---
name: "libressl-tls_ocsp_process_response"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-tls_ocsp_process_response"
---

# libressl-tls\_ocsp\_process\_response(3)

inspect an OCSP response

## NAME

**tls\_ocsp\_process\_response**, **tls\_peer\_ocsp\_url**, **tls\_peer\_ocsp\_response\_status**, **tls\_peer\_ocsp\_cert\_status**, **tls\_peer\_ocsp\_crl\_reason**, **tls\_peer\_ocsp\_result**, **tls\_peer\_ocsp\_revocation\_time**, **tls\_peer\_ocsp\_this\_update**, **tls\_peer\_ocsp\_next\_update** – inspect an OCSP response

## SYNOPSIS

library “libtls” libssl libcrypto

**#include \<tls.h\>**

*int*\

**tls\_ocsp\_process\_response**(*struct tls \*ctx*, *const unsigned char \*response*, *size\_t size*);

*const* *char* *\**\

**tls\_peer\_ocsp\_url**(*struct tls \*ctx*);

*int*\

**tls\_peer\_ocsp\_response\_status**(*struct tls \*ctx*);

*int*\

**tls\_peer\_ocsp\_cert\_status**(*struct tls \*ctx*);

*int*\

**tls\_peer\_ocsp\_crl\_reason**(*struct tls \*ctx*);

*const* *char* *\**\

**tls\_peer\_ocsp\_result**(*struct tls \*ctx*);

*time\_t*\

**tls\_peer\_ocsp\_revocation\_time**(*struct tls \*ctx*);

*time\_t*\

**tls\_peer\_ocsp\_this\_update**(*struct tls \*ctx*);

*time\_t*\

**tls\_peer\_ocsp\_next\_update**(*struct tls \*ctx*);

## DESCRIPTION

**tls\_ocsp\_process\_response**() processes a raw OCSP response in *response* of size *size* to check the revocation status of the peer certificate from *ctx*. A successful return code of 0 indicates that the certificate has not been revoked.

**tls\_peer\_ocsp\_url**() returns the URL for OCSP validation of the peer certificate from *ctx*.

The following functions return information about the peer certificate from *ctx* that was obtained by validating a stapled OCSP response during the handshake, or via a previous call to **tls\_ocsp\_process\_response**().

**tls\_peer\_ocsp\_response\_status**() returns the OCSP response status as per RFC 6960 section 2.3.

**tls\_peer\_ocsp\_cert\_status**() returns the OCSP certificate status code as per RFC 6960 section 2.2.

**tls\_peer\_ocsp\_crl\_reason**() returns the OCSP certificate revocation reason status code as per RFC 5280 section 5.3.1.

**tls\_peer\_ocsp\_result**() returns a textual representation of the OCSP status code returned by one of the previous three functions. If the OCSP response was valid and the certificate was not revoked, the string indicates the OCSP certificate status. Otherwise, the string indicates the OCSP certificate revocation reason or the OCSP error.

**tls\_peer\_ocsp\_revocation\_time**() returns the OCSP revocation time.

**tls\_peer\_ocsp\_this\_update**() returns the OCSP this update time.

**tls\_peer\_ocsp\_next\_update**() returns the OCSP next update time.

## RETURN VALUES

**tls\_ocsp\_process\_response**() returns 0 on success or -1 on error.

**tls\_peer\_ocsp\_url**() and **tls\_peer\_ocsp\_result**() return NULL on error or an out of memory condition.

The **tls\_peer\_ocsp\_response\_status**() function returns one of TLS\_OCSP\_RESPONSE\_SUCCESSFUL, TLS\_OCSP\_RESPONSE\_MALFORMED, TLS\_OCSP\_RESPONSE\_INTERNALERROR, TLS\_OCSP\_RESPONSE\_TRYLATER, TLS\_OCSP\_RESPONSE\_SIGREQUIRED, or TLS\_OCSP\_RESPONSE\_UNAUTHORIZED on success or -1 on error.

The **tls\_peer\_ocsp\_cert\_status**() function returns one of TLS\_OCSP\_CERT\_GOOD, TLS\_OCSP\_CERT\_REVOKED, or TLS\_OCSP\_CERT\_UNKNOWN on success, and -1 on error.

The **tls\_peer\_ocsp\_crl\_reason**() function returns one of TLS\_CRL\_REASON\_UNSPECIFIED, TLS\_CRL\_REASON\_KEY\_COMPROMISE, TLS\_CRL\_REASON\_CA\_COMPROMISE, TLS\_CRL\_REASON\_AFFILIATION\_CHANGED, TLS\_CRL\_REASON\_SUPERSEDED, TLS\_CRL\_REASON\_CESSATION\_OF\_OPERATION, TLS\_CRL\_REASON\_CERTIFICATE\_HOLD, TLS\_CRL\_REASON\_REMOVE\_FROM\_CRL, TLS\_CRL\_REASON\_PRIVILEGE\_WITHDRAWN, or TLS\_CRL\_REASON\_AA\_COMPROMISE on success or -1 on error.

**tls\_peer\_ocsp\_revocation\_time**(), **tls\_peer\_ocsp\_this\_update**(), and **tls\_peer\_ocsp\_next\_update**() return a time in epoch-seconds on success or -1 on error.

## SEE ALSO

[tls\_client(3)](/tls_client/3.md), [tls\_config\_ocsp\_require\_stapling(3)](/tls_config_ocsp_require_stapling/3.md), [tls\_conn\_version(3)](/tls_conn_version/3.md), [tls\_connect(3)](/tls_connect/3.md), [tls\_handshake(3)](/tls_handshake/3.md), [tls\_init(3)](/tls_init/3.md)

## HISTORY

These functions appeared in OpenBSD 6.1.

## AUTHORS

Bob Beck ⟨*beck@openbsd.org*⟩ Marko Kreen ⟨*markokr@gmail.com*⟩