How to decode an X.509 certificate in Rust

1[dependencies]
2x509-parser = "=0.18.1"
3sha2 = "=0.11.1"
4hex = "=0.4.3"
5 

1use sha2::{Digest, Sha256};
2use x509_parser::der_parser::oid::Oid;
3use x509_parser::extensions::GeneralName;
4use x509_parser::objects::{oid_registry, oid2sn};
5use x509_parser::pem::Pem;
6 
7/// Short name of an OID ("ecdsa-with-SHA256"), or its dotted form when the registry does not know it.
8fn oid_name(oid: &Oid) -> String {
9    oid2sn(oid, oid_registry()).map(str::to_owned).unwrap_or_else(|_| oid.to_id_string())
10}
11 
12fn main() -> Result<(), Box<dyn std::error::Error>> {
13    let data = std::fs::read("chain.pem")?;
14    // every "BEGIN CERTIFICATE" block in the file, leaf first
15    for pem in Pem::iter_from_buffer(&data) {
16        let pem = pem?;
17        let cert = pem.parse_x509()?; // borrows pem.contents, the DER bytes
18 
19        println!("subject: {}", cert.subject());
20        println!("issuer: {}", cert.issuer());
21        println!("serial: {}", cert.raw_serial_as_string());
22        println!("valid: {} -> {}", cert.validity().not_before, cert.validity().not_after);
23        println!("signed with: {}", oid_name(&cert.signature_algorithm.algorithm));
24 
25        if let Some(san) = cert.subject_alternative_name()? {
26            for name in &san.value.general_names {
27                if let GeneralName::DNSName(dns) = name {
28                    println!("DNS name: {dns}");
29                }
30            }
31        }
32        let curve = cert.public_key().algorithm.parameters.as_ref().map(|p| p.as_oid()).transpose()?;
33        if let Some(curve) = curve {
34            println!("key: EC on {}", oid_name(&curve));
35        }
36        println!("SHA-256 fingerprint: {}", hex::encode(Sha256::digest(&pem.contents)));
37        println!("CA: {}, currently valid: {}", cert.is_ca(), cert.validity().is_valid());
38    }
39    Ok(())
40}
41