pub fn fingerprint(settings: &TlsSettings) -> Result<[u8; 32], TlsError>Expand description
Fingerprint the TLS material currently on disk.
Kubernetes Secret and projected volumes do not rewrite files in place —
they swap a ..data symlink — so mtime and inode are both unreliable across
a renewal. Hashing the bytes is what actually detects the change.
The client CA is included so mTLS trust is part of the reloadable surface, not just the server certificate.
§Arguments
settings- the resolved TLS settings naming the files to hash
§Returns
A SHA-256 digest over the certificate, key and (when configured) client CA.
§Errors
Returns TlsError::CertRead, TlsError::KeyRead or
TlsError::ClientCaRead if a file cannot be read. Callers polling for
changes should treat an error as “no change” and retry: a file is routinely
unreadable for a moment during a renewal.