OCSP_CRLID_NEW(3)

📦 version 4.4.0, in alpine 3.24, arch rolling

💅 OCSP_CRLID_NEW — okay bestie, let's talk about the OCSP CRL extension

So this page is OCSP_CRLID_NEW(3) and it's literally all about three little functions in libcrypto that deal with one specific ASN.1 structure. Ngl, it's niche. But it's also kind of iconic? Let's get into it. 🎀

🌸 NAME 🌸

OCSP_CRLID_new, OCSP_CRLID_free, OCSP_crlID_new — the OCSP CRL extension, periodt.

✨ SYNOPSIS ✨

You're gonna need libcrypto for this one, bestie. Here's the include:

#include <openssl/ocsp.h>

And here are the three function signatures, exactly as they are, no cap:

OCSP_CRLID *
OCSP_CRLID_new(void);

void
OCSP_CRLID_free(OCSP_CRLID *crlid);

X509_EXTENSION *
OCSP_crlID_new(const char *url, long *number, char *time);

🦋 DESCRIPTION 🦋

Okay so picture this: a client comes in and asks "hey, is this certificate still valid?" and it turns out the answer is no. 😭 The responder may optionally tell them which certificate revocation list the cert got found on. Optional! It's a nice-to-have, not a must.

The data that's required for that lives in an ASN.1 CrlID structure, tucked inside the singleExtensions field of the SingleResponse structure. And the CrlID itself is represented by an OCSP_CRLID object — which gets stored inside the OCSP_SINGLERESP object you can read about in OCSP_SINGLERESP_new(3). It's giving nested-structs-inception. 🫶

Now the functions themselves:

  • OCSP_CRLID_new() — allocates and initializes an empty OCSP_CRLID object. Fresh out of the box, zero notes.
  • OCSP_CRLID_free() — frees crlid. Say bye 👋, it's gone, that's the whole job.
  • OCSP_crlID_new() — the main character 💅. It takes the url at which the CRL is available, the CRL number, and/or the time at which the CRL was created. And here's the cute part: each argument can be NULL, and if it is, that respective field just gets omitted. Very "no thoughts, field not present." ✨

The resulting CrlID structure is encoded in ASN.1 using X509V3_EXT_i2d(3) with criticality 0. 👑

🎀 RETURN VALUES 🎀

  • OCSP_CRLID_new() returns a new OCSP_CRLID object, or NULL if an error occurred. 🙈
  • OCSP_crlID_new() returns a new X509_EXTENSION object, or NULL if an error occurred.

So like, always check for NULL, bestie. Always. 🔥

🌈 SEE ALSO 🌈

Go read these next, iykyk:

⭐ STANDARDS ⭐

RFC 6960: X.509 Internet Public Key Infrastructure Online Certificate Status Protocol, section 4.4.2: CRL References — that's the receipt, that's the source. 🧚

👑 HISTORY 👑

OCSP_CRLID_new(), OCSP_CRLID_free(), and OCSP_crlID_new() first appeared in OpenSSL 0.9.7 and have been available since OpenBSD 3.2. Ancient. Vintage. Lowkey legendary. 💜

💀 CAVEATS 💀

The function names OCSP_CRLID_new() and OCSP_crlID_new() only differ in case. Like, that's it. That's the difference. Yes, this is a trap, and yes, you will absolutely typo it at 3am. You've been warned. 🍓

Written by the Debian folks, dated June 8, 2025 — mwah, thanks for the docs, slay 💖✨

📦 where this page comes from