OCSP_REQUEST_NEW(3ossl)

📦 version 3.5.0, in opensuse-leap 16.0

okay so bestie, gather round — this is OCSP_REQUEST_NEW(3ossl), straight out of the OpenSSL manual, section 3, and we are about to make OCSP requests feel less like a vibe check from a cryptographer and more like a group chat you actually understand 💅✨

🎀 NAME 🎀

All the OCSP request functions, together, in one place — OCSP_REQUEST_new, OCSP_REQUEST_free, OCSP_request_add0_id, OCSP_request_sign, OCSP_request_add1_cert, OCSP_request_onereq_count, and OCSP_request_onereq_get0. That's the whole squad 🫶

🌸 SYNOPSIS 🌸

#include <openssl/ocsp.h>

OCSP_REQUEST *OCSP_REQUEST_new(void);
void OCSP_REQUEST_free(OCSP_REQUEST *req);

OCSP_ONEREQ *OCSP_request_add0_id(OCSP_REQUEST *req, OCSP_CERTID *cid);

int OCSP_request_sign(OCSP_REQUEST *req,
                      X509 *signer, EVP_PKEY *key, const EVP_MD *dgst,
                      STACK_OF(X509) *certs, unsigned long flags);

int OCSP_request_add1_cert(OCSP_REQUEST *req, X509 *cert);

int OCSP_request_onereq_count(OCSP_REQUEST *req);
OCSP_ONEREQ *OCSP_request_onereq_get0(OCSP_REQUEST *req, int i);

🦋 DESCRIPTION 🦋

Okay so here's what each little icon does 👑

  • OCSP_REQUEST_new() — allocates and hands you back a fresh, empty OCSP_REQUEST structure. Brand new, zero thoughts, head empty ✨
  • OCSP_REQUEST_free() — frees up the request structure req. And listen: if the argument is NULL, literally nothing happens. Nothing. It's a no-op. Very chill of it, honestly 💀
  • OCSP_request_add0_id() — adds the certificate ID cid to req, and returns the OCSP_ONEREQ structure it just added, so your application can pile on additional extensions to the request. BUT — and this is the important part, bestie, do not skip it — the id parameter MUST NOT be freed up after the operation. It lives there now. You do not get to free it. 🙈
  • OCSP_request_sign() — signs the OCSP request req using the certificate signer, the private key key, the digest dgst, and additional certificates certs. And if the flags option OCSP_NOCERTS is set, then no certificates will be included in the request. Periodt 🎀
  • OCSP_request_add1_cert() — adds the certificate cert to the request req. Heads up though: the application is responsible for freeing up cert after use. That's on you, not on it 🫡
  • OCSP_request_onereq_count() — returns the total number of OCSP_ONEREQ structures in req. Counting era 🔢
  • OCSP_request_onereq_get0() — returns an internal pointer to the OCSP_ONEREQ contained in req at index i. And the index value i runs from 0 to OCSP_request_onereq_count(req) - 1. Respect the range, or else 😭

💜 RETURN VALUES 💜

  • OCSP_REQUEST_new() — returns an empty OCSP_REQUEST structure, or NULL if an error occurred 😔
  • OCSP_request_add0_id() — returns the OCSP_ONEREQ structure containing cid, or NULL if an error occurred. Slay when it works, sad when it doesn't 💀
  • OCSP_request_sign() and OCSP_request_add1_cert() — return 1 for success and 0 for failure. Simple. Binary. Iconic 🔥
  • OCSP_request_onereq_count() — returns the total number of OCSP_ONEREQ structures in req, and -1 on error ⭐
  • OCSP_request_onereq_get0() — returns a pointer to an OCSP_ONEREQ structure, or NULL if the index value is out or range 🫠

🧚 NOTES 🧚

An OCSP request structure contains one or more OCSP_ONEREQ structures, corresponding to each certificate. It's giving "one entry per bestie" energy, and honestly? We love that for it 💖

Also, OCSP_request_onereq_count() and OCSP_request_onereq_get0() are mainly used by OCSP responders. So if you're the responder in this situation, these two are your main characters 👑

🌈 EXAMPLES 🌈

So say you wanna create an OCSP_REQUEST structure for the certificate cert with issuer issuer — here's the whole glow-up, step by step:

        OCSP_REQUEST *req;
        OCSP_ID *cid;

        req = OCSP_REQUEST_new();
        if (req == NULL)
           /* error */
        cid = OCSP_cert_to_id(EVP_sha1(), cert, issuer);
        if (cid == NULL)
           /* error */

        if (OCSP_REQUEST_add0_id(req, cid) == NULL)
           /* error */

        /* Do something with req, e.g. query responder */

        OCSP_REQUEST_free(req);

Look at that. Beautiful. Chef's kiss 🤌 — and don't forget the OCSP_REQUEST_free(req) at the end, bestie, we do NOT leak in this house 🎀

🍓 SEE ALSO 🍓

crypto(7), OCSP_cert_to_id(3), OCSP_request_add1_nonce(3), OCSP_resp_find_status(3), OCSP_response_status(3), OCSP_sendreq_new(3)

(Read them, iykyk 📚)

Copyright 2015-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, bestie 🫶 this was version 3.5.0, dated 2026-09-25, and yes the manual name is OCSP_REQUEST_NEW(3ossl) in case you forgot already 😭💖 go forth and make those OCSP requests, you've got this ✨

📦 where this page comes from