rustls · djc · Oct 1, 2025 · Oct 1, 2025
diff --git a/bogo/src/main.rs b/bogo/src/main.rs
@@ -29,7 +29,7 @@ use nix::sys::signal::{self, Signal};
 #[cfg(unix)]
 use nix::unistd::Pid;
 use rustls::client::danger::{
-    HandshakeSignatureValid, ServerIdentity, ServerVerified, ServerVerifier,
+    HandshakeSignatureValid, PeerVerified, ServerIdentity, ServerVerifier,
 };
 use rustls::client::{
     ClientConfig, ClientConnection, EchConfig, EchGreaseConfig, EchMode, EchStatus, Resumption,
@@ -44,9 +44,7 @@ use rustls::pki_types::pem::PemObject;
 use rustls::pki_types::{
     CertificateDer, EchConfigListBytes, PrivateKeyDer, ServerName, SubjectPublicKeyInfoDer,
 };
-use rustls::server::danger::{
-    ClientIdentity, ClientVerified, ClientVerifier, SignatureVerificationInput,
-};
+use rustls::server::danger::{ClientIdentity, ClientVerifier, SignatureVerificationInput};
 use rustls::server::{
     ClientHello, ProducesTickets, ServerConfig, ServerConnection, WebPkiClientVerifier,
 };
@@ -411,8 +409,8 @@ impl DummyClientAuth {
 }
 
 impl ClientVerifier for DummyClientAuth {
-    fn verify_identity(&self, _identity: &ClientIdentity<'_>) -> Result<ClientVerified, Error> {
-        Ok(ClientVerified::assertion())
+    fn verify_identity(&self, _identity: &ClientIdentity<'_>) -> Result<PeerVerified, Error> {
+        Ok(PeerVerified::assertion())
     }
 
     fn verify_tls12_signature(
@@ -469,11 +467,11 @@ impl DummyServerAuth {
 }
 
 impl ServerVerifier for DummyServerAuth {
-    fn verify_identity(&self, _identity: &ServerIdentity<'_>) -> Result<ServerVerified, Error> {
+    fn verify_identity(&self, _identity: &ServerIdentity<'_>) -> Result<PeerVerified, Error> {
         if let OcspValidation::Reject = self.ocsp {
             return Err(CertificateError::InvalidOcspResponse.into());
         }
-        Ok(ServerVerified::assertion())
+        Ok(PeerVerified::assertion())
     }
 
     fn verify_tls12_signature(

diff --git a/examples/src/bin/tlsclient-mio.rs b/examples/src/bin/tlsclient-mio.rs
@@ -409,8 +409,8 @@ mod danger {
         fn verify_identity(
             &self,
             _identity: &ServerIdentity<'_>,
-        ) -> Result<rustls::client::danger::ServerVerified, rustls::Error> {
-            Ok(rustls::client::danger::ServerVerified::assertion())
+        ) -> Result<rustls::client::danger::PeerVerified, rustls::Error> {
+            Ok(rustls::client::danger::PeerVerified::assertion())
         }
 
         fn verify_tls12_signature(

diff --git a/openssl-tests/src/raw_key_openssl_interop.rs b/openssl-tests/src/raw_key_openssl_interop.rs
@@ -11,7 +11,7 @@ mod client {
 
     use rustls::client::AlwaysResolvesClientRawPublicKeys;
     use rustls::client::danger::{
-        HandshakeSignatureValid, ServerIdentity, ServerVerified, ServerVerifier,
+        HandshakeSignatureValid, PeerVerified, ServerIdentity, ServerVerifier,
     };
     use rustls::crypto::{
         WebPkiSupportedAlgorithms, aws_lc_rs as provider, verify_tls13_signature,
@@ -97,14 +97,14 @@ mod client {
     }
 
     impl ServerVerifier for SimpleRpkServerVerifier {
-        fn verify_identity(&self, identity: &ServerIdentity<'_>) -> Result<ServerVerified, Error> {
+        fn verify_identity(&self, identity: &ServerIdentity<'_>) -> Result<PeerVerified, Error> {
             let PeerIdentity::RawPublicKey(spki) = identity.identity else {
                 return Err(ApiMisuse::UnverifiableCertificateType.into());
             };
 
             match self.trusted_spki.contains(spki) {
                 false => Err(Error::InvalidCertificate(CertificateError::UnknownIssuer)),
-                true => Ok(ServerVerified::assertion()),
+                true => Ok(PeerVerified::assertion()),
             }
         }
 
