ctz / rustls / 433

96%

push

travis-ci

Introduce ResolvesServerCertUsingSNI

This does server-side certificate switching based on SNI.
SNI is mandatory when using it (but a default could be added
if that's useful).

ResolvesServerCertUsingSNI checks certificates against their names
as it is configured.  This means mismatches are handled before the
server is running.

This change removes handshake-time SNI cross-checking from the
core library -- instead you should use ResolvesServerCertUsingSNI
or call sign::CertifiedKey::cross_check_end_entity_cert in your
own resolver if you want to fail at cert resolve time.

4056 of 6790 branches covered (59.73%)

21 of 21 new or added lines in 3 files covered. (100.0%)

5450 of 5869 relevant lines covered (92.86%)

6114.19 hits per line