OSSL_CMP_SRV_CTX_NEW(3ossl)

📦

version 15.1 · 2 versions

15.1 · freebsd 15.1 (latest)
14.5 · freebsd 14.5

💅 NAME 💅

okay so this page is literally the whole squad of generic functions you need to set up and control a CMP server — introducing, in no particular order because they're all main characters:

OSSL_CMP_SRV_process_request, OSSL_CMP_CTX_server_perform, OSSL_CMP_SRV_CTX_new, OSSL_CMP_SRV_CTX_free, OSSL_CMP_SRV_cert_request_cb_t, OSSL_CMP_SRV_rr_cb_t, OSSL_CMP_SRV_certConf_cb_t, OSSL_CMP_SRV_genm_cb_t, OSSL_CMP_SRV_error_cb_t, OSSL_CMP_SRV_pollReq_cb_t, OSSL_CMP_SRV_CTX_init, OSSL_CMP_SRV_delayed_delivery_cb_t, OSSL_CMP_SRV_clean_transaction_cb_t, OSSL_CMP_SRV_CTX_init_trans, OSSL_CMP_SRV_CTX_get0_cmp_ctx, OSSL_CMP_SRV_CTX_get0_custom_ctx, OSSL_CMP_SRV_CTX_set_send_unprotected_errors, OSSL_CMP_SRV_CTX_set_accept_unprotected, OSSL_CMP_SRV_CTX_set_accept_raverified, OSSL_CMP_SRV_CTX_set_grant_implicit_confirm

bestie, that's a lot of names, but they all live in the OpenSSL 3ossl manual section and they all pull in the same direction: getting a CMP server up and running. 🫶

✨ SYNOPSIS ✨

#include <openssl/cmp.h>

OSSL_CMP_MSG *OSSL_CMP_SRV_process_request(OSSL_CMP_SRV_CTX *srv_ctx,
                                           const OSSL_CMP_MSG *req);
OSSL_CMP_MSG *OSSL_CMP_CTX_server_perform(OSSL_CMP_CTX *client_ctx,
                                          const OSSL_CMP_MSG *req);
OSSL_CMP_SRV_CTX *OSSL_CMP_SRV_CTX_new(OSSL_LIB_CTX *libctx, const char *propq);
void OSSL_CMP_SRV_CTX_free(OSSL_CMP_SRV_CTX *srv_ctx);

