OCSP_RESPONSE_STATUS(3)

💅 NAME 💅

ok so bestie, this page is the whole OCSP_RESPONSE friend group, and honestly they're icons. We're talking OCSP_RESPONSE_new, OCSP_RESPONSE_free, OCSP_RESPBYTES_new, OCSP_RESPBYTES_free, OCSP_BASICRESP_new, OCSP_BASICRESP_free, OCSP_RESPDATA_new, OCSP_RESPDATA_free, OCSP_RESPID_new, OCSP_RESPID_free, OCSP_response_create, OCSP_response_status, OCSP_response_status_str, OCSP_response_get1_basic, and OCSP_basic_sign — collectively known as the OCSP response functions, aka the OCSP_RESPONSE_STATUS(3) manual page you're literally reading rn. 🦋

---

✨ SYNOPSIS ✨

library “libcrypto”

#include <openssl/ocsp.h>

OCSP_RESPONSE *
OCSP_RESPONSE_new(void);

void
OCSP_RESPONSE_free(OCSP_RESPONSE *resp);

OCSP_RESPBYTES *
OCSP_RESPBYTES_new(void);

void
OCSP_RESPBYTES_free(OCSP_RESPBYTES *respbytes);

OCSP_BASICRESP *
OCSP_BASICRESP_new(void);

void
OCSP_BASICRESP_free(OCSP_BASICRESP *bs);

OCSP_RESPDATA *
OCSP_RESPDATA_new(void);

void
OCSP_RESPDATA_free(OCSP_RESPDATA *respdata);

OCSP_RESPID *
OCSP_RESPID_new(void);

void
OCSP_RESPID_free(OCSP_RESPID *respid);

OCSP_RESPONSE *
OCSP_response_create(int status, OCSP_BASICRESP *bs);

int
OCSP_response_status(OCSP_RESPONSE *resp);

const char *
OCSP_response_status_str(long code);

OCSP_BASICRESP *
OCSP_response_get1_basic(OCSP_RESPONSE *resp);

int
OCSP_basic_sign(OCSP_BASICRESP *bs, X509 *signer, EVP_PKEY *key,
    const EVP_MD *dgst, STACK_OF(X509) *certs, unsigned long flags);

---

🎀 DESCRIPTION 🎀

okay so buckle up, we're meeting the whole cast one by one. 💖

OCSP_RESPONSE_new() allocates and initializes an empty OCSP_RESPONSE object, and like, what even is that? It represents an ASN.1 OCSPResponse structure as defined in RFC 6960. Iconic. And then OCSP_RESPONSE_free() frees resp — yes queen, release it. 🫶

OCSP_RESPBYTES_new() allocates and initializes an empty OCSP_RESPBYTES object, representing an ASN.1 ResponseBytes structure defined in RFC 6960. Such an object is used inside OCSP_RESPONSE, lowkey living its best supporting-role life. OCSP_RESPBYTES_free() frees respbytes.

OCSP_BASICRESP_new() allocates and initializes an empty OCSP_BASICRESP object, representing an ASN.1 BasicOCSPResponse structure defined in RFC 6960. Fun fact bestie: OCSP_RESPBYTES contains the DER-encoded form of an OCSP_BASICRESP object, so they're literally entangled, iykyk. OCSP_BASICRESP_free() frees bs.

OCSP_RESPDATA_new() allocates and initializes an empty OCSP_RESPDATA object, representing an ASN.1 ResponseData structure defined in RFC 6960. This one's used inside OCSP_BASICRESP, nesting-doll situation fr. OCSP_RESPDATA_free() frees respdata.

OCSP_RESPID_new() allocates and initializes an empty OCSP_RESPID object, representing an ASN.1 ResponderID structure defined in RFC 6960. It's used inside OCSP_RESPDATA, because the pipeline is deep and we respect it. OCSP_RESPID_free() frees respid. ✨

OCSP_response_create() creates an OCSP_RESPONSE object for status and optionally includes the basic response bs — like, if bs is there it's invited, if not, we move on. 🌸

OCSP_response_status() returns the OCSP response status of resp, and it returns one of these values:

• OCSP_RESPONSE_STATUS_SUCCESSFUL
• OCSP_RESPONSE_STATUS_MALFORMEDREQUEST
• OCSP_RESPONSE_STATUS_INTERNALERROR
• OCSP_RESPONSE_STATUS_TRYLATER
• OCSP_RESPONSE_STATUS_SIGREQUIRED
• OCSP_RESPONSE_STATUS_UNAUTHORIZED

OCSP_response_status_str() converts one of the status codes returned by OCSP_response_status() to a string consisting of one word — short and to the point, the way we like it. 💅

OCSP_response_get1_basic() decodes and returns the OCSP_BASICRESP object contained in resp. It is only called if the status of a response is OCSP_RESPONSE_STATUS_SUCCESSFUL — so like, only summon it when things actually worked, periodt.

OCSP_basic_sign() signs the OCSP response bs using the certificate signer, the private key key, the digest dgst, and the additional certificates certs. And there are flags, bestie:

• If the flags option OCSP_NOCERTS is set, then no certificates will be included in the request.
• If the flags option OCSP_RESPID_KEY is set, then the responder is identified by key ID rather than by name.

---

🔥 RETURN VALUES 🔥

OCSP_RESPONSE_new() and OCSP_response_create() return a pointer to an OCSP_RESPONSE object or NULL if an error occurred. 💀

OCSP_BASICRESP_new() and OCSP_response_get1_basic() return a pointer to an OCSP_BASICRESP object or NULL if an error occurred.

OCSP_RESPBYTES_new(), OCSP_RESPDATA_new(), and OCSP_RESPID_new() return a pointer to an empty OCSP_RESPBYTES, OCSP_RESPDATA, or OCSP_RESPID object, respectively, or NULL if an error occurred. (respectively is doing so much work here, we love to see it 🫶)

OCSP_response_status() returns a status value.

OCSP_response_status_str() returns a pointer to a static string.

OCSP_basic_sign() return 1 on success or 0 on failure. that's it, that's the whole vibe check.

---

🌈 SEE ALSO 🌈

EVP_DigestInit(3), OCSP_cert_to_id(3), OCSP_request_add1_nonce(3), OCSP_REQUEST_new(3), OCSP_resp_find_status(3), OCSP_sendreq_new(3) — go read them, they're all connected, it's giving OCSP cinematic universe. 👑

---

⭐ STANDARDS ⭐

RFC 6960: X.509 Internet Public Key Infrastructure Online Certificate Status Protocol, section 4.2: Response Syntax. iconic document, no notes. 📜

---

🦋 HISTORY 🦋

These functions first appeared in OpenSSL 0.9.7 and have been available since OpenBSD 3.2. vintage behavior honestly, they've been slaying since before some of us were born. 💜

---

and that's the page bestie! 🎀 this Debian build (dated June 8, 2025, of the OCSP_RESPONSE_STATUS(3) library-functions family, in case you're keeping receipts) says mwah, go sign some responses responsibly. 💋✨