--- name: "libressl-OCSP_resp_find_status" section: "3" platform: "linux" package: "libressl" version: "4.4.0-1" release: "Arch Linux 2026-11-01" platforms: ["linux"] url: "https://new.carta.tech/libressl-OCSP_resp_find_status" --- # libressl-OCSP\_resp\_find\_status(3) OCSP response utility functions ## NAME **OCSP\_SINGLERESP\_new**, **OCSP\_SINGLERESP\_free**, **OCSP\_CERTSTATUS\_new**, **OCSP\_CERTSTATUS\_free**, **OCSP\_REVOKEDINFO\_new**, **OCSP\_REVOKEDINFO\_free**, **OCSP\_resp\_find\_status**, **OCSP\_cert\_status\_str**, **OCSP\_resp\_count**, **OCSP\_resp\_get0**, **OCSP\_resp\_find**, **OCSP\_SINGLERESP\_get0\_id**, **OCSP\_single\_get0\_status**, **OCSP\_check\_validity**, **OCSP\_basic\_verify** – OCSP response utility functions ## SYNOPSIS Crypto Library (libcrypto, -lcrypto) **#include \** *OCSP\_SINGLERESP* *\**\ **OCSP\_SINGLERESP\_new**(*void*); *void*\ **OCSP\_SINGLERESP\_free**(*OCSP\_SINGLERESP \*single*); *OCSP\_CERTSTATUS* *\**\ **OCSP\_CERTSTATUS\_new**(*void*); *void*\ **OCSP\_CERTSTATUS\_free**(*OCSP\_CERTSTATUS \*certstatus*); *OCSP\_REVOKEDINFO* *\**\ **OCSP\_REVOKEDINFO\_new**(*void*); *void*\ **OCSP\_REVOKEDINFO\_free**(*OCSP\_REVOKEDINFO \*revokedinfo*); *int*\ **OCSP\_resp\_find\_status**(*OCSP\_BASICRESP \*bs*, *OCSP\_CERTID \*id*, *int \*status*, *int \*reason*, *ASN1\_GENERALIZEDTIME \*\*revtime*, *ASN1\_GENERALIZEDTIME \*\*thisupd*, *ASN1\_GENERALIZEDTIME \*\*nextupd*); *const* *char* *\**\ **OCSP\_cert\_status\_str**(*long status*); *int*\ **OCSP\_resp\_count**(*OCSP\_BASICRESP \*bs*); *OCSP\_SINGLERESP* *\**\ **OCSP\_resp\_get0**(*OCSP\_BASICRESP \*bs*, *int idx*); *int*\ **OCSP\_resp\_find**(*OCSP\_BASICRESP \*bs*, *OCSP\_CERTID \*id*, *int last*); *const* *OCSP\_CERTID* *\**\ **OCSP\_SINGLERESP\_get0\_id**(*const OCSP\_SINGLERESP \*single*); *int*\ **OCSP\_single\_get0\_status**(*OCSP\_SINGLERESP \*single*, *int \*reason*, *ASN1\_GENERALIZEDTIME \*\*revtime*, *ASN1\_GENERALIZEDTIME \*\*thisupd*, *ASN1\_GENERALIZEDTIME \*\*nextupd*); *int*\ **OCSP\_check\_validity**(*ASN1\_GENERALIZEDTIME \*thisupd*, *ASN1\_GENERALIZEDTIME \*nextupd*, *long sec*, *long maxsec*); *int*\ **OCSP\_basic\_verify**(*OCSP\_BASICRESP \*bs*, *STACK\_OF(X509) \*certs*, *X509\_STORE \*st*, *unsigned long flags*); ## DESCRIPTION **OCSP\_SINGLERESP\_new**() allocates and initializes an empty *OCSP\_SINGLERESP* object, representing an ASN.1 *SingleResponse* structure defined in RFC 6960. Each such object can store the server's answer regarding the validity of one individual certificate. Such objects are used inside the *OCSP\_RESPDATA* of *OCSP\_BASICRESP* objects, which are described in OCSP\_BASICRESP\_new(3). **OCSP\_SINGLERESP\_free**() frees *single*. **OCSP\_CERTSTATUS\_new**() allocates and initializes an empty *OCSP\_CERTSTATUS* object, representing an ASN.1 *CertStatus* structure defined in RFC 6960. Such an object is used inside *OCSP\_SINGLERESP*. **OCSP\_CERTSTATUS\_free**() frees *certstatus*. **OCSP\_REVOKEDINFO\_new**() allocates and initializes an empty *OCSP\_REVOKEDINFO* object, representing an ASN.1 *RevokedInfo* structure defined in RFC 6960. Such an object is used inside *OCSP\_CERTSTATUS*. **OCSP\_REVOKEDINFO\_free**() frees *revokedinfo*. **OCSP\_resp\_find\_status**() searches *bs* for an OCSP response for *id*. If it is successful, the fields of the response are returned in \**status*, \**reason*, \**revtime*, \**thisupd* and \**nextupd*. The \**status* value will be one of V\_OCSP\_CERTSTATUS\_GOOD, V\_OCSP\_CERTSTATUS\_REVOKED, or V\_OCSP\_CERTSTATUS\_UNKNOWN. The \**reason* and \**revtime* fields are only set if the status is V\_OCSP\_CERTSTATUS\_REVOKED. If set, the \**reason* field will be set to the revocation reason which will be one of OCSP\_REVOKED\_STATUS\_NOSTATUS, OCSP\_REVOKED\_STATUS\_UNSPECIFIED, OCSP\_REVOKED\_STATUS\_KEYCOMPROMISE, OCSP\_REVOKED\_STATUS\_CACOMPROMISE, OCSP\_REVOKED\_STATUS\_AFFILIATIONCHANGED, OCSP\_REVOKED\_STATUS\_SUPERSEDED, OCSP\_REVOKED\_STATUS\_CESSATIONOFOPERATION, OCSP\_REVOKED\_STATUS\_CERTIFICATEHOLD or OCSP\_REVOKED\_STATUS\_REMOVEFROMCRL. **OCSP\_cert\_status\_str**() converts one of the *status* codes retrieved by **OCSP\_resp\_find\_status**() to a string consisting of one word. **OCSP\_resp\_count**() returns the number of *OCSP\_SINGLERESP* structures in *bs*. **OCSP\_resp\_get0**() returns the *OCSP\_SINGLERESP* structure in *bs* corresponding to index *idx*, where *idx* runs from 0 to **OCSP\_resp\_count**(*bs*, *No*, *-*, *1*). **OCSP\_resp\_find**() searches *bs* for *id* and returns the index of the first matching entry after *last* or starting from the beginning if *last* is -1. **OCSP\_single\_get0\_status**() extracts the fields of *single* in \**reason*, \**revtime*, \**thisupd*, and \**nextupd*. **OCSP\_check\_validity**() checks the validity of *thisupd* and *nextupd* values which will be typically obtained from **OCSP\_resp\_find\_status**() or **OCSP\_single\_get0\_status**(). If *sec* is non-zero, it indicates how many seconds leeway should be allowed in the check. If *maxsec* is positive, it indicates the maximum age of *thisupd* in seconds. Applications will typically call **OCSP\_resp\_find\_status**() using the certificate ID of interest and then check its validity using **OCSP\_check\_validity**(). They can then take appropriate action based on the status of the certificate. An OCSP response for a certificate contains **thisUpdate** and **nextUpdate** fields. Normally the current time should be between these two values. To account for clock skew, the *maxsec* field can be set to non-zero in **OCSP\_check\_validity**(). Some responders do not set the **nextUpdate** field. This would otherwise mean an ancient response would be considered valid: the *maxsec* parameter to **OCSP\_check\_validity**() can be used to limit the permitted age of responses. The values written to \**revtime*, \**thisupd*, and \**nextupd* by **OCSP\_resp\_find\_status**() and **OCSP\_single\_get0\_status**() are internal pointers which must not be freed up by the calling application. Any or all of these parameters can be set to NULL if their value is not required. **OCSP\_basic\_verify**() checks that the basic response message *bs* is correctly signed and that the signer certificate can be validated. It takes *st* as the trusted store