pub struct OcspBasicResp { /* private fields */ }Expand description
The signed inner OCSP response (OCSP_BASICRESP*).
Extracted from an OcspResponse via OcspResponse::basic.
Provides signature verification and per-certificate status lookup.
Implementations§
Source§impl OcspBasicResp
impl OcspBasicResp
Sourcepub fn verify(&self, store: &X509Store, flags: u64) -> Result<bool, ErrorStack>
pub fn verify(&self, store: &X509Store, flags: u64) -> Result<bool, ErrorStack>
Verify the response signature against store.
flags is passed directly to OCSP_basic_verify (use 0 for defaults,
which verifies the signature and checks the signing certificate chain).
Returns Ok(true) if the signature is valid.
§Errors
Sourcepub fn find_status(
&self,
cert_id: &OcspCertId,
) -> Result<Option<OcspSingleStatus>, ErrorStack>
pub fn find_status( &self, cert_id: &OcspCertId, ) -> Result<Option<OcspSingleStatus>, ErrorStack>
Look up the status for a specific certificate by its OcspCertId.
Returns Ok(Some(status)) if the responder included a SingleResponse
for that certificate, Ok(None) if not found, or Err on a fatal
OpenSSL error.
The cert_id is passed by shared reference; its pointer is only used
for the duration of this call (OCSP_resp_find_status does not store it).
§Errors
Sourcepub fn check_validity(
&self,
cert_id: &OcspCertId,
sec: i64,
maxsec: i64,
) -> Result<bool, ErrorStack>
pub fn check_validity( &self, cert_id: &OcspCertId, sec: i64, maxsec: i64, ) -> Result<bool, ErrorStack>
Validate the thisUpdate / nextUpdate window of a SingleResponse.
sec is the acceptable clock-skew in seconds (typically 300).
maxsec limits how far in the future nextUpdate may be (-1 = no limit).