typedef OSSL_CMP_PKISI *(*OSSL_CMP_SRV_cert_request_cb_t)(
                                                OSSL_CMP_SRV_CTX *srv_ctx,
                                                const OSSL_CMP_MSG *req,
                                                int certReqId,
                                                const OSSL_CRMF_MSG *crm,
                                                const X509_REQ *p10cr,
                                                X509 **certOut,
                                                STACK_OF(X509) **chainOut,
                                                STACK_OF(X509) **caPubs);
typedef OSSL_CMP_PKISI *(*OSSL_CMP_SRV_rr_cb_t)(OSSL_CMP_SRV_CTX *srv_ctx,
                                                const OSSL_CMP_MSG *req,
                                                const X509_NAME *issuer,
                                                const ASN1_INTEGER *serial);
typedef int (*OSSL_CMP_SRV_genm_cb_t)(OSSL_CMP_SRV_CTX *srv_ctx,
                                      const OSSL_CMP_MSG *req,
                                      STACK_OF(OSSL_CMP_ITAV) *in,
                                      STACK_OF(OSSL_CMP_ITAV) **out);
typedef void (*OSSL_CMP_SRV_error_cb_t)(OSSL_CMP_SRV_CTX *srv_ctx,
                                        const OSSL_CMP_MSG *req,
                                        const OSSL_CMP_PKISI *statusInfo,
                                        const ASN1_INTEGER *errorCode,
                                        const OSSL_CMP_PKIFREETEXT *errorDetails);
typedef int (*OSSL_CMP_SRV_certConf_cb_t)(OSSL_CMP_SRV_CTX *srv_ctx,
                                          const OSSL_CMP_MSG *req,
                                          int certReqId,
                                          const ASN1_OCTET_STRING *certHash,
                                          const OSSL_CMP_PKISI *si);
typedef int (*OSSL_CMP_SRV_pollReq_cb_t)(OSSL_CMP_SRV_CTX *srv_ctx,
                                         const OSSL_CMP_MSG *req,
                                         int certReqId,
                                         OSSL_CMP_MSG **certReq,
                                         int64_t *check_after);
int OSSL_CMP_SRV_CTX_init(OSSL_CMP_SRV_CTX *srv_ctx, void *custom_ctx,
                          OSSL_CMP_SRV_cert_request_cb_t process_cert_request,
                          OSSL_CMP_SRV_rr_cb_t process_rr,
                          OSSL_CMP_SRV_genm_cb_t process_genm,
                          OSSL_CMP_SRV_error_cb_t process_error,
                          OSSL_CMP_SRV_certConf_cb_t process_certConf,
                          OSSL_CMP_SRV_pollReq_cb_t process_pollReq);
typedef int (*OSSL_CMP_SRV_delayed_delivery_cb_t)(OSSL_CMP_SRV_CTX *srv_ctx,
                                                  const OSSL_CMP_MSG *req);
typedef int (*OSSL_CMP_SRV_clean_transaction_cb_t)(OSSL_CMP_SRV_CTX *srv_ctx,
                                                   const ASN1_OCTET_STRING *id);
int OSSL_CMP_SRV_CTX_init_trans(OSSL_CMP_SRV_CTX *srv_ctx,
                                OSSL_CMP_SRV_delayed_delivery_cb_t delay,
                                OSSL_CMP_SRV_clean_transaction_cb_t clean);

OSSL_CMP_CTX *OSSL_CMP_SRV_CTX_get0_cmp_ctx(const OSSL_CMP_SRV_CTX *srv_ctx);
void *OSSL_CMP_SRV_CTX_get0_custom_ctx(const OSSL_CMP_SRV_CTX *srv_ctx);

int OSSL_CMP_SRV_CTX_set_send_unprotected_errors(OSSL_CMP_SRV_CTX *srv_ctx,
                                                 int val);
int OSSL_CMP_SRV_CTX_set_accept_unprotected(OSSL_CMP_SRV_CTX *srv_ctx, int val);
int OSSL_CMP_SRV_CTX_set_accept_raverified(OSSL_CMP_SRV_CTX *srv_ctx, int val);
int OSSL_CMP_SRV_CTX_set_grant_implicit_confirm(OSSL_CMP_SRV_CTX *srv_ctx,
                                                int val);

🎀 DESCRIPTION 🎀

🌟 `OSSL_CMP_SRV_process_request()`

okay so this one is like, the actual server brain 🧠 — it implements the generic aspects of a CMP server. Its arguments are the OSSL_CMP_SRV_CTX srv_ctx and the CMP request message req.

It does the typical generic checks on req, calls the respective callback function (if present) for more specific processing, and then assembles a result message, which may be a CMP error message. no cap, it handles the whole flow for you.

and here's the little gotcha you gotta remember 👀: if after return of the function the expression

OSSL_CMP_CTX_get_status(OSSL_CMP_SRV_CTX_get0_cmp_ctx(srv_ctx))

yields -1 then the function has closed the current transaction — and that could be because of a normal successful end of the transaction, or because of an error. either way, transaction's over, periodt. 💀

🦋 `OSSL_CMP_CTX_server_perform()`

this is an interface to OSSL_CMP_SRV_process_request() that can be used by a CMP client in the same way as OSSL_CMP_MSG_http_perform(3). yes bestie, same energy, same usage pattern. ✨

in particular, the first parameter client_ctx is the OSSL_CMP_CTX of the client. and the OSSL_CMP_SRV_CTX must be set as transfer_cb_arg of client_ctx — don't forget that part, iykyk.

