Class TrustAnchorLoader

Namespace

MailFathom.Infrastructure.Certificates

Assembly

MailFathom.Infrastructure.dll

Turns deployment-provisioned material into a certificate usable as a trust anchor.

public sealed class TrustAnchorLoader

Inheritance

object

TrustAnchorLoader

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

This is the only place in MailFathom that knows about X.509, which is what keeps the scheme adapters material-agnostic: a future material kind arrives as another loader over the same resolved bytes rather than as a change to how a secret is retrieved.

Every anchor is imported with EphemeralKeySet. A trust anchor needs no private key, bundles commonly carry one anyway, and the default key-storage behavior would write that key into a key store on disk — outside the buffer whose lifetime the secret machinery controls. An anchor that turns out to carry a private key is rejected rather than silently accepted, because trusting an authority MailFathom could also impersonate is not what an operator configured.

Constructors

TrustAnchorLoader(ISecretReferenceResolver)

Initializes a new trust anchor loader.

Methods

LoadAsync(ConfiguredSecret?, CancellationToken)

Loads the certificate behind a configured secret block.