SSL_CTX_SET_TLSEXT_STATUS_CB(3ossl)

💖 SSL_CTX_SET_TLSEXT_STATUS_CB — OCSP Certificate Status Request functions 💖

okay bestie, so this is an OpenSSL manpage (the 3ossl manual, iykyk) and it's all about OCSP stapling — the thing where a client is like "hey server, could u send me your certificate status?" and the server's like "say less, here's a whole status response, no extra round trip needed ✨". The functions in question are:

• SSL_CTX_set_tlsext_status_cb, SSL_CTX_get_tlsext_status_cb
• SSL_CTX_set_tlsext_status_arg, SSL_CTX_get_tlsext_status_arg
• SSL_CTX_set_tlsext_status_type, SSL_CTX_get_tlsext_status_type
• SSL_set_tlsext_status_type, SSL_get_tlsext_status_type
• SSL_get_tlsext_status_ocsp_resp, SSL_set_tlsext_status_ocsp_resp

---

🌈 SYNOPSIS 🌈

like, here's the whole vibe in code form, no cap:

#include <openssl/tls1.h>

long SSL_CTX_set_tlsext_status_cb(SSL_CTX *ctx, int (*callback)(SSL *, void *));
long SSL_CTX_get_tlsext_status_cb(SSL_CTX *ctx, int (**callback)(SSL *, void *));

long SSL_CTX_set_tlsext_status_arg(SSL_CTX *ctx, void *arg);
long SSL_CTX_get_tlsext_status_arg(SSL_CTX *ctx, void **arg);

long SSL_CTX_set_tlsext_status_type(SSL_CTX *ctx, int type);
long SSL_CTX_get_tlsext_status_type(SSL_CTX *ctx);

long SSL_set_tlsext_status_type(SSL *s, int type);
long SSL_get_tlsext_status_type(SSL *s);

long SSL_get_tlsext_status_ocsp_resp(ssl, unsigned char **resp);
long SSL_set_tlsext_status_ocsp_resp(ssl, unsigned char *resp, int len);

---

🦋 DESCRIPTION 🦋

So picture this: a client app wants the server to send back an OCSP status response (that's the OCSP stapling thing we mentioned, main character behavior tbh). To make that happen, the client calls SSL_CTX_set_tlsext_status_type() before any SSL objects get created. Or, alternative route: an application can call SSL_set_tlsext_status_type() on one individual SSL object, as long as it's before the handshake starts. Periodt.

Currently the only supported type is TLSEXT_STATUSTYPE_ocsp — that's the value you pass in the type argument, bestie. And if you call SSL_CTX_get_tlsext_status_type() you'll get back the type TLSEXT_STATUSTYPE_ocsp that was previously set via SSL_CTX_set_tlsext_status_type(), or -1 if it was never set. 💅

---

Then the client ALSO needs to hand over a callback function so it can decide what to do with the OCSP response it gets back — that's what SSL_CTX_set_tlsext_status_cb() is for. The callback's whole job is deciding whether the returned OCSP response is acceptable or not. And the callback gets passed, as its argument, the value you previously set by calling SSL_CTX_set_tlsext_status_arg().

⚠️ real talk: the callback will not be called in the event of a handshake where session resumption occurs — because there are no Certificates exchanged in such a handshake. that's just facts.

The callback you set via SSL_CTX_set_tlsext_status_cb() can be retrieved with SSL_CTX_get_tlsext_status_cb(), and the argument can be retrieved with SSL_CTX_get_tlsext_status_arg(). 🫶

---

On the client side, SSL_get_tlsext_status_type() tells you whether the client previously called SSL_set_tlsext_status_type(). If it did, you get TLSEXT_STATUSTYPE_ocsp back; otherwise -1. On the server side, SSL_get_tlsext_status_type() tells you whether the client requested OCSP stapling. If the client requested it, this function returns TLSEXT_STATUSTYPE_ocsp, or -1 otherwise.

The response the server sent back can be grabbed with SSL_get_tlsext_status_ocsp_resp(). The value *resp gets updated to point at the OCSP response data, and the return value is the length of that data. Typically a callback would pull an OCSP_RESPONSE object out of this data by calling d2i_OCSP_RESPONSE(). And if the server didn't provide any response data at all, then *resp will be NULL and the return value from SSL_get_tlsext_status_ocsp_resp() will be -1. 😭

A server application also has to call SSL_CTX_set_tlsext_status_cb() if it wants to be able to provide clients with OCSP Certificate Status responses. Typically the server callback would:

1. obtain the server certificate being sent back to the client via a call to SSL_get_certificate();
2. obtain the OCSP response to be sent back;
3. and then set that response data by calling SSL_set_tlsext_status_ocsp_resp().

A pointer to the response data goes in the resp argument, and the length of that data goes in the len argument. Slay. ✨

---

👑 RETURN VALUES 👑

The callback, when used on the client side, should return:

• a negative value on error;
• 0 if the response is not acceptable — and heads up, in that case the handshake will fail;
• or a positive value if it's acceptable.

The callback, when used on the server side, should return one of:

• SSL_TLSEXT_ERR_OK — meaning the OCSP response that has been set should be returned;
• SSL_TLSEXT_ERR_NOACK — meaning an OCSP response should not be returned;
• SSL_TLSEXT_ERR_ALERT_FATAL — meaning a fatal error has occurred. 💀

SSL_CTX_set_tlsext_status_cb(), SSL_CTX_set_tlsext_status_arg(), SSL_CTX_set_tlsext_status_type(), SSL_set_tlsext_status_type() and SSL_set_tlsext_status_ocsp_resp() return 0 on error or 1 on success.

SSL_CTX_get_tlsext_status_type() returns the value previously set by SSL_CTX_set_tlsext_status_type(), or -1 if not set.

SSL_get_tlsext_status_ocsp_resp() returns the length of the OCSP response data or -1 if there is no OCSP response data.

SSL_get_tlsext_status_type() returns TLSEXT_STATUSTYPE_ocsp on the client side if SSL_set_tlsext_status_type() was previously called, or on the server side if the client requested OCSP stapling. Otherwise -1 is returned.

---

🌸 SEE ALSO 🌸

• ssl(7)

---

🎀 HISTORY 🎀

The SSL_get_tlsext_status_type(), SSL_CTX_get_tlsext_status_type() and SSL_CTX_set_tlsext_status_type() functions were added in OpenSSL 1.1.0. iconic behavior honestly.

---

📜 COPYRIGHT 📜

Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page bestie!! 🦋💖 this came from the OpenSSL 3.5.9 docs, dated 2026-09-2 — go forth and staple some OCSP responses, you've got this 🫶✨🌈