OCSP_REQUEST_NEW(3)

📦 version 4.4.0, in alpine 3.24, arch rolling

🎀 NAME 💅

okay so this page is all about the OCSP_REQUEST fam, in the libcrypto library (that's the manual we're in, bestie — Library Functions Manual, yes ma'am ✨). The whole squad:

OCSP_REQUEST_new, OCSP_REQUEST_free, OCSP_SIGNATURE_new, OCSP_SIGNATURE_free, OCSP_REQINFO_new, OCSP_REQINFO_free, OCSP_ONEREQ_new, OCSP_ONEREQ_free, OCSP_request_add0_id, OCSP_request_sign, OCSP_request_add1_cert, OCSP_request_onereq_count, OCSP_request_onereq_get0 — literally all the OCSP request functions, together, iconic behavior 💖

✨ SYNOPSIS 🌸

like, first you gotta pull in the library and the header:

library “libcrypto” #include <openssl/ocsp.h>

then the whole cast 🫶

OCSP_REQUEST *
OCSP_REQUEST_new(void);

void
OCSP_REQUEST_free(OCSP_REQUEST *req);

OCSP_SIGNATURE *
OCSP_SIGNATURE_new(void);

void
OCSP_SIGNATURE_free(OCSP_SIGNATURE *signature);

OCSP_REQINFO *
OCSP_REQINFO_new(void);

void
OCSP_REQINFO_free(OCSP_REQINFO *reqinfo);

OCSP_ONEREQ *
OCSP_ONEREQ_new(void);

void
OCSP_ONEREQ_free(OCSP_ONEREQ *onereq);

OCSP_ONEREQ *
OCSP_request_add0_id(OCSP_REQUEST *req, OCSP_CERTID *cid);

int
OCSP_request_sign(OCSP_REQUEST *req, X509 *signer, EVP_PKEY *key,
    const EVP_MD *dgst, STACK_OF(X509) *certs, unsigned long flags);

int
OCSP_request_add1_cert(OCSP_REQUEST *req, X509 *cert);

int
OCSP_request_onereq_count(OCSP_REQUEST *req);

OCSP_ONEREQ *
OCSP_request_onereq_get0(OCSP_REQUEST *req, int i);

🦋 DESCRIPTION 💜

OCSP_REQUEST_new() allocates and initializes an empty OCSP_REQUEST object — and what even is that? it's the ASN.1 OCSPRequest structure from RFC 6960, periodt. OCSP_REQUEST_free() frees req. bye bestie 👋

OCSP_SIGNATURE_new() allocates and initializes an empty OCSP_SIGNATURE object, which represents an ASN.1 Signature structure from RFC 6960. And like, this one is used inside OCSP_REQUEST, so it's giving inner-circle energy. OCSP_SIGNATURE_free() frees signature.

OCSP_REQINFO_new() allocates and initializes an empty OCSP_REQINFO object — that's the ASN.1 TBSRequest structure per RFC 6960, and it also lives inside OCSP_REQUEST. What does it do tho? it asks about the validity of one or more certificates. little overachiever 🧚 OCSP_REQINFO_free() frees reqinfo.

OCSP_ONEREQ_new() allocates and initializes an empty OCSP_ONEREQ object, representing an ASN.1 Request structure from RFC 6960. These cuties live inside OCSP_REQINFO, and each one asks about the validity of a single certificate — one job, one certificate, very focused 💅 OCSP_ONEREQ_free() frees onereq.

OCSP_request_add0_id() adds certificate ID cid to req. It returns the OCSP_ONEREQ object it just added, so your app can tack on extra extensions to the request. and like — major heads up — the cid parameter must not be freed up after the operation. don't do it. not me catching you doing it 🙈

OCSP_request_sign() signs the OCSP request req using certificate signer, private key key, digest dgst, and additional certificates certs. And if the flags option OCSP_NOCERTS is set, then no certificates will be included in the request. so clean ✨

OCSP_request_add1_cert() adds certificate cert to request req. The application is responsible for freeing up cert after use — that's on you, bestie, own it 🫶

OCSP_request_onereq_count() returns the total number of OCSP_ONEREQ objects in req. counting queen 👑

OCSP_request_onereq_get0() returns an internal pointer to the OCSP_ONEREQ contained in req at index i. The index i runs from 0 to OCSP_request_onereq_count(req) - 1 — so like, do the math correctly or it's not gonna slay 💀

fr fr: OCSP_request_onereq_count() and OCSP_request_onereq_get0() are mainly used by OCSP responders. that's their whole thing, iykyk.

🌈 RETURN VALUES ⭐

okay so what comes back:

  • OCSP_REQUEST_new(), OCSP_SIGNATURE_new(), OCSP_REQINFO_new(), and OCSP_ONEREQ_new() return an empty OCSP_REQUEST, OCSP_SIGNATURE, OCSP_REQINFO, or OCSP_ONEREQ object, respectively — or NULL if an error occurred. sad girl hours 😭
  • OCSP_request_add0_id() returns the OCSP_ONEREQ object containing cid, or NULL if an error occurred.
  • OCSP_request_sign() and OCSP_request_add1_cert() return 1 for success or 0 for failure. simple as that 💖
  • OCSP_request_onereq_count() returns the total number of OCSP_ONEREQ objects in req.
  • OCSP_request_onereq_get0() returns a pointer to an OCSP_ONEREQ object, or NULL if the index value is out of range. (told you the index mattered 🎯)

🍓 EXAMPLES 🌸

okay bestie, let's actually create an OCSP_REQUEST object for certificate cert with issuer issuer — watch and learn:

OCSP_REQUEST *req;
OCSP_ID *cid;

req = OCSP_REQUEST_new();
if (req == NULL)
        /* error */
cid = OCSP_cert_to_id(EVP_sha1(), cert, issuer);
if (cid == NULL)
        /* error */

if (OCSP_REQUEST_add0_id(req, cid) == NULL)
        /* error */

 /* Do something with req, e.g. query responder */

OCSP_REQUEST_free(req);

see how the error comments are just /* error */? that's your cue to handle it, not ignore it 💀

🔥 SEE ALSO 👑

the whole friend group, go say hi: ACCESS_DESCRIPTION_new(3), crypto(3), d2i_OCSP_REQUEST(3), d2i_OCSP_RESPONSE(3), EVP_DigestInit(3), OCSP_cert_to_id(3), OCSP_CRLID_new(3), OCSP_request_add1_nonce(3), OCSP_resp_find_status(3), OCSP_response_status(3), OCSP_sendreq_new(3), OCSP_SERVICELOC_new(3), X509_ocspid_print(3) — collect them all ✨

🌟 STANDARDS 🎀

RFC 6960: X.509 Internet Public Key Infrastructure Online Certificate Status Protocol, section 4.1: Request Syntax. cite your sources, always 💅

💜 HISTORY 🦋

These functions first appeared in OpenSSL 0.9.7 and have been available since OpenBSD 3.2. veterans of the game, honestly 👑

and that's the page, bestie! 🫶 this Debian build of the manual is dated June 8, 2025 — so go forth, sign those requests, and don't free that cid 😘
📦 where this page comes from