gnutls_ocsp_resp_verify(3)

💖 gnutls_ocsp_resp_verify(3) 💖

okay bestie, welcome to the gnutls manual page for gnutls_ocsp_resp_verify, and yes it's literally the gnutls section 3 girlies' club, come sit with us 🫶

---

✨ NAME ✨

gnutls_ocsp_resp_verify — it's an API function, and it's giving "trust nobody, verify everybody" 💅

---

🌸 SYNOPSIS 🌸

#include <gnutls/ocsp.h>

int gnutls_ocsp_resp_verify(gnutls_ocsp_resp_const_t resp,
gnutls_x509_trust_list_t trustlist, unsigned int * verify, unsigned int
flags);

---

🎀 ARGUMENTS 🎀

• gnutls_ocsp_resp_const_t resp — bestie this should contain a gnutls_ocsp_resp_t type. that's the whole vibe, no notes.
• gnutls_x509_trust_list_t trustlist — your trust anchors, as a gnutls_x509_trust_list_t type. the people you actually trust, the inner circle, the main characters 👑
• unsigned int * verify — an output variable holding the verification status, an gnutls_ocsp_verify_reason_t. she's an output, she tells you the tea after the fact 🍓
• unsigned int flags — verification flags from gnutls_certificate_verify_flags. for now? zero. that's it. that's the whole flag situation.

---

💜 DESCRIPTION 💜

So the assignment here is: verify the signature of the Basic OCSP Response against the public key in the certificate of a trusted signer. periodt. ✨

The trustlist should be populated with trust anchors. The function will extract the signer certificate from the Basic OCSP Response and will verify it against the trustlist. A trusted signer is a certificate that is either:

• in trustlist directly (iconic, no middleman), or
• signed directly by a certificate in trustlist and has the id-ad-ocspSigning Extended Key Usage bit set.

Both boxes gotta be ticked for that second one, bestie. it's giving strict.

The output verify variable will hold verification status codes (e.g., GNUTLS_OCSP_VERIFY_SIGNER_NOT_FOUND, GNUTLS_OCSP_VERIFY_INSECURE_ALGORITHM) which are only valid if the function returned GNUTLS_E_SUCCESS. so like, don't read her before you know she's valid, that's rude.

🚨 NOT ME HAVING TO SAY THIS BUT: the function returns GNUTLS_E_SUCCESS even when verification failed. The caller must always inspect the verify variable to find out the verification status. this is the plot twist of the whole page, do not skip it, i'm literally begging 😭

The flags variable should be 0 for now.

---

🌈 RETURNS 🌈

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value. slay or negative, there is no in-between 💀

---

🦋 REPORTING BUGS 🦋

Found a bug? Tell the girlies. Report bugs to <bugs@gnutls.org>.

Home page: https://www.gnutls.org

---

🧚 COPYRIGHT 🧚

Copyright © 2001-2023 Free Software Foundation, Inc., and others.

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved. (yes queen, that's the whole license, go off 🎀)

---

⭐ SEE ALSO ⭐

The full documentation for gnutls is maintained as a Texinfo manual. If the /usr/share/doc/gnutls/ directory does not contain the HTML form visit

https://www.gnutls.org/manual/

---

okay that's the whole page, no cap. this was gnutls_ocsp_resp_verify(3) from the gnutls manual, version 3.8.13 — mwah, thanks for reading bestie, go verify some responses responsibly 💖🌸✨🫶