Question: Howto extract Peer Certificate

[JR-Otava]

Hi...
I need to check the peer certificate from a server.
I can't find an example, so this is how far I got..

use x509_parser::prelude::*;

#[tokio::main]
async fn main() -> Result<(), reqwest::Error> {
    let client = reqwest::Client::builder()
        .tls_info(true)
        .build()
        .expect("should be able to build reqwest client");

    let res = client.get("https://www.google.com")
        .send()
        .await?;
    println!("Status: {}", res.status());
    let ext = res.extensions();
    println!("Extensions:[{}] {:?}", ext.len(), ext);
    if let Some(val) = ext.get::<reqwest::tls::TlsInfo>()
    { 
        if let Some(peer_cert_der) = val.peer_certificate() {
            //println!("PeerCert: {:?}", peer_cert_der);
            //let cert_cont = reqwest::tls::native_tls::imp::Certificate::new(peer_cert_der)?;
            //let cert = reqwest::tls::Certificate::from_der(peer_cert_der)?;
            let cert = 
            match X509Certificate::from_der(peer_cert_der) {
                Ok((rem, cert)) => {
                    assert!(rem.is_empty());
                    assert_eq!(cert.version(), X509Version::V3);
                    println!("Cert: {:?}", cert.tbs_certificate.validity());
                    Some(cert.tbs_certificate)
                },
                _ => {
                     // panic!("x509 parsing failed: {:?}", res)
                     None
                },
            };
            println!("Cert: {:?}", cert);
            //cert.
        }
    }
    Ok(())
}

Is this the right way, or is there a better way ?

[seanmonstar]

Is there a problem in the code you posted? I don't see it immediately, but I'm also not sure where I should be looking.

[JR-Otava]

Hi...
Thanks for answering...
The code works, the question is is there a way to do it without an external package..
I could not find a way to use a function within Reqwest to get the cert...

let cert = reqwest::tls::Certificate::from_der(peer_cert_der)?;

Will create the cert, but I could not find a way to get cert, since all the method/members are pub(crate).

I love that you make the most flexible solution available.
But, it would be infinitely more convenient with
a call that returned Option<X509Certificate>...

I have the same kind of issue with Mocking responses.
I have to use the http package directly, and the package versions get in the way frequently.

Thanks for taking the time