Struct OcspResponseBuilder

pub struct OcspResponseBuilder { /* private fields */ }

Available on crate feature builder only.

X509 OCSP Response builder

use der::{asn1::ObjectIdentifier, DateTime, Decode};
use x509_cert::Certificate;
use x509_ocsp::builder::OcspResponseBuilder;
use x509_ocsp::{ext::Nonce, CertStatus, OcspGeneralizedTime, OcspRequest, OcspResponse,
    SingleResponse,
};

let req = OcspRequest::from_der(OCSP_REQ_DER).unwrap();
let ca = Certificate::from_der(CA_DER).unwrap();

let mut builder = OcspResponseBuilder::new(ca.tbs_certificate.subject.clone())
    .with_single_response(
        SingleResponse::new(
            req.tbs_request.request_list[0].req_cert.clone(),
            CertStatus::good(),
            OcspGeneralizedTime::from(DateTime::new(2023, 10, 31, 0, 0, 0).unwrap()),
        )
        .with_next_update(OcspGeneralizedTime::from(
            DateTime::new(2024, 1, 1, 0, 0, 0).unwrap()
        )),
    );

if let Some(nonce) = req.nonce() {
    builder = builder.with_extension(nonce).unwrap();
}

#[cfg(feature = "std")]
let now = OcspGeneralizedTime::try_from(std::time::SystemTime::now()).unwrap();

#[cfg(not(feature = "std"))]
let now = OcspGeneralizedTime::from(
    DateTime::new(2023, 11, 1, 0, 0, 0).unwrap()
);

let mut signer = rsa_signer();
let signer_cert_chain = vec![ca.clone()];
let resp = builder
    .sign(&mut signer, Some(signer_cert_chain), now)
    .unwrap();

Implementations

impl OcspResponseBuilder

pub fn new(responder_id: impl Into<ResponderId>) -> Self

Returns a OcspResponseBuilder given the Version, ResponderId, and Produced At values.

pub fn with_single_response(self, single_response: SingleResponse) -> Self

Adds a SingleResponse to the builder as defined in RFC 6960 Section 4.2.1.

pub fn with_extension(self, ext: impl AsExtension) -> Result<Self, Error>

Adds a response extension as specified in RFC 6960 Section 4.4. Errors when the extension encoding fails.

pub fn sign<S, Sig>( self, signer: &mut S, certificate_chain: Option<Vec<Certificate>>, produced_at: OcspGeneralizedTime, ) -> Result<OcspResponse, Error>

where S: Signer<Sig> + DynSignatureAlgorithmIdentifier, Sig: SignatureBitStringEncoding,

Consumes the builder and returns a signed OcspResponse. Errors when the algorithm identifier encoding, message encoding, or signature generation fails.

Per RFC 6960 Section 2.4, the producedAt value must be the time the request was signed.

pub fn sign_with_rng<S, Sig>( self, signer: &mut S, rng: &mut impl CryptoRngCore, certificate_chain: Option<Vec<Certificate>>, produced_at: OcspGeneralizedTime, ) -> Result<OcspResponse, Error>

where S: RandomizedSigner<Sig> + DynSignatureAlgorithmIdentifier, Sig: SignatureBitStringEncoding,

Consumes the builder and returns a signed OcspResponse. Errors when the algorithm identifier encoding, message encoding, or signature generation fails.

Per RFC 6960 Section 2.4, the producedAt value must be the time the request was signed.

Trait Implementations

impl Clone for OcspResponseBuilder

fn clone(&self) -> OcspResponseBuilder

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OcspResponseBuilder

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.