OSSL_CMP_MSG_HTTP_PERFORM(3ossl)

📦
version 3.5.9 · 8 versions
, in fedora 43, fedora 44

💅 OSSL_CMP_MSG_http_perform — the girlies' guide to yeeting a CMP request at a server

okay so bestie, this is OSSL_CMP_MSG_http_perform(3ossl), a page from the OpenSSL manual, and it's all about the client side of an HTTP(S) transfer of a CMP request-response pair. basically you hand it a request, it hands you back an answer, and the internet does the middle part. iconic behavior honestly. 🎀

✨ NAME ✨

OSSL_CMP_MSG_http_perform — client-side HTTP(S) transfer of a CMP request-response pair. yes that's the whole vibe, it's giving "do the network thing for me please". 🦋

🌸 SYNOPSIS 🌸

#include <openssl/cmp.h>

OSSL_CMP_MSG *OSSL_CMP_MSG_http_perform(OSSL_CMP_CTX *ctx,
                                        const OSSL_CMP_MSG *req);

💖 DESCRIPTION 💖

so OSSL_CMP_MSG_http_perform() takes the PKIMessage you pass in as req, sends it off to the CMP server that's specified in ctx, and returns the result it got back from that server. that's the whole plot. no notes. ✨

the two-BIO era (when you've already got a connection)

if you've already used OSSL_CMP_CTX_set_transfer_cb_arg(3) to set the transfer callback argument, then the pointer bios you provided gets treated as a two-element BIO array, and that array is what gets used for the exchange with the server — exactly as described for the bio and rbio parameters of OSSL_HTTP_open(3). 💅

and like, fun fact: those two BIO pointers are allowed to be equal and both refer to a TLS connection. that's the move in BRSKI-AE, where a pre-established TLS channel gets reused for CMP. reusing things instead of rebuilding them? that's main character energy fr. 👑

the "just go find the server yourself" era

otherwise — meaning no such callback arg was set — the function contacts the server specified via OSSL_CMP_CTX_set1_server(3), and optionally OSSL_CMP_CTX_set_serverPort(3) for the port, where the default port is 80 for HTTP and 443 for HTTPS. 🧚

the HTTP path to use (which we also call the "CMP alias" in this context, iykyk) defaults to "/", or else it's the string you set via OSSL_CMP_CTX_set1_serverPath(3).

and on success? the function returns the server's response PKIMessage. slay. 🫶

all the little settings it respects

the function makes use of any HTTP callback function you set via OSSL_CMP_CTX_set_http_cb(3). it respects any timeout value set via OSSL_CMP_CTX_set_option(3) with an OSSL_CMP_OPT_MSG_TIMEOUT argument. it also respects any HTTP(S) proxy options set via OSSL_CMP_CTX_set1_proxy(3) and OSSL_CMP_CTX_set1_no_proxy(3), plus the respective environment variables. 🌈

okay important: proxying plain HTTP is supported directly. but using a proxy for HTTPS connections requires a suitable callback function such as OSSL_HTTP_proxy_connect(3). not me warning you in advance, bestie, just being a good friend. 💀

📚 NOTES 📚

CMP is defined in RFC 9810. HTTP transfer for CMP is defined in RFC 9811. go read them if you want the lore, they're literally right there. ⭐

🎀 RETURN VALUES 🎀

OSSL_CMP_MSG_http_perform() returns the received CMP response message on success, else NULL. that's it. success = message, fail = NULL, no in-between, no drama (well, the NULL is kind of the drama). 😭

👀 SEE ALSO 👀

🦋 HISTORY 🦋

the OpenSSL CMP support was added in OpenSSL 3.0. 🌱

the OSSL_CMP_MSG_http_perform() use of transfer_cb_arg was added in OpenSSL 3.5. glow-up confirmed. ✨

Copyright 2007-2025 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay and that's the whole page bestie, love that for us 🫶 — this was OpenSSL 3.5.9, dated 2026-09-29, and the manual name is OSSL_CMP_MSG_HTTP_PERFORM(3ossl). now go send your PKIMessage, you've got this. 💅🌸

📦 where this page comes from