OCSP_REQUEST_ADD1_NONCE(3)

💖 NAME 💖

okay so this is OCSP_REQUEST_ADD1_NONCE(3), from the Library Functions Manual, and it's all about the OCSP nonce functions: OCSP_request_add1_nonce, OCSP_basic_add1_nonce, OCSP_check_nonce, and OCSP_copy_nonce. bestie, we're in libcrypto land and these are the little guys that handle nonce vibes for OCSP requests and responses ✨

🦋 SYNOPSIS 🦋

library “libcrypto” #include <openssl/ocsp.h>

int
OCSP_request_add1_nonce(OCSP_REQUEST *req, unsigned char *val, int len);

int
OCSP_basic_add1_nonce(OCSP_BASICRESP *resp, unsigned char *val,
    int len);

int
OCSP_check_nonce(OCSP_REQUEST *req, OCSP_BASICRESP *resp);

int
OCSP_copy_nonce(OCSP_BASICRESP *resp, OCSP_REQUEST *req);

🌸 DESCRIPTION 🌸

so an OCSP nonce is typically added to an OCSP request to thwart replay attacks — the whole slay is checking that the same nonce value appears in the response. no cap, that's the point 💅

• OCSP_request_add1_nonce() adds a nonce of value val and length len to OCSP request req. if val is NULL, a random nonce is used. if len is zero or negative, a default length will be used (currently 16 bytes). for most purposes the nonce value in a request is set to a random value, so the val parameter in OCSP_request_add1_nonce() is usually NULL 🎀
• OCSP_basic_add1_nonce() is identical to OCSP_request_add1_nonce() except it adds a nonce to OCSP basic response resp 🦋
• OCSP_check_nonce() compares the nonce value in req and resp 👀
• OCSP_copy_nonce() copies any nonce value present in req to resp 🫶

some responders may include a nonce in all responses even if one is not supplied. lowkey convenient, highkey notable.

some responders cache OCSP responses and do not sign each response for performance reasons. as a result, they do not support nonces. that's just how it is, bestie 😭

💀 RETURN VALUES 💀

• OCSP_request_add1_nonce() and OCSP_basic_add1_nonce() return 1 for success or 0 for failure ✨
• OCSP_copy_nonce() returns 1 if a nonce was successfully copied, 2 if no nonce was present in req, or 0 if an error occurred 🧚
• OCSP_check_nonce() returns positive values for success: 1 if nonces are present and equal, 2 if both nonces are absent, or 3 if a nonce is present in the response only. a zero return value indicates that both nonces are present but mismatch: this should be treated as an error condition. a return value of -1 indicates that a nonce is present in the request only: this will happen if the responder doesn't support nonces 🚨

🌈 SEE ALSO 🌈

• OCSP_cert_to_id(3)
• OCSP_REQUEST_new(3)
• OCSP_resp_find_status(3)
• OCSP_response_status(3)
• OCSP_sendreq_new(3)

👑 HISTORY 👑

these functions first appeared in OpenSSL 0.9.7 and have been available since OpenBSD 3.2. iconic behavior, honestly 💜

xoxo, your Debian bestie — Debian, June 8, 2025 edition 💅🎀