Struct OcspChecker 

pub struct OcspChecker<V> { /* private fields */ }

Available on crate feature ocsp only.

Offline OCSP-based revocation checker.

Parses a pre-fetched DER-encoded OCSP response, verifies its signature against the issuer’s SPKI, checks the validity window of the matching SingleResponse, and reports the certificate’s revocation status.

Feature

Only available when the ocsp feature is enabled.

Limitations (v0.1)

• The OCSP response is re-parsed from DER on every check_revocation call. For chains with multiple certificates validated against the same response, this is O(N) redundant parsing. Tracked for v0.2 (cache the parsed BasicOcspResponse in new).
• Only issuer-signed (direct) OCSP responses are supported. Delegated OCSP responders (responses signed by a separate responder certificate, not by the issuer directly) will fail with Error::OcspSignatureInvalid because the signature is verified against the issuer’s key. This is a v0.1 limitation tracked for v0.2.

• SingleResponse matching uses both serial number and the CertID issuerNameHash/issuerKeyHash fields (RFC 6960 §4.1.1). An OCSP response from a different CA with the same serial number will be rejected by the hash checks.
• The ResponderId field is not verified against the issuer identity.
• If no SingleResponse matches the certificate’s serial number, OcspStatusUnknown is returned (hard-fail).
• RevocationChecker::check_revocation_against_anchor is not overridden. The certificate immediately issued by the trust anchor is not revocation-checked by this type; revocation against the anchor is the responsibility of the path validator (a v0.1 limitation).

Implementations

impl<V: SignatureVerifier> OcspChecker<V>

pub fn new(response_der: impl Into<Vec<u8>>, now_unix: u64, verifier: V) -> Self

Create a new OcspChecker.

• response_der — DER-encoded OCSPResponse (any Into<Vec<u8>>, e.g. Vec<u8> or &[u8])
• now_unix — current time as seconds since the Unix epoch
• verifier — signature verifier used to authenticate the OCSP response

Trait Implementations

impl<V: Clone> Clone for OcspChecker<V>

fn clone(&self) -> OcspChecker<V>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<V: Debug> Debug for OcspChecker<V>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<V: SignatureVerifier> RevocationChecker for OcspChecker<V>

fn check_revocation( &self, cert: &Certificate, issuer: &Certificate, ) -> Result<()>

Check whether cert has been revoked.

fn check_revocation_against_anchor( &self, _cert: &Certificate, _anchor: &TrustAnchor, ) -> Result<()>

Check whether cert (issued directly by a trust anchor) has been revoked.