OCSP_REQUEST_ADD1_NONCE(3ossl)

💖 OCSP_REQUEST_ADD1_NONCE 💖

okay bestie, so this is the OpenSSL page for the OCSP nonce functions — that's OCSP_request_add1_nonce, OCSP_basic_add1_nonce, OCSP_check_nonce and OCSP_copy_nonce, all living in the 3ossl manual. nonces are literally the vibe-check of the OCSP world and i'm obsessed with them, so let's get into it 🎀

---

✨ SYNOPSIS ✨

#include <openssl/ocsp.h>

int OCSP_request_add1_nonce(OCSP_REQUEST *req, unsigned char *val, int len);
int OCSP_basic_add1_nonce(OCSP_BASICRESP *resp, unsigned char *val, int len);
int OCSP_copy_nonce(OCSP_BASICRESP *resp, OCSP_REQUEST *req);
int OCSP_check_nonce(OCSP_REQUEST *req, OCSP_BASICRESP *resp);

---

🌸 DESCRIPTION 🌸

• OCSP_request_add1_nonce() — drops a nonce of value val and length len into the OCSP request req. if val is NULL, it just makes a random one, cute. and if len is zero or negative, a default length gets used instead (currently 16 bytes).
• OCSP_basic_add1_nonce() — literally identical to OCSP_request_add1_nonce() except it's adding the nonce to an OCSP basic response resp instead of a request. same energy, different struct 💅
• OCSP_check_nonce() — compares the nonce value in req and resp. it's giving referee energy fr fr.
• OCSP_copy_nonce() — copies whatever nonce value is present in req over to resp. no thoughts, just copy 🫶

---

⭐ RETURN VALUES ⭐

OCSP_request_add1_nonce() and OCSP_basic_add1_nonce() are simple like that:

• 1 — success, we ate 💅
• 0 — failure, not the vibe 😭

OCSP_copy_nonce() has a lil more range:

• 1 — a nonce was successfully copied ✨
• 2 — there was no nonce present in req (nothing to copy, lowkey fine)
• 0 — an error occurred 💀

OCSP_check_nonce() returns the result of the nonce comparison between req and resp. the return value is the comparison result, so read it carefully bestie:

• 1 — nonces are present and equal 👑
• 2 — the nonces are absent
• 3 — a nonce is present in the response only
• 0 — nonces are present and unequal 🚨
• -1 — the nonce is present in the request only

---

🦋 NOTES 🦋

for most purposes, the nonce value in a request gets set to a random value, so the val parameter in OCSP_request_add1_nonce() is usually NULL. let the function cook 🍓

an OCSP nonce is typically added to an OCSP request to thwart replay attacks — you do that by checking the same nonce value shows up in the response. it's the "prove you're you" of it all.

some responders may include a nonce in all responses even if one wasn't supplied. generous of them ngl.

some responders cache OCSP responses and don't sign each response, for performance reasons. as a result, they do not support nonces. periodt.

the return values of OCSP_check_nonce() can be checked to cover each case. a positive return value effectively indicates success: nonces are both present and match, both absent, or present in the response only. a nonzero return additionally covers the case where the nonce is present in the request only — this will happen if the responder doesn't support nonces. a zero return value indicates present and mismatched nonces:

⚠️ bestie listen — a 0 return should be treated as an error condition. do not let that slide. 🚨

---

🔥 SEE ALSO 🔥

• crypto(7)
• OCSP_cert_to_id(3)
• OCSP_REQUEST_new(3)
• OCSP_resp_find_status(3)
• OCSP_response_status(3)
• OCSP_sendreq_new(3)

---

💜 COPYRIGHT 💜

Copyright 2015-2020 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

okay that's the whole page bestie, no cap 💖 this was OpenSSL 3.5.9, dated 2026-09-29, from the 3ossl manual set. go forth and nonce responsibly, ily 🎀✨💅