OSSL_CMP_SRV_CTX_NEW(3SSL)

📦

version 4.0.3 · 13 versions

🌸 OSSL_CMP_SRV_CTX_NEW 💅

okay bestie, this is the OpenSSL manual page for the CMP server side of things — the 3SSL one, no cap. It's about generic functions to set up and control a CMP server, and it's a whole serve. Sit down, hydrate, let's get into it 🫶

✨ NAME ✨

So the whole girlboss squad here is:

OSSL_CMP_SRV_process_request
OSSL_CMP_CTX_server_perform
OSSL_CMP_SRV_CTX_new
OSSL_CMP_SRV_CTX_free
OSSL_CMP_SRV_cert_request_cb_t
OSSL_CMP_SRV_rr_cb_t
OSSL_CMP_SRV_certConf_cb_t
OSSL_CMP_SRV_genm_cb_t
OSSL_CMP_SRV_error_cb_t
OSSL_CMP_SRV_pollReq_cb_t
OSSL_CMP_SRV_CTX_init
OSSL_CMP_SRV_delayed_delivery_cb_t
OSSL_CMP_SRV_clean_transaction_cb_t
OSSL_CMP_SRV_CTX_init_trans
OSSL_CMP_SRV_CTX_get0_cmp_ctx
OSSL_CMP_SRV_CTX_get0_custom_ctx
OSSL_CMP_SRV_CTX_set_send_unprotected_errors
OSSL_CMP_SRV_CTX_set_accept_unprotected
OSSL_CMP_SRV_CTX_set_accept_raverified
OSSL_CMP_SRV_CTX_set_grant_implicit_confirm

and together they're the generic functions to set up and control a CMP server. iconic behavior fr fr 💜

🎀 SYNOPSIS 🎀

#include <openssl/cmp.h>

OSSL_CMP_MSG *OSSL_CMP_SRV_process_request(OSSL_CMP_SRV_CTX *srv_ctx,
                                           const OSSL_CMP_MSG *req);
OSSL_CMP_MSG *OSSL_CMP_CTX_server_perform(OSSL_CMP_CTX *client_ctx,
                                          const OSSL_CMP_MSG *req);
OSSL_CMP_SRV_CTX *OSSL_CMP_SRV_CTX_new(OSSL_LIB_CTX *libctx, const char *propq);
void OSSL_CMP_SRV_CTX_free(OSSL_CMP_SRV_CTX *srv_ctx);

typedef OSSL_CMP_PKISI *(*OSSL_CMP_SRV_cert_request_cb_t)(
                                                OSSL_CMP_SRV_CTX *srv_ctx,
                                                const OSSL_CMP_MSG *req,
                                                int certReqId,
                                                const OSSL_CRMF_MSG *crm,
                                                const X509_REQ *p10,
                                                X509 **certOut,
                                                STACK_OF(X509) **chainOut,
                                                STACK_OF(X509) **caPubs);
typedef OSSL_CMP_PKISI *(*OSSL_CMP_SRV_rr_cb_t)(OSSL_CMP_SRV_CTX *srv_ctx,
                                                const OSSL_CMP_MSG *req,
                                                const X509_NAME *issuer,
                                                const ASN1_INTEGER *serial);
typedef int (*OSSL_CMP_SRV_genm_cb_t)(OSSL_CMP_SRV_CTX *srv_ctx,
                                      const OSSL_CMP_MSG *req,
                                      STACK_OF(OSSL_CMP_ITAV) *in,
                                      STACK_OF(OSSL_CMP_ITAV) **out);
typedef void (*OSSL_CMP_SRV_error_cb_t)(OSSL_CMP_SRV_CTX *srv_ctx,
                                        const OSSL_CMP_MSG *req,
                                        const OSSL_CMP_PKISI *statusInfo,
                                        const ASN1_INTEGER *errorCode,
                                        const OSSL_CMP_PKIFREETEXT *errorDetails);
typedef int (*OSSL_CMP_SRV_certConf_cb_t)(OSSL_CMP_SRV_CTX *srv_ctx,
                                          const OSSL_CMP_MSG *req,
                                          int certReqId,
                                          const ASN1_OCTET_STRING *certHash,
                                          const OSSL_CMP_PKISI *si);
typedef int (*OSSL_CMP_SRV_pollReq_cb_t)(OSSL_CMP_SRV_CTX *srv_ctx,
                                         const OSSL_CMP_MSG *req,
                                         int certReqId,
                                         OSSL_CMP_MSG **certReq,
                                         int64_t *check_after);
int OSSL_CMP_SRV_CTX_init(OSSL_CMP_SRV_CTX *srv_ctx, void *custom_ctx,
                          OSSL_CMP_SRV_cert_request_cb_t process_cert_request,
                          OSSL_CMP_SRV_rr_cb_t process_rr,
                          OSSL_CMP_SRV_genm_cb_t process_genm,
                          OSSL_CMP_SRV_error_cb_t process_error,
                          OSSL_CMP_SRV_certConf_cb_t process_certConf,
                          OSSL_CMP_SRV_pollReq_cb_t process_pollReq);
typedef int (*OSSL_CMP_SRV_delayed_delivery_cb_t)(OSSL_CMP_SRV_CTX *srv_ctx,
                                                  const OSSL_CMP_MSG *req);
typedef int (*OSSL_CMP_SRV_clean_transaction_cb_t)(OSSL_CMP_SRV_CTX *srv_ctx,
                                                   const ASN1_OCTET_STRING *id);
int OSSL_CMP_SRV_CTX_init_trans(OSSL_CMP_SRV_CTX *srv_ctx,
                                OSSL_CMP_SRV_delayed_delivery_cb_t delay,
                                OSSL_CMP_SRV_clean_transaction_cb_t clean);

