OCSP_SENDREQ_NEW(3ossl)

📦
version 15.1 · 3 versions
, in freebsd 15.1

💅 OCSP_SENDREQ_NEW 💅

okay bestie, so this is the 3ossl manual page for the OCSP responder query functions — and yes, the header literally lists a whole friend group: OCSP_REQ_CTX, OCSP_sendreq_new, OCSP_sendreq_nbio, OCSP_sendreq_bio, OCSP_REQ_CTX_i2d, OCSP_REQ_CTX_add1_header, OCSP_REQ_CTX_free, OCSP_set_max_response_length, and OCSP_REQ_CTX_set1_req. They all do OCSP responder query stuff. 🎀

✨ SYNOPSIS ✨

#include <openssl/ocsp.h>

OSSL_HTTP_REQ_CTX *OCSP_sendreq_new(BIO *io, const char *path,
                                    const OCSP_REQUEST *req, int buf_size);
OCSP_RESPONSE *OCSP_sendreq_bio(BIO *io, const char *path, OCSP_REQUEST *req);

ok so the following ones are deprecated since OpenSSL 3.0 (iykyk, we'll get there), and you can hide them entirely by defining OPENSSL_API_COMPAT with a suitable version value — peep openssl_user_macros(7):

typedef OSSL_HTTP_REQ_CTX OCSP_REQ_CTX;
int OCSP_sendreq_nbio(OCSP_RESPONSE **presp, OSSL_HTTP_REQ_CTX *rctx);
int OCSP_REQ_CTX_i2d(OCSP_REQ_CT *rctx, const ASN1_ITEM *it, ASN1_VALUE *req);
int OCSP_REQ_CTX_add1_header(OCSP_REQ_CT *rctx,
                             const char *name, const char *value);
void OCSP_REQ_CTX_free(OCSP_REQ_CTX *rctx);
void OCSP_set_max_response_length(OCSP_REQ_CT *rctx, unsigned long len);
int OCSP_REQ_CTX_set1_req(OCSP_REQ_CTX *rctx, const OCSP_REQUEST *req);

🦋 DESCRIPTION 🦋

These functions do an OCSP POST request / response transfer over HTTP, using the HTTP request functions described over in OSSL_HTTP_REQ_CTX(3). Slay, HTTP.

🌸 OCSP_sendreq_new()

Builds a complete OSSL_HTTP_REQ_CTX structure with:

  • the BIO io — what you're using for requests and the response,
  • the URL path path,
  • optionally the OCSP request req,
  • and a response header maximum line length of buf_size.

If buf_size is zero, a default value of 4KiB is used. 🫶 And req can be set to NULL and provided later using OCSP_REQ_CTX_set1_req() or OSSL_HTTP_REQ_CTX_set1_req(3) — no pressure, bestie.

The io and path arguments correspond to the components of the URL. For example, if the responder URL is "http://example.com/ocspreq", the BIO io should have been connected to host "example.com" on port 80 and path should be set to "/ocspreq". Literally just splitting the URL at home. 💅

🌈 OCSP_sendreq_nbio()

Attempts to send the request prepared in rctx and to gather the response via HTTP, using the BIO io and path that were given when calling OCSP_sendreq_new(). If the operation gets completed, it assigns the response — a pointer to a OCSP_RESPONSE structure — in *presp. 🎀

Heads up: you may need to call it again if its result is -1, which indicates BIO_should_retry(3). In that case it's advisable to sleep a little in between, using BIO_wait(3) on the read BIO to prevent a busy loop. (No cap, don't spin your CPU like a feral hamster. 💀)

🧚 OCSP_sendreq_bio()

Combines OCSP_sendreq_new() with as many calls of OCSP_sendreq_nbio() as needed and then OCSP_REQ_CTX_free(), with a response header maximum line length 4k. It waits indefinitely on a response. 😭

It does not support setting a timeout or adding headers, and is retained for compatibility; use OSSL_HTTP_transfer(3) instead. It's giving legacy, ngl.

⭐ The equivalences

OCSP_REQ_CTX_i2d(rctx, it, req) is equivalent to the following:

OSSL_HTTP_REQ_CTX_set1_req(rctx, "application/ocsp-request", it, req)

OCSP_REQ_CTX_set1_req(rctx, req) is equivalent to the following:

OSSL_HTTP_REQ_CTX_set1_req(rctx, "application/ocsp-request",
                           ASN1_ITEM_rptr(OCSP_REQUEST),
                           (const ASN1_VALUE *)req)

🍓 The deprecated girlies

The deprecated type and the remaining deprecated functions have been superseded by the following equivalents, periodt:

🔥 RETURN VALUES 🔥

  • OCSP_sendreq_new() — returns a valid OSSL_HTTP_REQ_CTX structure or NULL if an error occurred. 👑
  • OCSP_sendreq_nbio() — returns 1 for success, 0 on error, -1 if retry is needed. The classic trio, fr fr.
  • OCSP_sendreq_bio() — returns the OCSP_RESPONSE structure sent by the responder or NULL if an error occurred.

👀 SEE ALSO 👀

OSSL_HTTP_REQ_CTX(3), OSSL_HTTP_transfer(3), OCSP_cert_to_id(3), OCSP_request_add1_nonce(3), OCSP_REQUEST_new(3), OCSP_resp_find_status(3), OCSP_response_status(3)

🕰️ HISTORY 🕰️

OCSP_REQ_CTX, OCSP_REQ_CTX_i2d(), OCSP_REQ_CTX_add1_header(), OCSP_REQ_CTX_free(), OCSP_set_max_response_length(), and OCSP_REQ_CTX_set1_req() were deprecated in OpenSSL 3.0. They were so iconic in their day, but everyone's moved on. 💜

Copyright 2015-2022 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

ok that's the whole page bestie, go forth and OCSP 🫶✨ this iconic lil drop is from OpenSSL 3.5.6, dated 2026-04-07 — mwah, bye! 💅🎀🦋

📦 where this page comes from