OCSP_REQUEST_NEW(3SSL)

📦
version 4.0.3 · 14 versions
, in ubuntu stonking

💖 OCSP_REQUEST_NEW 💖 — it's giving OpenSSL manual energy ✨

okay bestie, sit down, hydrate, because today we're learning about OCSP request functions from <openssl/ocsp.h> — yes, the whole little family: OCSP_REQUEST_new, OCSP_REQUEST_free, OCSP_request_add0_id, OCSP_request_sign, OCSP_request_add1_cert, OCSP_request_onereq_count and OCSP_request_onereq_get0. this is the 3SSL manual page, so bring your ✨certificate-validating✨ self. 🎀

🌸 SYNOPSIS 🌸

#include <openssl/ocsp.h>

OCSP_REQUEST *OCSP_REQUEST_new(void);
void OCSP_REQUEST_free(OCSP_REQUEST *req);

OCSP_ONEREQ *OCSP_request_add0_id(OCSP_REQUEST *req, OCSP_CERTID *cid);

int OCSP_request_sign(OCSP_REQUEST *req,
                      X509 *signer, EVP_PKEY *key, const EVP_MD *dgst,
                      const STACK_OF(X509) *certs, unsigned long flags);

int OCSP_request_add1_cert(OCSP_REQUEST *req, X509 *cert);

int OCSP_request_onereq_count(OCSP_REQUEST *req);
OCSP_ONEREQ *OCSP_request_onereq_get0(OCSP_REQUEST *req, int i);

like, look at those signatures. iconic. no notes. 🫶

✨ DESCRIPTION ✨

okay so here's the tea on every single one of these functions, no skips, we are not leaving anyone out:

  • OCSP_REQUEST_new() — allocates and hands you back a shiny empty OCSP_REQUEST structure. blank slate, main character debut. 🦋
  • OCSP_REQUEST_free() — frees up the request structure req. and if the argument is NULL? literally nothing happens, it just vibes. no crash, no drama. 💅
  • OCSP_request_add0_id() — adds the certificate ID cid to req. it returns the OCSP_ONEREQ structure that got added, so your application can go ahead and slap additional extensions onto the request. BUT — and this is the important part bestie — the id parameter MUST NOT be freed up after the operation. do not touch it. it's not yours anymore. 🚫
  • OCSP_request_sign() — signs the OCSP request req using the certificate signer, the private key key, the digest dgst, and additional certificates certs. and if the flags option OCSP_NOCERTS is set, then no certificates will be included in the request. zero. zilch. not a one. 🎀
  • OCSP_request_add1_cert() — adds the certificate cert to the request req. note: the application is responsible for freeing up cert after use. that's on you, girl. you brought it, you clean it up. 🧹
  • OCSP_request_onereq_count() — returns the total number of OCSP_ONEREQ structures in req. it's literally just counting. slay. 🔢
  • OCSP_request_onereq_get0() — returns an internal pointer to the OCSP_ONEREQ contained in req at index i. and the index value i runs from 0 to OCSP_request_onereq_count(req) - 1. off-by-one girls, this one's for you. ⚠️

🔥 RETURN VALUES 🔥

here's what you get back, per function, no surprises:

  • OCSP_REQUEST_new() returns an empty OCSP_REQUEST structure — or NULL if an error occurred. 😭
  • OCSP_request_add0_id() returns the OCSP_ONEREQ structure containing cid — or NULL if an error occurred.
  • OCSP_request_sign() and OCSP_request_add1_cert() return 1 for success and 0 for failure. yes bestie, 1 is good here, we know, C is like that. 💀
  • OCSP_request_onereq_count() returns the total number of OCSP_ONEREQ structures in req — and -1 on error.
  • OCSP_request_onereq_get0() returns a pointer to an OCSP_ONEREQ structure — or NULL if the index value is out of range. (the manpage says "out or range", we're gonna assume it means out of range, love that for us 🙈)

💜 NOTES 💜

  • an OCSP request structure contains one or more OCSP_ONEREQ structures, corresponding to each certificate. one req per cert, cute little squad. 👑
  • OCSP_request_onereq_count() and OCSP_request_onereq_get0() are mainly used by OCSP responders. so if you're not building a responder, these are lowkey background characters for you. iykyk. ✨

🌈 EXAMPLES 🌈

say you wanna create an OCSP_REQUEST structure for certificate cert with issuer issuer. here's the whole glow-up, verbatim:

OCSP_REQUEST *req;
OCSP_ID *cid;

req = OCSP_REQUEST_new();
if (req == NULL)
   /* error */
cid = OCSP_cert_to_id(EVP_sha1(), cert, issuer);
if (cid == NULL)
   /* error */

if (OCSP_REQUEST_add0_id(req, cid) == NULL)
   /* error */

/* Do something with req, e.g. query responder */

OCSP_REQUEST_free(req);

see how cid is never freed separately? that's that add0 contract we talked about. obsessed with consistency. 🫶

🦋 SEE ALSO 🦋

go read these next, bestie, they're all in the group chat:

Copyright 2015-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, bestie!! this was OCSP_REQUEST_NEW(3SSL) from OpenSSL 4.0.3, dated 2026-09-29 — go forth and request your OCSP statuses responsibly 💖✨🎀 no cap, you ate this one. bye!! 💅🌸

📦 where this page comes from