pub struct OcspBasicResp { /* private fields */ }Expand description
The signed inner OCSP response (OCSP_BASICRESP*).
Extracted from an OcspResponse via OcspResponse::basic, or
allocated fresh with OcspBasicResp::new for responder-side use.
Provides signature verification and per-certificate status lookup.
Implementations§
Source§impl OcspBasicResp
impl OcspBasicResp
Sourcepub fn new() -> Result<Self, ErrorStack>
pub fn new() -> Result<Self, ErrorStack>
Allocate a new, empty OCSP_BASICRESP.
Useful on the responder side when building a basic response from scratch.
§Errors
Returns Err if OpenSSL fails to allocate memory.
Sourcepub fn get_response(&self, idx: usize) -> Option<BorrowedOcspSingleResp<'_>>
pub fn get_response(&self, idx: usize) -> Option<BorrowedOcspSingleResp<'_>>
Get the SingleResponse at position idx in this basic response.
Returns None if idx is out of range (>= Self::count).
The returned BorrowedOcspSingleResp is borrowed from self and
must not outlive it.
Sourcepub fn find_response(&self, id: &OcspCertId) -> Option<usize>
pub fn find_response(&self, id: &OcspCertId) -> Option<usize>
Find the index of the first SingleResponse matching id.
Searches from the beginning of the response list. Returns Some(idx)
with the zero-based index of the matching entry, or None if no
matching entry was found.
Use Self::get_response with the returned index to access the entry.
Sourcepub fn verify(&self, store: &X509Store, flags: u64) -> Result<bool, ErrorStack>
pub fn verify(&self, store: &X509Store, flags: u64) -> Result<bool, ErrorStack>
Verify the response signature against store.
flags is passed directly to OCSP_basic_verify (use 0 for defaults,
which verifies the signature and checks the signing certificate chain).
Returns Ok(true) if the signature is valid.
§Errors
Sourcepub fn find_status(
&self,
cert_id: &OcspCertId,
) -> Result<Option<OcspSingleStatus>, ErrorStack>
pub fn find_status( &self, cert_id: &OcspCertId, ) -> Result<Option<OcspSingleStatus>, ErrorStack>
Look up the status for a specific certificate by its OcspCertId.
Returns Ok(Some(status)) if the responder included a SingleResponse
for that certificate, Ok(None) if not found, or Err on a fatal
OpenSSL error.
The cert_id is passed by shared reference; its pointer is only used
for the duration of this call (OCSP_resp_find_status does not store it).
§Errors
Sourcepub fn check_validity(
&self,
cert_id: &OcspCertId,
sec: i64,
maxsec: i64,
) -> Result<bool, ErrorStack>
pub fn check_validity( &self, cert_id: &OcspCertId, sec: i64, maxsec: i64, ) -> Result<bool, ErrorStack>
Validate the thisUpdate / nextUpdate window of a SingleResponse.
sec is the acceptable clock-skew in seconds (typically 300).
maxsec limits how far in the future nextUpdate may be (-1 = no limit).