OSSL_CMP_CTX *OSSL_CMP_SRV_CTX_get0_cmp_ctx(const OSSL_CMP_SRV_CTX *srv_ctx);
void *OSSL_CMP_SRV_CTX_get0_custom_ctx(const OSSL_CMP_SRV_CTX *srv_ctx);

int OSSL_CMP_SRV_CTX_set_send_unprotected_errors(OSSL_CMP_SRV_CTX *srv_ctx,
                                                 int val);
int OSSL_CMP_SRV_CTX_set_accept_unprotected(OSSL_CMP_SRV_CTX *srv_ctx, int val);
int OSSL_CMP_SRV_CTX_set_accept_raverified(OSSL_CMP_SRV_CTX *srv_ctx, int val);
int OSSL_CMP_SRV_CTX_set_grant_implicit_confirm(OSSL_CMP_SRV_CTX *srv_ctx,
                                                int val);

copy that exactly, bestie, don't freestyle the signatures 🙈

💖 DESCRIPTION 💖

the main character: `OSSL_CMP_SRV_process_request()`

She implements the generic core aspects of Certificate Management Protocol (CMP) servers. Her arguments are the OSSL_CMP_SRV_CTX srv_ctx and a CMP request message req. What she does: the typical generic checks on req, then she calls the respective callback function (if present) for the more specific processing, and then she assembles a response message, which may be a CMP error message. she's doing it all, honestly 👑

Since OSSL_CMP_SRV_process_request() handles only a single CMP request message, it may need to be called multiple times until a CMP transaction has ended. So here's the vibe check on that:

If, after the function returns, the expression OSSL_CMP_CTX_get_status(OSSL_CMP_SRV_CTX_get0_cmp_ctx(srv_ctx)) yields -1, then the function has closed the current transaction — and that could be because of a normal successful end of the transaction or because of an error.
Otherwise, you should call it again with the next request message of the same transaction (which can be a certificate confirmation or a poll request message).

⚠️ Do not call this function from multiple threads sharing the same srv_ctx without explicitly serialising the calls. Calling it in parallel leads to undefined behavior — like, genuinely cursed, not the fun kind of cursed 💀

Also real talk: when an earlier call did not yet finish the respective transaction, calling it in an interleaved way with a new request belonging to a different transaction will abort the earlier transaction and begin the new one. messy but that's the rules.

`OSSL_CMP_CTX_server_perform()` 🌈

She's an interface to OSSL_CMP_SRV_process_request() that a CMP client can use in the same way as OSSL_CMP_MSG_http_perform(3). In particular, the first parameter client_ctx is the OSSL_CMP_CTX of the client. And the OSSL_CMP_SRV_CTX must be set as transfer_cb_arg of client_ctx. don't forget that part, it's lowkey important fr 💅

`OSSL_CMP_SRV_CTX_new()` ✨

Creates and initializes an OSSL_CMP_SRV_CTX structure associated with the library context libctx and property query string propq — and both of those may be NULL to select the defaults. no biggie 🎀

`OSSL_CMP_SRV_CTX_free()` 🦋

Deletes the given srv_ctx. If the argument is NULL, nothing is done — she simply does not perceive it 💅

`OSSL_CMP_SRV_CTX_init()` 🌸

Sets in the given srv_ctx a custom server context pointer plus the callback functions that perform the specific processing of:

CMP certificate requests
revocation requests
certificate confirmation requests
general messages
error messages
poll requests

All arguments except srv_ctx may be NULL. And real talk: if a callback for some message type is not given, that means the respective type of CMP message is not supported by the server. periodt.

