---
name: "libressl-OCSP_cert_to_id"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-OCSP_cert_to_id"
---

# libressl-OCSP\_cert\_to\_id(3)

OCSP certificate ID utility functions

## NAME

**OCSP\_CERTID\_new**, **OCSP\_CERTID\_free**, **OCSP\_cert\_to\_id**, **OCSP\_cert\_id\_new**, **OCSP\_id\_issuer\_cmp**, **OCSP\_id\_cmp**, **OCSP\_id\_get0\_info** – OCSP certificate ID utility functions

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/ocsp.h\>**

*OCSP\_CERTID* *\**\

**OCSP\_CERTID\_new**(*void*);

*void*\

**OCSP\_CERTID\_free**(*OCSP\_CERTID \*id*);

*OCSP\_CERTID* *\**\

**OCSP\_cert\_to\_id**(*const EVP\_MD \*dgst*, *const X509 \*subject*, *const X509 \*issuer*);

*OCSP\_CERTID* *\**\

**OCSP\_cert\_id\_new**(*const EVP\_MD \*dgst*, *const X509\_NAME \*issuerName*, *const ASN1\_BIT\_STRING \*issuerKey*, *const ASN1\_INTEGER \*serialNumber*);

*int*\

**OCSP\_id\_issuer\_cmp**(*OCSP\_CERTID \*a*, *OCSP\_CERTID \*b*);

*int*\

**OCSP\_id\_cmp**(*OCSP\_CERTID \*a*, *OCSP\_CERTID \*b*);

*int*\

**OCSP\_id\_get0\_info**(*ASN1\_OCTET\_STRING \*\*piNameHash*, *ASN1\_OBJECT \*\*pmd*, *ASN1\_OCTET\_STRING \*\*pikeyHash*, *ASN1\_INTEGER \*\*pserial*, *OCSP\_CERTID \*cid*);

## DESCRIPTION

**OCSP\_CERTID\_new**() allocates and initializes an empty *OCSP\_CERTID* object, representing an ASN.1 *CertID* structure defined in RFC 6960. It can store hashes of an issuer's distinguished name and public key together with a serial number of a certificate. It is used by the *OCSP\_ONEREQ* object described in OCSP\_ONEREQ\_new(3) and by the *OCSP\_SINGLERESP* object described in OCSP\_SINGLERESP\_new(3). **OCSP\_CERTID\_free**() frees *id*.

**OCSP\_cert\_to\_id**() creates and returns a new *OCSP\_CERTID* object using message digest *dgst* for certificate *subject* with issuer *issuer*. If *dgst* is NULL then SHA-1 is used.

**OCSP\_cert\_id\_new**() creates and returns a new *OCSP\_CERTID* using *dgst* and issuer name *issuerName*, issuer key hash *issuerKey* and serial number *serialNumber*.

**OCSP\_id\_issuer\_cmp**() compares the hash algorithms, the hashed issuer distinguished names and the hashed public keys of *OCSP\_CERTID* *a* and *b*.

**OCSP\_id\_cmp**() compares *OCSP\_CERTID* *a* and *b* using **OCSP\_id\_issuer\_cmp**() followed by a comparison of the certificate serial numbers with ASN1\_INTEGER\_cmp(3).

**OCSP\_id\_get0\_info**() returns the issuer name hash, hash OID, issuer key hash and serial number contained in *cid*. If any of the values are not required, the corresponding parameter can be set to NULL. The values returned by **OCSP\_id\_get0\_info**() are internal pointers and must not be freed up by an application: they will be freed when the corresponding *OCSP\_CERTID* object is freed.

OCSP clients will typically only use **OCSP\_cert\_to\_id**() or **OCSP\_cert\_id\_new**(): the other functions are used by responder applications.

## RETURN VALUES

**OCSP\_CERTID\_new**(), **OCSP\_cert\_to\_id**(), and **OCSP\_cert\_id\_new**() return either a pointer to a valid *OCSP\_CERTID* object or NULL if an error occurred.

**OCSP\_id\_cmp**() and **OCSP\_id\_issuer\_cmp**() return 0 for a match or non-zero otherwise.

**OCSP\_id\_get0\_info**() returns 1 for success or 0 for failure.

## SEE ALSO

ASN1\_INTEGER\_cmp(3), EVP\_DigestInit(3), OCSP\_request\_add1\_nonce(3), OCSP\_REQUEST\_new(3), OCSP\_resp\_find\_status(3), OCSP\_response\_status(3), OCSP\_sendreq\_new(3), X509\_get\_issuer\_name(3), X509\_NAME\_new(3), X509\_ocspid\_print(3)

## STANDARDS

RFC 6960: X.509 Internet Public Key Infrastructure Online Certificate Status Protocol, section 4: Details of the Protocol

## HISTORY

These functions first appeared in OpenSSL 0.9.7 and have been available since OpenBSD 3.2.