@@ -149,7 +149,7 @@ mod server {
     use rustls::pki_types::{CertificateDer, PrivateKeyDer, SubjectPublicKeyInfoDer};
     use rustls::server::AlwaysResolvesServerRawPublicKeys;
     use rustls::server::danger::{
-        ClientIdentity, ClientVerified, ClientVerifier, SignatureVerificationInput,
+        ClientIdentity, ClientVerifier, PeerVerified, SignatureVerificationInput,
     };
     use rustls::sign::CertifiedKey;
     use rustls::{
@@ -244,14 +244,14 @@ mod server {
     }
 
     impl ClientVerifier for SimpleRpkClientVerifier {
-        fn verify_identity(&self, identity: &ClientIdentity<'_>) -> Result<ClientVerified, Error> {
+        fn verify_identity(&self, identity: &ClientIdentity<'_>) -> Result<PeerVerified, Error> {
             let PeerIdentity::RawPublicKey(spki) = identity.identity else {
                 return Err(ApiMisuse::UnverifiableCertificateType.into());
             };
 
             match self.trusted_spki.contains(spki) {
                 false => Err(Error::InvalidCertificate(CertificateError::UnknownIssuer)),
-                true => Ok(ClientVerified::assertion()),
+                true => Ok(PeerVerified::assertion()),
             }
         }
 

diff --git a/rustls-test/src/lib.rs b/rustls-test/src/lib.rs
@@ -19,7 +19,7 @@ use std::io;
 use std::sync::{Arc, Mutex, OnceLock};
 
 use rustls::client::danger::{
-    HandshakeSignatureValid, ServerIdentity, ServerVerified, ServerVerifier,
+    HandshakeSignatureValid, PeerVerified, ServerIdentity, ServerVerifier,
 };
 use rustls::client::{
     AlwaysResolvesClientRawPublicKeys, ServerVerifierBuilder, UnbufferedClientConnection,
@@ -34,9 +34,7 @@ use rustls::pki_types::{
     CertificateDer, CertificateRevocationListDer, DnsName, PrivateKeyDer, PrivatePkcs8KeyDer,
     ServerName, SubjectPublicKeyInfoDer,
 };
-use rustls::server::danger::{
-    ClientIdentity, ClientVerified, ClientVerifier, SignatureVerificationInput,
-};
+use rustls::server::danger::{ClientIdentity, ClientVerifier, SignatureVerificationInput};
 use rustls::server::{
     AlwaysResolvesServerRawPublicKeys, ClientHello, ClientVerifierBuilder, ResolvesServerCert,
     UnbufferedServerConnection, WebPkiClientVerifier,
@@ -582,7 +580,7 @@ pub fn make_server_config_with_raw_key_support(
     provider: &CryptoProvider,
 ) -> ServerConfig {
     let mut client_verifier =
-        MockClientVerifier::new(|| Ok(ClientVerified::assertion()), kt, provider);
+        MockClientVerifier::new(|| Ok(PeerVerified::assertion()), kt, provider);
     let server_cert_resolver = Arc::new(AlwaysResolvesServerRawPublicKeys::new(
         kt.certified_key_with_raw_pub_key(provider)
             .unwrap(),
@@ -1112,14 +1110,14 @@ pub struct MockServerVerifier {
 }
 
 impl ServerVerifier for MockServerVerifier {
-    fn verify_identity(&self, identity: &ServerIdentity<'_>) -> Result<ServerVerified, Error> {
+    fn verify_identity(&self, identity: &ServerIdentity<'_>) -> Result<PeerVerified, Error> {
         println!("verify_identity({identity:?})");
         if let Some(expected_ocsp) = &self.expected_ocsp_response {
             assert_eq!(expected_ocsp, identity.ocsp_response);
         }
         match &self.cert_rejection_error {
             Some(error) => Err(error.clone()),
-            _ => Ok(ServerVerified::assertion()),
+            _ => Ok(PeerVerified::assertion()),
         }
     }
 
