_public_keys_default_false
- Work item 5: FingerprintPinVerifier's pop cross-ref now names both
server verifiers (default VerifyPresentedCertVerifier verifies per
ADR-008; AcceptAnyCertVerifier escape hatch does not)
Verification: cargo test (default, 69 lib tests) and --all-features
(78 lib tests, 1 new), clippy --all-targets --all-features -D warnings,
fmt --check, doc --no-deps warning-free — all green
glm-5.3-flash
7713a6e210