Class TlsServerCertificateLoader

Namespace

MailFathom.Infrastructure.Certificates

Assembly

MailFathom.Infrastructure.dll

Turns deployment-provisioned material into the TLS identity an endpoint presents, or into a named refusal.

public sealed class TlsServerCertificateLoader

Inheritance

object

TlsServerCertificateLoader

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

This is the server-identity counterpart of TrustAnchorLoader and shares its rules: X.509 knowledge stays here rather than spreading into the scheme adapters, material is erased as soon as it has been parsed, and an unusable configuration produces a named failure rather than an exception.

Every private key is imported with EphemeralKeySet, so provisioning a certificate never leaves a copy of its key in an operating-system key store. That is the one place where this loader inverts the trust-anchor rule: an anchor carrying a private key is rejected, while a server identity without one is, because a server that cannot sign the handshake cannot prove it is the domain it claims.

Constructors

TlsServerCertificateLoader(ISecretReferenceResolver, TimeProvider)

Initializes a new server certificate loader.

Methods

LoadAsync(TlsServerCertificateOptions?, string, CancellationToken)

Loads and validates the identity an endpoint presents for one domain.