Support passing an async function to do X.509 signing

Also requires a validity function.

Author: andybalaam

CHANGELOG.md

@@ -1,3 +1,9 @@
+Changes in next release
+=======================
+## ✨ Features
+
+* Allow passing a signing function when setting up Rust crypto ([#5483](https://github.com/matrix-org/matrix-js-sdk/pull/5483)). Contributed by @andybalaam.
+
 Changes in [42.2.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v42.2.0) (2026-08-18)
 ==================================================================================================
 ## 🐛 Bug Fixes

spec/integ/crypto/rust-crypto.spec.ts

@@ -155,7 +155,7 @@ eXmIj7ZEOIsufPdiYuKDp/aUdgUHmuCGyegfoCJze36SdFX5q6z8Aq5nKPtz+FM=
 -----END CERTIFICATE-----
 `;
 
-    it("should pass on the caCertsPem if supplied", async () => {
+    it("should pass on the caCertsPem and sign function if supplied", async () => {
         // Given a Matrix client
         const matrixClient = createClient({
             baseUrl: "http://test.server",
@@ -165,8 +165,18 @@ eXmIj7ZEOIsufPdiYuKDp/aUdgUHmuCGyegfoCJze36SdFX5q6z8Aq5nKPtz+FM=
 
         const initFromStore = vi.spyOn(OlmMachine, "initFromStore");
 
+        const x509Signer = async (item: Uint8Array) => {
+            return {
+                signature_bytes: item,
+                certificate_chain: "MYCHAIN",
+                signature_scheme: "RsaPssSha512" as const,
+            };
+        };
+
+        const x509Validity = () => 12000.3;
+
         // When we init Rust crypto and pass a PEM for the CA certs
-        await matrixClient.initRustCrypto({ caCertsPem: CA_PEM });
+        await matrixClient.initRustCrypto({ caCertsPem: CA_PEM, x509Signer, x509Validity });
 
         // Then that PEM was passed in to the Olm machine
         expect(initFromStore).toHaveBeenCalledWith(
@@ -175,6 +185,8 @@ eXmIj7ZEOIsufPdiYuKDp/aUdgUHmuCGyegfoCJze36SdFX5q6z8Aq5nKPtz+FM=
             expect.anything(),
             expect.anything(),
             CA_PEM,
+            x509Signer,
+            x509Validity,
         );
     });
 

spec/unit/rust-crypto/rust-crypto.spec.ts

@@ -141,10 +141,12 @@ describe("initRustCrypto", () => {
             mockStore,
             logger,
             undefined,
+            undefined,
+            undefined,
         );
     });
 
-    it("passes through the store params (key) and CA certs", async () => {
+    it("passes through the store params (key), CA certs and sign function", async () => {
         const mockStore = { free: vi.fn() } as unknown as StoreHandle;
         vi.spyOn(StoreHandle, "openWithKey").mockResolvedValue(mockStore);
 
@@ -154,6 +156,16 @@ describe("initRustCrypto", () => {
         const storeKey = new Uint8Array(32);
         const logger = new DebugLogger(debug("matrix-js-sdk:test:initRustCrypto"));
         const caCertsPem = "MY_PEM etc...";
+        const x509Signer = async (item: Uint8Array) => {
+            return {
+                signature_bytes: item,
+                certificate_chain: "CHAIN",
+                signature_scheme: "RsaPssSha512" as const,
+            };
+        };
+        const x509Validity = () => {
+            return 10000;
+        };
 
         await initRustCrypto({
             logger,
@@ -165,6 +177,8 @@ describe("initRustCrypto", () => {
             storePrefix: "storePrefix",
             storeKey: storeKey,
             caCertsPem,
+            x509Signer,
+            x509Validity,
         });
 
         expect(StoreHandle.openWithKey).toHaveBeenCalledWith("storePrefix", storeKey, logger);
@@ -174,6 +188,8 @@ describe("initRustCrypto", () => {
             mockStore,
             logger,
             caCertsPem,
+            x509Signer,
+            x509Validity,
         );
     });
 
@@ -204,6 +220,8 @@ describe("initRustCrypto", () => {
             mockStore,
             logger,
             undefined,
+            undefined,
+            undefined,
         );
     });
 

src/client.ts

@@ -1980,7 +1980,14 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
      * @param args.caCertsPem - Optional PEM-formatted string that provides CA certificates. These will be used to check
      *    X.509 signatures on user identities. Any user identity that has a valid signature according to the supplied
      *    CAs will be considered verified, without any manual verification taking place.
-     *
+     *    NOTE: this is an unspecified extension to Matrix. Applications should exercise caution when using it.
+     * @param args.x509Signer - Optional async function for signing some data with an X.509 certificate. Used to sign
+     *    the user's identity so compatible clients will recognise this user as verified without manual verification
+     *    taking place. If you supply this you must also supply rawX509Validity.
+     *    NOTE: this is an unspecified extension to Matrix. Applications should exercise caution when using it.
+     * @param args.x509Validity - Optional function returning the validity period of the X.509 certificate used for
+     *    signing, as the number of milliseconds since the Unix epoch. If you supply this you must also supply
+     *    rawX509Signer.
      *    NOTE: this is an unspecified extension to Matrix. Applications should exercise caution when using it.
      *
      * @returns a Promise which will resolve when the crypto layer has been
@@ -1993,6 +2000,12 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
             storageKey?: Uint8Array;
             storagePassword?: string;
             caCertsPem?: string;
+            x509Signer?: (item: Uint8Array) => Promise<{
+                signature_bytes: Uint8Array;
+                certificate_chain: string;
+                signature_scheme: "RsaPssSha512";
+            }>;
+            x509Validity?: () => number;
         } = {},
     ): Promise<void> {
         if (this.cryptoBackend) {
@@ -2040,6 +2053,8 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
             enableEncryptedStateEvents: this.enableEncryptedStateEvents,
 
             caCertsPem: args.caCertsPem,
+            x509Signer: args.x509Signer,
+            x509Validity: args.x509Validity,
         });
 
         rustCrypto.setSupportedVerificationMethods(this.verificationMethods);

src/rust-crypto/index.ts

@@ -103,6 +103,25 @@ export interface InitRustCryptoArgs {
      * considered verified, without any manual verification taking place.
      */
     caCertsPem?: string;
+
+    /**
+     * Optional async function for signing some data with an X.509 certificate.
+     * Used to sign the user's identity so compatible clients will recognise
+     * this user as verified without manual verification taking place. If you
+     * supply this you must also supply rawX509Validity.
+     */
+    x509Signer?: (item: Uint8Array) => Promise<{
+        signature_bytes: Uint8Array;
+        certificate_chain: string;
+        signature_scheme: "RsaPssSha512";
+    }>;
+
+    /**
+     * Optional function returning the validity period of the X.509 certificate
+     * used for signing, as the number of milliseconds since the Unix epoch. If
+     * you supply this you must also supply rawX509Signer.
+     */
+    x509Validity?: () => number;
 }
 
 /**
@@ -158,6 +177,8 @@ async function initOlmMachine(
         legacyCryptoStore,
         enableEncryptedStateEvents,
         caCertsPem,
+        x509Signer,
+        x509Validity,
     }: InitRustCryptoArgs,
     storeHandle: StoreHandle,
 ): Promise<RustCrypto> {
@@ -169,6 +190,8 @@ async function initOlmMachine(
         storeHandle,
         logger,
         caCertsPem,
+        x509Signer,
+        x509Validity,
     );
 
     // A final migration step, now that we have an OlmMachine.