GNUTLS_CERTIFICATE_SET_OCSP_STATUS_REQUEST_FUNCTION2(3)

📦
version 3.8.13 · 7 versions
, in alpine 3.22, alpine 3.23, alpine 3.24, arch rolling, fedora 43, fedora 44, ubuntu stonking

✨ gnutls_certificate_set_ocsp_status_request_function2 💅

okay bestie, welcome to the gnutls manual, specifically the page for gnutls_certificate_set_ocsp_status_request_function2 — yes that's a whole mouthful, yes it's iconic, and yes we're gonna get through it together 🫶

🌸 NAME 🌸

gnutls_certificate_set_ocsp_status_request_function2 — literally just an API function, no cap

🎀 SYNOPSIS 🎀

#include <gnutls/gnutls.h>

int
gnutls_certificate_set_ocsp_status_request_function2(gnutls_certificate_credentials_t
sc, unsigned idx, gnutls_status_request_ocsp_func ocsp_func, void *
ptr);

💖 ARGUMENTS 💖

  • gnutls_certificate_credentials_t sc — bestie this is a gnutls_certificate_credentials_t type, that's the whole vibe
  • unsigned idx — a certificate index, the kind you get handed back by gnutls_certificate_set_key() and its little friend group
  • gnutls_status_request_ocsp_func ocsp_func — a function pointer to your OCSP status request callback 🦋
  • void * ptr — an opaque pointer that gets passed straight to the callback function, mysterious and mysterious-only

🌈 DESCRIPTION 🌈

So here's the tea: this function is for the server side, and what it does is register a callback that provides OCSP status requests matching the indexed certificate chain from the client. The callback gets invoked if the client supplied a status-request OCSP extension. slay.

The callback function prototype is, and I need you to read this carefully because it's giving main character:

typedef int (*gnutls_status_request_ocsp_func) (gnutls_session_t
session, void *ptr, gnutls_datum_t *ocsp_response);

So the callback fires whenever the client requests an OCSP certificate status. Now — and this part matters — the callback may return GNUTLS_E_NO_CERTIFICATE_STATUS if there's no recent OCSP response lying around. But if the callback returns GNUTLS_E_SUCCESS, then bestie it is expected to have the ocsp_response field set with a valid (DER-encoded) OCSP response. And that response has to be a value allocated using gnutls_malloc(), because the caller is gonna deinitialize it. that's the deal, no negotiation 💅

⭐ NOTE ⭐

The ability to set multiple OCSP responses per credential structure via the index idx was added in version 3.5.6. But — plot twist — to keep backwards compatibility, it requires you to use gnutls_certificate_set_flags() with the GNUTLS_CERTIFICATE_API_V2 flag, so that the set certificate functions return an index that this function can actually use. so don't skip that step, it's not optional 🙈

🔥 RETURNS 🔥

On success, GNUTLS_E_SUCCESS (0) is returned. Otherwise you get a negative error code, and honestly? mood.

💜 SINCE 💜

3.5.5

🌸 REPORTING BUGS 🌸

Found a bug? Tell the people, don't just suffer in silence:

Copyright © 2001-2023 Free Software Foundation, Inc., and others.

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved.

🧚 SEE ALSO 🧚

The full documentation for gnutls is maintained as a Texinfo manual. If the /usr/share/doc/gnutls/ directory does not contain the HTML form, visit

https://www.gnutls.org/manual/

and that's the whole page, bestie 💖 this one's from gnutls 3.8.13, copyright dance spanning 2001-2023 by the Free Software Foundation, Inc., and others — go forth, register that OCSP callback, and stay iconic ✨🎀🦋

📦 where this page comes from