OCSP_REQUEST_ADD1_NONCE(3SSL)

📦
version 4.0.3 · 14 versions
, in ubuntu stonking

💖 OCSP_REQUEST_ADD1_NONCE 💖

okay bestie so this is the OCSP_request_add1_nonce(3SSL) page — yes it's a whole mouthful, we're calling it "the nonce squad" from here on out. It's OpenSSL, it's the OCSP nonce functions, and honestly? iconic behavior. Let's get into it 🎀

✨ NAME ✨

OCSP_request_add1_nonce, OCSP_basic_add1_nonce, OCSP_check_nonce, OCSP_copy_nonce — the OCSP nonce functions, aka the four besties who handle your nonce situation 💅

🌸 SYNOPSIS 🌸

#include <openssl/ocsp.h>

int OCSP_request_add1_nonce(OCSP_REQUEST *req, unsigned char *val, int len);
int OCSP_basic_add1_nonce(OCSP_BASICRESP *resp, unsigned char *val, int len);
int OCSP_copy_nonce(OCSP_BASICRESP *resp, OCSP_REQUEST *req);
int OCSP_check_nonce(OCSP_REQUEST *req, OCSP_BASICRESP *resp);

periodt. four functions, zero chill. copy-paste them exactly, do not freestyle the prototypes, i am begging 🫶

🦋 DESCRIPTION 🦋

so like. a nonce is a one-time random lil value and these functions are the way you handle it in OCSP world.

  • OCSP_request_add1_nonce() — adds a nonce of value val and length len to the OCSP request req. If val is NULL, a random nonce gets used instead (very slay of it). And if len is zero or negative, a default length kicks in — currently 16 bytes. yes, sixteen. locked in 💖
  • OCSP_basic_add1_nonce() — literally the same as OCSP_request_add1_nonce() except the vibe is different: it adds the nonce to an OCSP basic response resp instead of a request.
  • OCSP_check_nonce() — compares the nonce value in req and resp. the moment of truth, the vibe check, if you will ⭐
  • OCSP_copy_nonce() — copies any nonce value present in req over to resp. stealing from one and giving to the other, but make it cryptography.

🔥 RETURN VALUES 🔥

  • OCSP_request_add1_nonce() and OCSP_basic_add1_nonce() — return 1 for success and 0 for failure. simple. binary. iconic.
  • OCSP_copy_nonce() — returns 1 if a nonce was successfully copied, 2 if no nonce was present in req, and 0 if an error occurred.
  • OCSP_check_nonce() — returns the result of the nonce comparison between req and resp. the return value is the result of the comparison, so read it carefully bestie, it's giving love-letter-decoding energy:
    • nonces are present and equal → 1
    • nonces are absent → 2
    • a nonce is present in the response only → 3
    • nonces are present and unequal → 0
    • the nonce is present in the request only → -1

👑 NOTES 👑

okay this is the part where i need you to actually pay attention, bestie. no scrolling.

  • For most purposes the nonce value in a request is set to a random value, so the val parameter in OCSP_request_add1_nonce() is usually NULL. let it cook, it knows what it's doing.
  • An OCSP nonce is typically added to an OCSP request to thwart replay attacks — you do this by checking the same nonce value appears in the response. security girlie behavior 💅
  • Some responders may include a nonce in all responses even if one is not supplied. fine. quirky. we respect it.
  • Some responders cache OCSP responses and do not sign each response, for performance reasons. as a result they do not support nonces. no nonce for you, sorry 🥲
  • The return values of OCSP_check_nonce() can be checked to cover each case:
    • A positive return value effectively indicates success: nonces are both present and match, both absent, or present in the response only. ✅
    • A nonzero return additionally covers the case where the nonce is present in the request only — this will happen if the responder doesn't support nonces.
    • A zero return value indicates present and mismatched nonces.
⚠️ a 0 return means present-and-mismatched nonces, and this should be treated as an error condition. not a vibe. not a false alarm. an actual error. do not ignore it, i will know 🙈

🌈 SEE ALSO 🌈

crypto(7), OCSP_cert_to_id(3), OCSP_REQUEST_new(3), OCSP_resp_find_status(3), OCSP_response_status(3), OCSP_sendreq_new(3)

the whole friend group, go read them too 🫶

Copyright 2015-2020 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page bestie, no notes 💖 written for 4.0.3, dated 2026-09-29 — go forth and nonce responsibly, mwah 💅✨

📦 where this page comes from