OCSP_CERT_TO_ID(3SSL)

📦
version 4.0.3 · 14 versions
, in ubuntu stonking

💖 OCSP_CERT_TO_ID 💖

okay bestie, welcome to the 3SSL manual page — yes that's the manual section, it's giving OpenSSL and it's giving ✨certificate ID utility functions✨. Pull up a chair, grab a boba, we're doing this.

🌸 NAME 🌸

OCSP_cert_to_id, OCSP_cert_id_new, OCSP_CERTID_free, OCSP_id_issuer_cmp, OCSP_id_cmp, OCSP_id_get0_info — the OCSP certificate ID utility functions. literally the whole little friend group of functions that build, compare, inspect and yeet OCSP certificate IDs 🎀

✨ SYNOPSIS ✨

#include <openssl/ocsp.h>

OCSP_CERTID *OCSP_cert_to_id(const EVP_MD *dgst,
                             X509 *subject, X509 *issuer);

OCSP_CERTID *OCSP_cert_id_new(const EVP_MD *dgst,
                              X509_NAME *issuerName,
                              ASN1_BIT_STRING *issuerKey,
                              ASN1_INTEGER *serialNumber);

void OCSP_CERTID_free(OCSP_CERTID *id);

int OCSP_id_issuer_cmp(const OCSP_CERTID *a, const OCSP_CERTID *b);
int OCSP_id_cmp(const OCSP_CERTID *a, const OCSP_CERTID *b);

int OCSP_id_get0_info(ASN1_OCTET_STRING **piNameHash, ASN1_OBJECT **pmd,
                      ASN1_OCTET_STRING **pikeyHash,
                      ASN1_INTEGER **pserial, OCSP_CERTID *cid);

look at those signatures. immaculate. no notes 💅

🦋 DESCRIPTION 🦋

okay so, let's go function by function, no cap:

  • OCSP_cert_to_id() creates and returns a brand new OCSP_CERTID structure, using message digest dgst for the certificate subject with issuer issuer. oh and bestie, important: if dgst is NULL then SHA1 gets used. default behaviour, iconic behaviour.
  • OCSP_cert_id_new() creates and returns a new OCSP_CERTID using dgst plus issuer name issuerName, issuer key hash issuerKey and serial number serialNumber. it's the DIY build-your-own-ID version, we love a hands-on queen 🫶
  • OCSP_CERTID_free() frees up id. and if the argument is NULL? nothing happens. it just vibes. no crash, no drama, we respect that energy.
  • OCSP_id_cmp() compares OCSP_CERTID a and b. the whole thing. full comparison. 👑
  • OCSP_id_issuer_cmp() compares only the issuer name of OCSP_CERTID a and b. just the issuer name, nothing else, it's a very focused queen.
  • OCSP_id_get0_info() returns the issuer name hash, hash OID, issuer key hash and serial number contained in cid. and here's the cute part: if any of those values are not required, the corresponding parameter can be set to NULL. build your own little info bundle, pick and choose, slay.

🌈 RETURN VALUES 🌈

the receipts, bestie:

  • OCSP_cert_to_id() and OCSP_cert_id_new() return either a pointer to a valid OCSP_CERTID structure, or NULL if an error occurred. NULL = something went wrong, we don't gatekeep bad news 😭
  • OCSP_id_cmp() and OCSP_id_issuer_cmp() return zero for a match and nonzero otherwise. yes zero means match, which is lowkey cursed but that's C for you, periodt.
  • OCSP_CERTID_free() does not return a value. it just does its thing and leaves. mysterious. main character.
  • OCSP_id_get0_info() returns 1 for success and 0 for failure. classic. old reliable. ⭐

💜 NOTES 💜

okay crucial context, don't skip this part:

  • OCSP clients will typically only use OCSP_cert_to_id() or OCSP_cert_id_new(). the other functions? those are used by responder applications. so like, know which one you are, iykyk.
  • the values returned by OCSP_id_get0_info() are internal pointers and MUST NOT be freed up by an application: they will be freed when the corresponding OCSP_CERTID structure is freed.
⚠️ bestie i am BEGGING you — do not free() those pointers. they are borrowed, not yours. the OCSP_CERTID owns them and it will handle the cleanup when it goes. touching them yourself is how you get a double-free and a very bad afternoon. 💀

🎀 SEE ALSO 🎀

go read these next, they're all in the same friend group:

crypto(7), OCSP_request_add1_nonce(3), OCSP_REQUEST_new(3), OCSP_resp_find_status(3), OCSP_response_status(3), OCSP_sendreq_new(3)

Copyright 2015-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, bestie 🫶 this was OpenSSL version 4.0.3, dated 2026-09-29, and yes we ate. no crumbs. go forth and build those certificate IDs 💖✨🌸

📦 where this page comes from