`OSSL_CMP_SRV_CTX_init_trans()` 🧚

Sets in srv_ctx the optional callback functions for initiating delayed delivery and cleaning up a transaction.

If the <delay> function is NULL then delivery of responses is never delayed. Otherwise delay takes a custom server context and a request message as input. It must return 1 if delivery of the respective response shall be delayed, 0 if not, and -1 on error.
If the <clean> function is NULL then no specific cleanup is performed. Otherwise clean takes a custom server context and a transaction ID pointer as input, where the pointer is NULL in case a new transaction is being started and otherwise provides the ID of the transaction being terminated. The <clean> function should reset the respective portions of the state and free related memory. It must return 1 on success and 0 on error. bestie please return the right thing, the vibes depend on it 🫶

`OSSL_CMP_SRV_CTX_get0_cmp_ctx()` 💜

Returns the OSSL_CMP_CTX from the srv_ctx.

`OSSL_CMP_SRV_CTX_get0_custom_ctx()` 🍓

Returns the custom server context from srv_ctx that has been set using OSSL_CMP_SRV_CTX_init().

`OSSL_CMP_SRV_CTX_set_send_unprotected_errors()` 🔥

Enables sending error messages and other forms of negative responses unprotected.

`OSSL_CMP_SRV_CTX_set_accept_unprotected()` 🌊

Enables acceptance of requests without protection or with invalid protection.

`OSSL_CMP_SRV_CTX_set_accept_raverified()` ⭐

Enables acceptance of ir/cr/kur messages with POPO 'RAVerified'.

`OSSL_CMP_SRV_CTX_set_grant_implicit_confirm()` 👑

Enables granting implicit confirmation of newly enrolled certificates if requested.

🫶 NOTES 🫶

CMP is defined in RFC 9810 (and CRMF in RFC 4211).

Like the OpenSSL CMP client, the CMP server implementation documented here focuses on the Lightweight CMP Profile (RFC 9483). Among other things, this implies that only commonly used CMP message types are supported and that each CMP message may not contain multiple certificate requests or responses. keep it simple, keep it cute 🎀

So far, this server implementation is single-threaded and should not be called in parallel for any given OSSL_CMP_SRV_CTX srv_ctx. It can handle only one CMP transaction at a time — which, of course, is not a problem for transactions consisting of just a single request/response message pair. so if your transaction is a solo act, you're chilling 🌸

💅 RETURN VALUES 💅

OSSL_CMP_SRV_process_request() returns a CMP response message, which may be an error message, or NULL on internal errors that preclude producing a response.
OSSL_CMP_SRV_CTX_new() returns a OSSL_CMP_SRV_CTX structure on success, NULL on error.
OSSL_CMP_SRV_CTX_free() does not return a value.
OSSL_CMP_SRV_CTX_get0_cmp_ctx() returns a OSSL_CMP_CTX structure on success, NULL on error.
OSSL_CMP_SRV_CTX_get0_custom_ctx() returns the custom server context that has been set using OSSL_CMP_SRV_CTX_init().
All other functions return 1 on success, 0 on error.

🌈 HISTORY 🌈

The OpenSSL CMP support was added in OpenSSL 3.0.

OSSL_CMP_SRV_CTX_init_trans() supporting delayed delivery of all types of response messages was added in OpenSSL 3.3. she's newer, she's evolved, we love her growth 💖

🌈 COPYRIGHT 🌈

okay bestie, legal moment, stay with me, it's short and it matters 💖

Licensed under the Apache License 2.0 (the "License"), babes. You may not use this file except in compliance with the License. fr fr, that's the actual rule 💅

You can grab a copy in the file LICENSE in the source distribution, or at <https://www.openssl.org/source/license.html>. ✨

and that's a wrap on this whole page 🎀 ty for reading all the way to the legal disclaimer, that's real main character energy 👑

This one's from OpenSSL 4.0.3, dated 2026-09-29, and it lives under the name OSSL_CMP_SRV_CTX_NEW(3SSL). so you know exactly which version of the lore you're reading 🌸 no cap, always check the version before you trust a vibe 🦋

okay love u, go write some CMP server code 💖✨

📦 where this page comes from

ubuntu stonking: libssl-doc 4.0.3-1ubuntu1 · Apache-2.0
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-11-03: a language model's rewrite of the original, under its terms

OSSL_CMP_SRV_CTX_NEW(3SSL)