RocksDB backend re-implementation

crates/utils/Cargo.toml

@@ -6,7 +6,7 @@ resolver = "2"
 
 [dependencies]
 rustls = { version = "0.21", features = ["tls12", "dangerous_configuration"]}
-rustls-pemfile = "1.0"
+rustls-pemfile = "2.0"
 tokio = { version = "1.23", features = ["net", "macros"] }
 tokio-rustls = { version = "0.24.0"}
 serde = { version = "1.0", features = ["derive"]}
@@ -25,7 +25,7 @@ dashmap = "5.4"
 ahash = { version = "0.8" }
 chrono = "0.4"
 rand = "0.8.5"
-webpki-roots = { version = "0.25.2"}
+webpki-roots = { version = "0.26"}
 
 [target.'cfg(unix)'.dependencies]
 privdrop = "0.5.3"

crates/utils/src/config/certificate.rs

@@ -57,15 +57,16 @@ impl Config {
             cert_id,
             "cert",
         ))?))
+        .collect::<Result<Vec<_>, _>>()
         .map_err(|err| {
             format!("Failed to read certificates in \"certificate.{cert_id}.cert\": {err}")
-        })?
-        .into_iter()
-        .map(Certificate)
-        .collect::<Vec<_>>();
+        })?;
 
         if !certs.is_empty() {
-            Ok(certs)
+            Ok(certs
+                .into_iter()
+                .map(|cert| Certificate(cert.as_ref().to_vec()))
+                .collect())
         } else {
             Err(format!(
                 "No certificates found in \"certificate.{cert_id}.cert\"."
@@ -85,7 +86,9 @@ impl Config {
         .into_iter()
         .next()
         {
-            Some(Item::PKCS8Key(key) | Item::RSAKey(key) | Item::ECKey(key)) => Ok(PrivateKey(key)),
+            Some(Item::Pkcs8Key(key)) => Ok(PrivateKey(key.secret_pkcs8_der().to_vec())),
+            Some(Item::Pkcs1Key(key)) => Ok(PrivateKey(key.secret_pkcs1_der().to_vec())),
+            Some(Item::Sec1Key(key)) => Ok(PrivateKey(key.secret_sec1_der().to_vec())),
             Some(_) => Err(format!(
                 "Unsupported private keys found in \"certificate.{cert_id}.private-key\".",
             )),

crates/utils/src/lib.rs

@@ -239,9 +239,9 @@ pub fn rustls_client_config(allow_invalid_certs: bool) -> ClientConfig {
 
         root_cert_store.add_trust_anchors(webpki_roots::TLS_SERVER_ROOTS.iter().map(|ta| {
             OwnedTrustAnchor::from_subject_spki_name_constraints(
-                ta.subject,
-                ta.spki,
-                ta.name_constraints,
+                ta.subject.as_ref(),
+                ta.subject_public_key_info.as_ref(),
+                ta.name_constraints.as_ref().map(|v| v.as_ref()),
             )
         }));
         config