🌸 `OSSL_CMP_SRV_CTX_new()`

creates and initializes an OSSL_CMP_SRV_CTX structure associated with the library context libctx and property query string propq, both of which may be NULL to select the defaults. easy. 🎀

🧚 `OSSL_CMP_SRV_CTX_free()`

deletes the given srv_ctx. if the argument is NULL, nothing is done — no drama, no crash, we love a graceful no-op. 💜

🍓 `OSSL_CMP_SRV_CTX_init()`

sets in the given srv_ctx a custom server context pointer plus the callback functions that do the specific processing of:

CMP certificate requests
revocation requests
certificate confirmation requests
general messages
error messages
poll requests

All arguments except srv_ctx may be NULL. and if a callback for some message type is not given, that means the respective type of CMP message is not supported by the server — so like, read the room, don't send it. 🙈

🌈 `OSSL_CMP_SRV_CTX_init_trans()`

sets in srv_ctx the optional callback functions for initiating delayed delivery and cleaning up a transaction. let's break it down:

If the <delay> function is NULL then delivery of responses is never delayed. Otherwise delay takes a custom server context and a request message as input. It must return 1 if delivery of the respective response shall be delayed, 0 if not, and -1 on error.
If the <clean> function is NULL then no specific cleanup is performed. Otherwise clean takes a custom server context and a transaction ID pointer as input, where the pointer is NULL in case a new transaction is being started and otherwise provides the ID of the transaction being terminated. The <clean> function should reset the respective portions of the state and free related memory. It must return 1 on success and 0 on error.

basically one's for "hold up, send it later" and the other's for "okay we're done here, tidy up". iconic duo. 👑

💅 the getters

OSSL_CMP_SRV_CTX_get0_cmp_ctx() — returns the OSSL_CMP_CTX from the srv_ctx.
OSSL_CMP_SRV_CTX_get0_custom_ctx() — returns the custom server context from srv_ctx that has been set using OSSL_CMP_SRV_CTX_init().

⭐ the setters

OSSL_CMP_SRV_CTX_set_send_unprotected_errors() — enables sending error messages and other forms of negative responses unprotected.
OSSL_CMP_SRV_CTX_set_accept_unprotected() — enables acceptance of requests without protection of with invalid protection. (yes, that's literally how the original says it — "of with" — we're keeping it, it's part of the lore. 😭)
OSSL_CMP_SRV_CTX_set_accept_raverified() — enables acceptance of ir/cr/kur messages with POPO 'RAVerified'.
OSSL_CMP_SRV_CTX_set_grant_implicit_confirm() — enables granting implicit confirmation of newly enrolled certificates if requested.

🌺 NOTES 🌺

CMP is defined in RFC 9810 (and CRMF in RFC 4211). 📜

So far the CMP server implementation is limited to one request per CMP message (and consequently to at most one response component per CMP message). so like, one at a time bestie, we're not doing multitasking here. 🫶

🦋 RETURN VALUES 🦋

OSSL_CMP_SRV_CTX_new() returns a OSSL_CMP_SRV_CTX structure on success, NULL on error.
OSSL_CMP_SRV_CTX_free() does not return a value. (it's giving "no thoughts, just vibes" 💅)
OSSL_CMP_SRV_CTX_get0_cmp_ctx() returns a OSSL_CMP_CTX structure on success, NULL on error.
OSSL_CMP_SRV_CTX_get0_custom_ctx() returns the custom server context that has been set using OSSL_CMP_SRV_CTX_init().
All other functions return 1 on success, 0 on error. ⭐

🔥 HISTORY 🔥

The OpenSSL CMP support was added in OpenSSL 3.0.

OSSL_CMP_SRV_CTX_init_trans() supporting delayed delivery of all types of response messages was added in OpenSSL 3.3. ✨

💖 COPYRIGHT 💖

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, bestie!! 🎀 version 3.5.6, dated 2026-04-07, manual page OSSL_CMP_SRV_CTX_NEW(3ossl) — go forth and server responsibly. 👑💜

📦 where this page comes from

freebsd 15.1: base 15.1
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on 2026-11-04: a language model's rewrite of the original, under its terms