pub(crate) fn peer_certificates(conn: &Connection) -> Vec<Vec<u8>>Expand description
Read a quinn connection’s peer certificate chain as DER, leaf first.
Shared with the WebTransport arm, which reaches the same
quinn::Connection through wtransport’s quic_connection(). One copy
because there is exactly one fragile step here and it should not exist
twice: Connection::peer_identity is Option<Box<dyn Any>>, since quinn is
generic over its crypto backend and has no type it could name for every
one. The rustls backend documents the concrete type as
Vec<rustls::pki_types::CertificateDer> and quinn-proto builds exactly
that, so the downcast is correct — and it is checked by nothing at compile
time, so a quinn release that changed the type would turn this into a
permanently empty chain rather than a build failure. That is what
tests/the_peer_certificate_chain_reaches_the_caller.rs is for: it asserts
the bytes handed back are the server’s own certificate, byte for byte, so
the silent version of that break cannot pass.
Bytes, and no opinion about them. Nothing here parses a certificate, checks a date, or decides whether a chain is trustworthy. A verdict depends on what the caller is measuring — a conformance probe grading a public relay wants “does this chain reach a public root”, an operator on a private CA wants the opposite — and a library that guessed would be wrong for one of them while looking authoritative to both. The rule that keeps this honest: the transport reports what the peer sent, the caller decides what it means.
Empty is not an error and is never reported as one. A chain is absent for
ordinary reasons — the handshake has not completed, the peer authenticated
by some other means, the session was resumed without one — and none of them
are faults this connection can do anything about. A caller that needs the
distinction between “no chain” and “a chain we could not read” is asking a
question the Any boundary above cannot answer anyway.
The returned Vec<Vec<u8>> owns its bytes rather than borrowing the
connection’s, which costs a copy per certificate and buys the thing callers
actually need: a chain that outlives the connection it came from. A probe
records the certificate and then closes the connection immediately, so a
borrowed chain would have to be interpreted before the peer is released —
exactly the ordering constraint this API exists to avoid imposing.