Enum SigningKeyConfig 

pub enum SigningKeyConfig {
    File {
        path: PathBuf,
    },
    Pkcs11 {
        module: String,
        token_label: Option<String>,
        slot_id: Option<u64>,
        pin: Option<String>,
        pin_env: Option<String>,
        key_label: Option<String>,
        key_id: Option<String>,
    },
    Demo,
}

How to obtain the signing key for OCSP response production.

Variants

File

Load from a PKCS#8 PEM or DER file on disk.

Fields

path: PathBuf

Pkcs11

Sign via a PKCS#11 hardware security module.

Supported HSMs: Thales Luna, Entrust nShield, Utimaco CryptoServer, FutureX Vectera Plus, SoftHSM2 (testing).

Fields

module: String

Path to the vendor’s PKCS#11 shared library.

token_label: Option<String>

Find slot by token label (e.g., Luna partition name).

slot_id: Option<u64>

Explicit slot ID (alternative to token_label).

pin: Option<String>

Login PIN (plaintext — prefer pin_env for production).

pin_env: Option<String>

Environment variable containing the login PIN.

key_label: Option<String>

Find key by CKA_LABEL.

key_id: Option<String>

Find key by CKA_ID (hex-encoded).

Demo

Ephemeral demo key for testing only. Produces a warning on every use.

Trait Implementations

impl Clone for SigningKeyConfig

fn clone(&self) -> SigningKeyConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SigningKeyConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for SigningKeyConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.