@@ -1242,7 +1240,7 @@ impl Default for MockServerVerifier {
 
 #[derive(Debug)]
 pub struct MockClientVerifier {
-    pub verified: fn() -> Result<ClientVerified, Error>,
+    pub verified: fn() -> Result<PeerVerified, Error>,
     pub subjects: Arc<[DistinguishedName]>,
     pub mandatory: bool,
     pub offered_schemes: Option<Vec<SignatureScheme>>,
@@ -1253,7 +1251,7 @@ pub struct MockClientVerifier {
 
 impl MockClientVerifier {
     pub fn new(
-        verified: fn() -> Result<ClientVerified, Error>,
+        verified: fn() -> Result<PeerVerified, Error>,
         kt: KeyType,
         provider: &CryptoProvider,
     ) -> Self {
@@ -1272,7 +1270,7 @@ impl MockClientVerifier {
 }
 
 impl ClientVerifier for MockClientVerifier {
-    fn verify_identity(&self, _identity: &ClientIdentity<'_>) -> Result<ClientVerified, Error> {
+    fn verify_identity(&self, _identity: &ClientIdentity<'_>) -> Result<PeerVerified, Error> {
         (self.verified)()
     }
 

diff --git a/rustls/src/client/handy.rs b/rustls/src/client/handy.rs
@@ -246,7 +246,7 @@ mod tests {
 
     use super::NoClientSessionStorage;
     use super::provider::cipher_suite;
-    use crate::client::danger::{HandshakeSignatureValid, ServerVerified, ServerVerifier};
+    use crate::client::danger::{HandshakeSignatureValid, PeerVerified, ServerVerifier};
     use crate::client::{ClientSessionStore, ResolvesClientCert};
     use crate::msgs::base::PayloadU16;
     use crate::msgs::enums::NamedGroup;
@@ -321,7 +321,7 @@ mod tests {
 
     impl ServerVerifier for DummyServerVerifier {
         #[cfg_attr(coverage_nightly, coverage(off))]
-        fn verify_identity(&self, _identity: &ServerIdentity<'_>) -> Result<ServerVerified, Error> {
+        fn verify_identity(&self, _identity: &ServerIdentity<'_>) -> Result<PeerVerified, Error> {
             unreachable!()
         }
 

diff --git a/rustls/src/client/test.rs b/rustls/src/client/test.rs
@@ -41,7 +41,7 @@ mod tests {
     use crate::sign::CertifiedKey;
     use crate::tls13::key_schedule::{derive_traffic_iv, derive_traffic_key};
     use crate::verify::{
-        HandshakeSignatureValid, ServerIdentity, ServerVerified, ServerVerifier,
+        HandshakeSignatureValid, PeerVerified, ServerIdentity, ServerVerifier,
         SignatureVerificationInput,
     };
     use crate::{DigitallySignedStruct, DistinguishedName, KeyLog};
@@ -308,8 +308,8 @@ mod tests {
     }
 
     impl ServerVerifier for ExpectSha1EcdsaVerifier {
-        fn verify_identity(&self, _identity: &ServerIdentity<'_>) -> Result<ServerVerified, Error> {
-            Ok(ServerVerified::assertion())
+        fn verify_identity(&self, _identity: &ServerIdentity<'_>) -> Result<PeerVerified, Error> {
+            Ok(PeerVerified::assertion())
         }
 
         fn verify_tls12_signature(
@@ -499,7 +499,7 @@ mod tests {
         }
 
         #[cfg_attr(coverage_nightly, coverage(off))]
-        fn verify_identity(&self, _identity: &ServerIdentity<'_>) -> Result<ServerVerified, Error> {
+        fn verify_identity(&self, _identity: &ServerIdentity<'_>) -> Result<PeerVerified, Error> {
             unreachable!()
         }
 
@@ -533,7 +533,7 @@ mod tests {
 
     impl ServerVerifier for ServerVerifierRequiringRpk {
         #[cfg_attr(coverage_nightly, coverage(off))]
-        fn verify_identity(&self, _identity: &ServerIdentity<'_>) -> Result<ServerVerified, Error> {
+        fn verify_identity(&self, _identity: &ServerIdentity<'_>) -> Result<PeerVerified, Error> {
             todo!()
         }
 

