rustunnel/droid-wiki/systems/credential-generation.md

Credential generation

The credential generation module in src/generate.rs creates all the certificate and key material needed for a rustunnel session.

Purpose

Generate a self-signed CA, server certificate, client certificate, and a random auth token. Write them to disk in a specified output directory.

Key abstractions

Type/Function	File	Description
GeneratedMaterial	src/generate.rs	Struct holding all generated PEM strings and the auth token
generate	src/generate.rs	Generate material and write 8 files to an output directory
generate_material	src/generate.rs	Generate material without writing to disk
generate_ca	src/generate.rs	Create a self-signed CA with rcgen
generate_server_cert	src/generate.rs	Create a server cert signed by the CA
generate_client_cert	src/generate.rs	Create a client cert signed by the CA
generate_auth_token	src/generate.rs	Generate a 32-byte random hex token

Certificate details

• CA — CN from --ca-name, org "rustunnel", serial 1, constrained CA basic constraints
• Server cert — CN from --server-name, org "rustunnel", serial 2, SANs: localhost, rustunnel, 127.0.0.1, and optionally the bind IP if not 0.0.0.0 or ::
• Client cert — CN from --client-name, org "rustunnel", serial 3
• Auth token — 64 hex characters (32 random bytes)

Output files

File	Content
ca.pem	CA certificate (PEM)
ca.key	CA private key (PEM)
server.crt	Server certificate (PEM)
server.key	Server private key (PEM)
client.crt	Client certificate (PEM)
client.key	Client private key (PEM)
token.txt	Auth token (plain text)
config.json	Paths and default addresses (JSON)

Key source files

File	Purpose
src/generate.rs	Certificate generation, token generation, file writing