Provide the ability to specify the header x5c

src/crypto/tpm.rs

@@ -47,7 +47,33 @@ where
             KeyAlgorithm::Rsa2048 => header.alg = JwaAlg::RS256,
         }
 
-        header.kid = Some(self.kid.clone());
+        // Only set the kid if we don't have an x509 cert for the x5c
+        match self.id_key {
+            IdentityKey::SoftEcdsa256 {
+                pkey: _,
+                x509: Some(x509),
+            }
+            | IdentityKey::SoftRsa2048 {
+                pkey: _,
+                x509: Some(x509),
+            } => {
+                header.x5c = Some(vec![general_purpose::STANDARD.encode(
+                    match x509.to_der() {
+                        Ok(der) => der,
+                        Err(ossl_err) => {
+                            error!(?ossl_err);
+                            return Err(JwtError::OpenSSLError);
+                        }
+                    },
+                )])
+            }
+            _ => {
+                // Only set the kid if it wasn't set previously with JwsBuilder.set_x5c()
+                if let None = header.x5c {
+                    header.kid = Some(self.kid.clone());
+                }
+            }
+        }
 
         // if were were asked to ember the jwk, do so now.
         /*

src/jws.rs

@@ -52,6 +52,16 @@ impl JwsBuilder {
         self
     }
 
+    /// Set the chain of certificates
+    pub fn set_x5c(mut self, x5c: Option<Vec<Vec<u8>>>) -> Self {
+        self.header.x5c = x5c.map(|v| {
+            v.into_iter()
+                .map(|c| general_purpose::STANDARD.encode(c))
+                .collect()
+        });
+        self
+    }
+
     /// Finalise this builder
     pub fn build(self) -> Jws {
         let JwsBuilder { header, payload } = self;