diff --git a/rustls/src/client/tls12.rs b/rustls/src/client/tls12.rs
@@ -184,7 +184,7 @@ mod server_hello {
                     // proof of possession in the prior session.
                     cx.common.peer_identity = Some(resuming.peer_identity().clone());
                     cx.common.handshake_kind = Some(HandshakeKind::Resumed);
-                    let cert_verified = verify::ServerVerified::assertion();
+                    let cert_verified = verify::PeerVerified::assertion();
                     let sig_verified = verify::HandshakeSignatureValid::assertion();
 
                     return if must_issue_new_ticket {
@@ -1087,7 +1087,7 @@ struct ExpectNewTicket {
     using_ems: bool,
     transcript: HandshakeHash,
     resuming: bool,
-    cert_verified: verify::ServerVerified,
+    cert_verified: verify::PeerVerified,
     sig_verified: verify::HandshakeSignatureValid,
 }
 
@@ -1139,7 +1139,7 @@ struct ExpectCcs {
     transcript: HandshakeHash,
     ticket: Option<NewSessionTicketPayload>,
     resuming: bool,
-    cert_verified: verify::ServerVerified,
+    cert_verified: verify::PeerVerified,
     sig_verified: verify::HandshakeSignatureValid,
 }
 
@@ -1200,7 +1200,7 @@ struct ExpectFinished {
     ticket: Option<NewSessionTicketPayload>,
     secrets: ConnectionSecrets,
     resuming: bool,
-    cert_verified: verify::ServerVerified,
+    cert_verified: verify::PeerVerified,
     sig_verified: verify::HandshakeSignatureValid,
 }
 
@@ -1337,7 +1337,7 @@ impl State<ClientConnectionData> for ExpectFinished {
 struct ExpectTraffic {
     // only `Some` if `config.enable_secret_extraction` is true
     extracted_secrets: Option<Result<PartiallyExtractedSecrets, Error>>,
-    _cert_verified: verify::ServerVerified,
+    _cert_verified: verify::PeerVerified,
     _sig_verified: verify::HandshakeSignatureValid,
     _fin_verified: verify::FinishedMessageVerified,
 }

diff --git a/rustls/src/client/tls13.rs b/rustls/src/client/tls13.rs
@@ -599,7 +599,7 @@ impl State<ClientConnectionData> for ExpectEncryptedExtensions {
 
                 // We *don't* reverify the certificate chain here: resumption is a
                 // continuation of the previous session in terms of security policy.
-                let cert_verified = verify::ServerVerified::assertion();
+                let cert_verified = verify::PeerVerified::assertion();
                 let sig_verified = verify::HandshakeSignatureValid::assertion();
                 Ok(Box::new(ExpectFinished {
                     config: self.config,
@@ -1380,7 +1380,7 @@ struct ExpectFinished {
     transcript: HandshakeHash,
     key_schedule: KeyScheduleHandshake,
     client_auth: Option<ClientAuthDetails>,
-    cert_verified: verify::ServerVerified,
+    cert_verified: verify::PeerVerified,
     sig_verified: verify::HandshakeSignatureValid,
     ech_retry_configs: Option<Vec<EchConfigPayload>>,
 }
@@ -1533,7 +1533,7 @@ struct ExpectTraffic {
     suite: &'static Tls13CipherSuite,
     key_schedule: KeyScheduleTraffic,
     resumption: KeyScheduleResumption,
-    _cert_verified: verify::ServerVerified,
+    _cert_verified: verify::PeerVerified,
     _sig_verified: verify::HandshakeSignatureValid,
     _fin_verified: verify::FinishedMessageVerified,
 }

diff --git a/rustls/src/lib.rs b/rustls/src/lib.rs
@@ -582,7 +582,7 @@ pub mod client {
         pub use super::builder::danger::DangerousClientConfigBuilder;
         pub use super::client_conn::danger::DangerousClientConfig;
         pub use crate::verify::{
-            HandshakeSignatureValid, ServerIdentity, ServerVerified, ServerVerifier,
+            HandshakeSignatureValid, PeerVerified, ServerIdentity, ServerVerifier,
             SignatureVerificationInput,
         };
     }
@@ -634,7 +634,7 @@ pub mod server {
     /// Dangerous configuration that should be audited and used with extreme care.
     pub mod danger {
         pub use crate::verify::{
-            ClientIdentity, ClientVerified, ClientVerifier, SignatureVerificationInput,
+            ClientIdentity, ClientVerifier, PeerVerified, SignatureVerificationInput,
         };
     }