LIBRESSL-TLS_OCSP_PROCESS_RESPONSE(3)

💅 TLS_OCSP_PROCESS_RESPONSE — inspect an OCSP response 💅

okay so bestie, this is a page out of the libtls manual (that's the Library Functions Manual, bestie, iykyk), and it's all about peeking inside an OCSP response to see if a certificate got revoked. no cap, it's giving "SSL detective work" energy and honestly? we're obsessed. 🕵️‍♀️✨

the whole squad on this page: tls_ocsp_process_response, tls_peer_ocsp_url, tls_peer_ocsp_response_status, tls_peer_ocsp_cert_status, tls_peer_ocsp_crl_reason, tls_peer_ocsp_result, tls_peer_ocsp_revocation_time, tls_peer_ocsp_this_update, tls_peer_ocsp_next_update. iconic lineup fr fr 💖

---

✨ SYNOPSIS ✨

library “libtls” libssl libcrypto #include <tls.h>

int
tls_ocsp_process_response(struct tls *ctx,
    const unsigned char *response, size_t size);

const char *
tls_peer_ocsp_url(struct tls *ctx);

int
tls_peer_ocsp_response_status(struct tls *ctx);

int
tls_peer_ocsp_cert_status(struct tls *ctx);

int
tls_peer_ocsp_crl_reason(struct tls *ctx);

const char *
tls_peer_ocsp_result(struct tls *ctx);

time_t
tls_peer_ocsp_revocation_time(struct tls *ctx);

time_t
tls_peer_ocsp_this_update(struct tls *ctx);

time_t
tls_peer_ocsp_next_update(struct tls *ctx);

---

🌸 DESCRIPTION 🌸

the main character 🎀

• tls_ocsp_process_response() — this one takes a raw OCSP response (the response pointer, size bytes long) and does a whole vibe check on the peer certificate from ctx to see if it's been revoked. and here's the slay: a return code of 0 on success means the cert has not been revoked. clean. ✨
• tls_peer_ocsp_url() — hands you the URL for OCSP validation of the peer certificate from ctx. that's it, that's the function. 💅

the info desk 🦋

the following functions (yes, all of them) give you info about the peer certificate from ctx, and that info came either from validating a stapled OCSP response during the handshake, or from a previous call to tls_ocsp_process_response(). both paths, same tea. 🍵

• tls_peer_ocsp_response_status() — returns the OCSP response status as per RFC 6960 section 2.3. go off, RFC.
• tls_peer_ocsp_cert_status() — returns the OCSP certificate status code as per RFC 6960 section 2.2.
• tls_peer_ocsp_crl_reason() — returns the OCSP certificate revocation reason status code as per RFC 5280 section 5.3.1.
• tls_peer_ocsp_result() — gives you a textual representation of the OCSP status code that one of the previous three functions returned. so like: if the OCSP response was valid and the certificate was not revoked, the string tells you the OCSP certificate status. otherwise, the string tells you the OCSP certificate revocation reason or the OCSP error. it's giving "translator friend" energy 🫶
• tls_peer_ocsp_revocation_time() — returns the OCSP revocation time.
• tls_peer_ocsp_this_update() — returns the OCSP this update time.
• tls_peer_ocsp_next_update() — returns the OCSP next update time.

---

⭐ RETURN VALUES ⭐

• tls_ocsp_process_response() — returns 0 on success or -1 on error. that's the whole spectrum, bestie.
• tls_peer_ocsp_url() and tls_peer_ocsp_result() — return NULL on error or an out of memory condition. 😭 not the OOM.
• tls_peer_ocsp_response_status() — on success, returns one of: TLS_OCSP_RESPONSE_SUCCESSFUL, TLS_OCSP_RESPONSE_MALFORMED, TLS_OCSP_RESPONSE_INTERNALERROR, TLS_OCSP_RESPONSE_TRYLATER, TLS_OCSP_RESPONSE_SIGREQUIRED, or TLS_OCSP_RESPONSE_UNAUTHORIZED. on error it returns -1.
• tls_peer_ocsp_cert_status() — on success, returns one of: TLS_OCSP_CERT_GOOD, TLS_OCSP_CERT_REVOKED, or TLS_OCSP_CERT_UNKNOWN. and -1 on error.
• tls_peer_ocsp_crl_reason() — on success, returns one of: TLS_CRL_REASON_UNSPECIFIED, TLS_CRL_REASON_KEY_COMPROMISE, TLS_CRL_REASON_CA_COMPROMISE, TLS_CRL_REASON_AFFILIATION_CHANGED, TLS_CRL_REASON_SUPERSEDED, TLS_CRL_REASON_CESSATION_OF_OPERATION, TLS_CRL_REASON_CERTIFICATE_HOLD, TLS_CRL_REASON_REMOVE_FROM_CRL, TLS_CRL_REASON_PRIVILEGE_WITHDRAWN, or TLS_CRL_REASON_AA_COMPROMISE. on error? you already know. -1. 💀
• tls_peer_ocsp_revocation_time(), tls_peer_ocsp_this_update(), and tls_peer_ocsp_next_update() — return a time in epoch-seconds on success, or -1 on error. epoch-seconds is so unhinged but we respect it 🕰️

---

👀 SEE ALSO 👀

tls_client(3), tls_config_ocsp_require_stapling(3), tls_conn_version(3), tls_connect(3), tls_handshake(3), tls_init(3)

go read those too, they're the friend group. 🫶

---

🌈 HISTORY 🌈

these functions appeared in OpenBSD 6.1. vintage! kinda. 🎀

---

👑 AUTHORS 👑

• Bob Beck <beck@openbsd.org>
• Marko Kreen <markokr@gmail.com>

absolute legends, we stan. 💜

---

ok final sign-off: this page is part of the Debian build, dated July 7, 2025, and yeah, the file name is TLS_OCSP_PROCESS_RESPONSE(3) even though the header on this page is short a letter or two — that's just how it is, bestie, don't come for me 💅✨ no cap, you're now an OCSP expert. go forth and check those revocation statuses. 🦋🌟