OCSP_SENDREQ_NEW(3SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

✨ NAME ✨

okay so this whole page is about the OCSP responder query functions bestie 💖 — the ones that go get a straight answer out of an OCSP responder over HTTP. their names, in order, no cap: OCSP_REQ_CTX, OCSP_sendreq_new, OCSP_sendreq_nbio, OCSP_sendreq_bio, OCSP_REQ_CTX_i2d, OCSP_REQ_CTX_add1_header, OCSP_REQ_CTX_free, OCSP_set_max_response_length, and OCSP_REQ_CTX_set1_req. all of them, together, one little squad 🫶

(this is the OCSP_SENDREQ_NEW(3SSL) manual page, btw, in case the vibe check needed a name)

🌸 SYNOPSIS 🌸

first, the include. iconic, mandatory, don't skip it:

#include <openssl/ocsp.h>

OSSL_HTTP_REQ_CTX *OCSP_sendreq_new(BIO *io, const char *path,
                                    const OCSP_REQUEST *req, int buf_size);
OCSP_RESPONSE *OCSP_sendreq_bio(BIO *io, const char *path, OCSP_REQUEST *req);

💀 the deprecated girlies 💀

sooo these next ones? they've been deprecated since OpenSSL 3.0 🫣 and if you define OPENSSL_API_COMPAT with a suitable version value you can hide them entirely — like, poof, gone. see openssl_user_macros(7) for the how.

typedef OSSL_HTTP_REQ_CTX OCSP_REQ_CTX;
int OCSP_sendreq_nbio(OCSP_RESPONSE **presp, OSSL_HTTP_REQ_CTX *rctx);
int OCSP_REQ_CTX_i2d(OCSP_REQ_CT *rctx, const ASN1_ITEM *it, ASN1_VALUE *req);
int OCSP_REQ_CTX_add1_header(OCSP_REQ_CT *rctx,
                             const char *name, const char *value);
void OCSP_REQ_CTX_free(OCSP_REQ_CTX *rctx);
void OCSP_set_max_response_length(OCSP_REQ_CT *rctx, unsigned long len);
int OCSP_REQ_CTX_set1_req(OCSP_REQ_CTX *rctx, const OCSP_REQUEST *req);

🦋 DESCRIPTION 🦋

so what are we even doing here? these functions do an OCSP POST request / response transfer over HTTP ✨ and they do it using the HTTP request functions from OSSL_HTTP_REQ_CTX(3). that's the whole vibe.

🎀 OCSP_sendreq_new()

this one builds a complete OSSL_HTTP_REQ_CTX structure for you. it takes:

  • io — the BIO you're gonna use for requests and responses
  • path — the URL path
  • req — the OCSP request, and it's optional, bestie
  • buf_size — the max line length for the response header

and if buf_size is zero? cute, a default value of 4KiB gets used 🍓 no stress.

the req can literally be NULL and set later using OCSP_REQ_CTX_set1_req() or OSSL_HTTP_REQ_CTX_set1_req(3). main character energy: show up empty-handed, deliver later 💅

the io and path arguments correspond to the components of the URL. example time, because this is the part people trip on: if the responder URL is "http://example.com/ocspreq" then the BIO io should haven been connected to host "example.com" on port 80, and path should be set to "/ocspreq". ✨ got it? got it.

🧚 OCSP_sendreq_nbio()

this one attempts to send the request prepared in rctx and gather the response via HTTP, using the BIO io and path that were given when you called OCSP_sendreq_new(). it remembers. it always remembers 🫶

if the operation gets completed, it assigns the response — a pointer to a OCSP_RESPONSE structure — in *presp. slay.

⚠️ ok important: the function may need to be called again if its result is -1, which indicates BIO_should_retry(3). in that case it is advisable to sleep a little in between, using BIO_wait(3) on the read BIO to prevent a busy loop. do not spin, bestie, your CPU does not deserve that 😭

🌈 OCSP_sendreq_bio()

this is the convenience girlie: it combines OCSP_sendreq_new() with as many calls of OCSP_sendreq_nbio() as needed and then OCSP_REQ_CTX_free(), with a response header maximum line length of 4k.

it waits indefinitely on a response. indefinitely!! 💀 it does not support setting a timeout or adding headers, and it's retained for compatibility — so use OSSL_HTTP_transfer(3) instead. periodt.

🔥 the equivalence girlies

OCSP_REQ_CTX_i2d(rctx, it, req) is equivalent to the following:

OSSL_HTTP_REQ_CTX_set1_req(rctx, "application/ocsp-request", it, req)

and OCSP_REQ_CTX_set1_req(rctx, req) is equivalent to the following:

OSSL_HTTP_REQ_CTX_set1_req(rctx, "application/ocsp-request",
                           ASN1_ITEM_rptr(OCSP_REQUEST),
                           (const ASN1_VALUE *)req)

like, same thing. different font. 💖

👑 the superseded girlies

the deprecated type and the remaining deprecated functions have been superseded by these equivalents — old queen, new queen, the throne stays shining:

⭐ RETURN VALUES ⭐

the receipts, bestie:

  • OCSP_sendreq_new() returns a valid OSSL_HTTP_REQ_CTX structure, or NULL if an error occurred. 🫠
  • OCSP_sendreq_nbio() returns 1 for success, 0 on error, and -1 if retry is needed.
  • OCSP_sendreq_bio() returns the OCSP_RESPONSE structure sent by the responder, or NULL if an error occurred.

💜 SEE ALSO 💜

go read these next, iykyk:

🎀 HISTORY 🎀

so the lore: OCSP_REQ_CTX, OCSP_REQ_CTX_i2d(), OCSP_REQ_CTX_add1_header(), OCSP_REQ_CTX_free(), OCSP_set_max_response_length(), and OCSP_REQ_CTX_set1_req() were deprecated in OpenSSL 3.0. they had a good run, we respect the legacy 👑

Copyright 2015-2022 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page bestie, you ate it 💅✨ this was version 4.0.3, dated 2026-09-29, and the manual is OCSP_SENDREQ_NEW(3SSL) — go forth and query your responders responsibly 🦋💖

📦 where this page comes from