OCSP_RESPONSE_STATUS(3)

📦 version 4.1.0, in opensuse-leap 16.0

✨ NAME ✨

OCSP_RESPONSE_STATUS(3) — okay so this is the Library Functions Manual page for the OCSP response function squad, and honestly it's giving "the whole response-side glow-up" 💅. The full lineup: OCSP_RESPONSE_new, OCSP_RESPONSE_free, OCSP_RESPBYTES_new, OCSP_RESPBYTES_free, OCSP_BASICRESP_new, OCSP_BASICRESP_free, OCSP_RESPDATA_new, OCSP_RESPDATA_free, OCSP_RESPID_new, OCSP_RESPID_free, OCSP_response_create, OCSP_response_status, OCSP_response_status_str, OCSP_response_get1_basic, and OCSP_basic_sign — collectively just OCSP response functions 🦋.

🌸 SYNOPSIS 🌸

#include <openssl/ocsp.h>

OCSP_RESPONSE *
OCSP_RESPONSE_new(void);

void
OCSP_RESPONSE_free(OCSP_RESPONSE *resp);

OCSP_RESPBYTES *
OCSP_RESPBYTES_new(void);

void
OCSP_RESPBYTES_free(OCSP_RESPBYTES *respbytes);

OCSP_BASICRESP *
OCSP_BASICRESP_new(void);

void
OCSP_BASICRESP_free(OCSP_BASICRESP *bs);

OCSP_RESPDATA *
OCSP_RESPDATA_new(void);

void
OCSP_RESPDATA_free(OCSP_RESPDATA *respdata);

OCSP_RESPID *
OCSP_RESPID_new(void);

void
OCSP_RESPID_free(OCSP_RESPID *respid);

OCSP_RESPONSE *
OCSP_response_create(int status, OCSP_BASICRESP *bs);

int
OCSP_response_status(OCSP_RESPONSE *resp);

const char *
OCSP_response_status_str(long code);

OCSP_BASICRESP *
OCSP_response_get1_basic(OCSP_RESPONSE *resp);

int
OCSP_basic_sign(OCSP_BASICRESP *bs, X509 *signer, EVP_PKEY *key,
    const EVP_MD *dgst, STACK_OF(X509) *certs, unsigned long flags);

💖 DESCRIPTION 💖

OK so real talk, every single one of these has a <something>_new() that spins up a fresh empty object and a <something>_free() that yeets it into the void. Here's the whole cast, one by one, because they all have main character energy in their own little way 👑

  • OCSP_RESPONSE_new() allocates and initializes an empty OCSP_RESPONSE object — it's the ASN.1 OCSPResponse structure from RFC 6960, no cap. And OCSP_RESPONSE_free() frees resp 🫶.
  • OCSP_RESPBYTES_new() allocates and initializes an empty OCSP_RESPBYTES object, which reps the ASN.1 ResponseBytes structure from RFC 6960. Little guy lives inside an OCSP_RESPONSE, iykyk. Then OCSP_RESPBYTES_free() frees respbytes.
  • OCSP_BASICRESP_new() allocates and initializes an empty OCSP_BASICRESP object — the ASN.1 BasicOCSPResponse structure from RFC 6960, iconic. Fun fact: OCSP_RESPBYTES literally contains the DER-encoded form of an OCSP_BASICRESP object 🔥. And OCSP_BASICRESP_free() frees bs.
  • OCSP_RESPDATA_new() allocates and initializes an empty OCSP_RESPDATA object, representing the ASN.1 ResponseData structure from RFC 6960. This one hangs out inside OCSP_BASICRESP. OCSP_RESPDATA_free() frees respdata ✨.
  • OCSP_RESPID_new() allocates and initializes an empty OCSP_RESPID object — the ASN.1 ResponderID structure from RFC 6960, and yes it lives inside OCSP_RESPDATA, nesting dolls fr fr 🎀. OCSP_RESPID_free() frees respid.
  • OCSP_response_create() creates an OCSP_RESPONSE object for status, optionally including the basic response bs 💫.
  • OCSP_response_status() returns the OCSP response status of resp. It gives you back one of these besties: OCSP_RESPONSE_STATUS_SUCCESSFUL, OCSP_RESPONSE_STATUS_MALFORMEDREQUEST, OCSP_RESPONSE_STATUS_INTERNALERROR, OCSP_RESPONSE_STATUS_TRYLATER, OCSP_RESPONSE_STATUS_SIGREQUIRED, or OCSP_RESPONSE_STATUS_UNAUTHORIZED 🌈.
  • OCSP_response_status_str() converts one of the status codes that OCSP_response_status() handed you into a string consisting of one word. One word. Very demure, very mindful 🧚.
  • OCSP_response_get1_basic() decodes and returns the OCSP_BASICRESP object contained in resp. Heads up though: it's only called if the status of a response is OCSP_RESPONSE_STATUS_SUCCESSFUL ⭐.
  • OCSP_basic_sign() signs the OCSP response bs using the certificate signer, the private key key, the digest dgst, and the additional certificates certs 🖊️. Two flag behaviors to memorize:
    • If the flags option OCSP_NOCERTS is set, then no certificates will be included in the request.
    • If the flags option OCSP_RESPID_KEY is set, then the responder is identified by key ID rather than by name 👀.

🦋 RETURN VALUES 🦋

Vibe check on what each one hands back to you:

  • OCSP_RESPONSE_new() and OCSP_response_create() return a pointer to an OCSP_RESPONSE object, or NULL if an error occurred 😭.
  • OCSP_BASICRESP_new() and OCSP_response_get1_basic() return a pointer to an OCSP_BASICRESP object, or NULL if an error occurred.
  • OCSP_RESPBYTES_new(), OCSP_RESPDATA_new(), and OCSP_RESPID_new() return a pointer to an empty OCSP_RESPBYTES, OCSP_RESPDATA, or OCSP_RESPID object, respectively, or NULL if an error occurred 💀.
  • OCSP_response_status() returns a status value.
  • OCSP_response_status_str() returns a pointer to a static string 🫶.
  • OCSP_basic_sign() return 1 on success or 0 on failure. (Yes, the grammar in the original is like that. We don't fix, we appreciate 💅.)

👑 SEE ALSO 👑

Go read these next, bestie — they're all connected:

🌺 STANDARDS 🌺

RFC 6960: X.509 Internet Public Key Infrastructure Online Certificate Status Protocol, section 4.2: Response Syntax — that's the receipt, periodt 📜.

🍓 HISTORY 🍓

These functions first appeared in OpenSSL 0.9.7 and have been available since OpenBSD 3.2. Ancient. Legendary. Still slaying 💜.

That's the whole page, no skips, no cuts — every function, every flag, every status code made it in 🎀

And that's a wrap, bestie 🫶 — page brought to you by Debian, dated August 27, 2019, and you already know OCSP_RESPONSE_STATUS(3) ate and left no crumbs 🌟

📦 where this page comes from