客户端证书与自定义校验

        if !config.verifier.offer_client_auth() {
            return Ok(false);
        }

        let cr = CertificateRequestPayloadTls13 {
            context: PayloadU8::empty(),
            extensions: CertificateRequestExtensions {
                signature_algorithms: Some(
                    config
                        .verifier
                        .supported_verify_schemes(),
                ),
                // ...
                authority_names: match config.verifier.root_hint_subjects() {
                    &[] => None,
                    authorities => Some(authorities.to_vec()),
                },
            },
        };

        let Some((end_entity, intermediates)) = client_cert.split_first() else {
            if !mandatory {
                debug!("client auth requested but no certificate supplied");
                self.transcript.abandon_client_auth();
                return Ok(Box::new(ExpectFinished {
                    // ...
                }));
            }

            return Err(cx.common.send_fatal_alert(
                AlertDescription::CertificateRequired,
                Error::NoCertificatesPresented,
            ));
        };

        let now = self.config.current_time()?;

        self.config
            .verifier
            .verify_client_cert(end_entity, intermediates, now)
            .map_err(|err| {
                cx.common
                    .send_cert_verify_error_alert(err)
            })?;

        Self {
            root_hint_subjects: roots.subjects(),
            roots,
            crls: Vec::new(),
            anon_policy: AnonymousClientPolicy::Deny,
            revocation_check_depth: RevocationCheckDepth::Chain,
            unknown_revocation_policy: UnknownStatusPolicy::Deny,
            revocation_expiration_policy: ExpirationPolicy::Ignore,
            supported_algs,
        }

== no client auth (baseline)
with_no_client_auth [server first flight 634 B, server sees client certs: None]: Ok

== mandatory client auth
  (client then sees: received fatal alert: CertificateRequired)
client sends no cert [server first flight 696 B, server sees client certs: None]: server error: peer sent no certificates
...
client sends alice [server first flight 695 B, server sees client certs: Some(2)]: Ok
  (client then sees: received fatal alert: UnknownCA)
client sends alice without intermediate [server first flight 696 B, server sees client certs: None]: server error: invalid peer certificate: UnknownIssuer
...
  (client then sees: received fatal alert: UnsupportedCertificate)
client cert with serverAuth EKU only [server first flight 695 B, server sees client certs: None]: server error: invalid peer certificate: certificate does not allow extended key usage for client authentication, allows server authentication
...

== optional client auth (allow_unauthenticated)
client sends no cert [server first flight 696 B, server sees client certs: None]: Ok
client sends alice [server first flight 696 B, server sees client certs: Some(2)]: Ok
  (client then sees: received fatal alert: UnknownCA)
client sends a cert from an unknown CA [server first flight 695 B, server sees client certs: None]: server error: invalid peer certificate: UnknownIssuer

root_hint_subjects: 119 names, 11341 bytes
webpki-roots as client roots [server first flight 12250 B, server sees client certs: Some(2)]: Ok
same, clear_root_hint_subjects [server first flight 664 B, server sees client certs: Some(2)]: Ok

        // If the policy only specifies checking EndEntity revocation state and we're looking at an
        // issuer certificate, return early without considering the certificate's revocation state.
        if let (RevocationCheckDepth::EndEntity, Role::Issuer) = (self.depth, path.role()) {
            return Ok(None);
        }

        let crl = self
            .crls
            .iter()
            .find(|candidate_crl| candidate_crl.authoritative(path));

        use UnknownStatusPolicy::*;
        let crl = match (crl, self.status_policy) {
            (Some(crl), _) => crl,
            // If the policy allows unknown, return Ok(None) to indicate that the certificate
            // was not confirmed as CertNotRevoked, but that this isn't an error condition.
            (None, Allow) => return Ok(None),
            // Otherwise, this is an error condition based on the provided policy.
            (None, _) => return Err(Error::UnknownRevocationStatus),
        };

        // Verify the CRL signature with the issuer SPKI.
        // ...
        crl.verify_signature(supported_sig_algs, issuer_spki, budget)
            .map_err(crl_signature_err)?;

        if self.expiration_policy == ExpirationPolicy::Enforce {
            crl.check_expiration(time)?;
        }

        // Verify that if the issuer has a KeyUsage bitstring it asserts cRLSign.
        KeyUsageMode::CrlSign.check(issuer_ku)?;

        // Try to find the cert serial in the verified CRL contents.
        let cert_serial = path.cert.serial.as_slice_less_safe();
        match crl.find_serial(cert_serial)? {
            None => Ok(Some(CertNotRevoked::assertion())),
            Some(_) => Err(Error::CertRevoked),
        }

root's CRL + intermediate's CRL listing alice [server first flight 695 B, server sees client certs: None]: server error: invalid peer certificate: Revoked
intermediate's CRL lists alice, only_check_end_entity_revocation [server first flight 696 B, server sees client certs: None]: server error: invalid peer certificate: Revoked
only intermediate's CRL (empty), default depth [server first flight 695 B, server sees client certs: None]: server error: invalid peer certificate: UnknownRevocationStatus
only intermediate's CRL (empty), only_check_end_entity_revocation [server first flight 695 B, server sees client certs: Some(2)]: Ok
root's CRL + intermediate's CRL (both empty) [server first flight 697 B, server sees client certs: Some(2)]: Ok
only intermediate's CRL, allow_unknown_revocation_status [server first flight 696 B, server sees client certs: Some(2)]: Ok
both CRLs, nextUpdate 2026-02-01, enforce_revocation_expiration [server first flight 696 B, server sees client certs: None]: server error: invalid peer certificate: certificate revocation list expired: verification time 1793295478 (UNIX), but CRL is not valid after 1769904000 (23391478 seconds ago)

== server presents an unrelated self-made certificate
NoVerifier: Ok
ChainOnlyNoop: Ok
  (server then sees: received fatal alert: UnknownCA)
default verifier: client error: invalid peer certificate: UnknownIssuer
...
== server presents the real certificate but signs with a different key
with_single_cert(real cert, other key): keys may not be consistent: KeyMismatch / InconsistentKeys(KeyMismatch)
NoVerifier: Ok
  (server then sees: received fatal alert: DecryptError)
ChainOnlyNoop: client error: invalid peer certificate: BadSignature
...

supported_verify_schemes() = []: server error: received corrupt message of type NoSignatureSchemes
supported_verify_schemes() = [ED25519] only, server key is P-256: server error: peer is incompatible: NoSignatureSchemesInCommon

  (client then sees: received fatal alert: UnknownCA)
intermediate's CRL lists alice [server first flight 695 B, server sees client certs: None]: server error: invalid peer certificate: UnknownRevocationStatus
    debug: InvalidCertificate(UnknownRevocationStatus)