and *certs* as a set of untrusted intermediate certificates. The function first tries to find the signer certificate of the response in *certs*. It also searches the certificates the responder may have included in *bs* unless the *flags* contain OCSP\_NOINTERN. It fails if the signer certificate cannot be found. Next, the function checks the signature of *bs* and fails on error unless the *flags* contain OCSP\_NOSIGS. Then the function already returns success if the *flags* contain OCSP\_NOVERIFY or if the signer certificate was found in *certs* and the *flags* contain OCSP\_TRUSTOTHER. Otherwise the function continues by validating the signer certificate. To this end, all certificates in *certs* and in *bs* are considered as untrusted certificates for the construction of the validation path for the signer certificate unless the OCSP\_NOCHAIN flag is set. After successful path validation, the function returns success if the OCSP\_NOCHECKS flag is set. Otherwise it verifies that the signer certificate meets the OCSP issuer criteria including potential delegation. If this does not succeed and the *flags* do not contain OCSP\_NOEXPLICIT, the function checks for explicit trust for OCSP signing in the root CA certificate. ## RETURN VALUES **OCSP\_SINGLERESP\_new**(), **OCSP\_CERTSTATUS\_new**(), and **OCSP\_REVOKEDINFO\_new**() return a pointer to an empty *OCSP\_SINGLERESP*, *OCSP\_CERTSTATUS*, or *OCSP\_REVOKEDINFO* object, respectively, or NULL if an error occurred. **OCSP\_resp\_find\_status**() returns 1 if *id* is found in *bs* or 0 otherwise. **OCSP\_cert\_status\_str**() returns a pointer to a static string. **OCSP\_resp\_count**() returns the total number of *OCSP\_SINGLERESP* fields in *bs*. **OCSP\_resp\_get0**() returns a pointer to an *OCSP\_SINGLERESP* structure or NULL if *idx* is out of range. **OCSP\_resp\_find**() returns the index of *id* in *bs* (which may be 0) or -1 if *id* was not found. **OCSP\_SINGLERESP\_get0\_id**() returns an internal pointer to the certificate ID object used by *single*; the returned pointer should not be freed by the caller. **OCSP\_single\_get0\_status**() returns the status of *single* or -1 if an error occurred. **OCSP\_basic\_verify**() returns 1 on success, 0 on error, or -1 on fatal error such as malloc failure. ## SEE ALSO OCSP\_cert\_to\_id(3), OCSP\_CRLID\_new(3), OCSP\_request\_add1\_nonce(3), OCSP\_REQUEST\_new(3), OCSP\_response\_status(3), OCSP\_sendreq\_new(3) ## STANDARDS RFC 6960: X.509 Internet Public Key Infrastructure Online Certificate Status Protocol, section 4.2: Response Syntax ## HISTORY **OCSP\_SINGLERESP\_new**(), **OCSP\_SINGLERESP\_free**(), **OCSP\_CERTSTATUS\_new**(), **OCSP\_CERTSTATUS\_free**(), **OCSP\_REVOKEDINFO\_new**(), **OCSP\_REVOKEDINFO\_free**(), **OCSP\_resp\_find\_status**(), **OCSP\_cert\_status\_str**(), **OCSP\_resp\_count**(), **OCSP\_resp\_get0**(), **OCSP\_resp\_find**(), **OCSP\_single\_get0\_status**(), and **OCSP\_check\_validity**() first appeared in OpenSSL 0.9.7 and have been available since OpenBSD 3.2. **OCSP\_SINGLERESP\_get0\_id**() first appeared in OpenSSL 1.1.0 and has been available since OpenBSD 6.3.