Struct OcspRequest 

pub struct OcspRequest<'a> { /* private fields */ }

A complete version-one OCSPRequest with exact original signed bytes.

Implementations

impl<'a> OcspRequest<'a>

pub fn authenticate_signature<'q, 'c, 'cert, V: Verify<E>, E: Work>( &'q self, signer: &'c Certificate<'cert>, key: WorkingKey<'cert>, verifier: &V, execution: &E, ) -> Result<RequestAuthentication<'q, 'a, 'c, 'cert>, RequestSignatureError<V::Error>>

Verify the exact original TBSRequest and bind the actual signer SPKI. RFC6960 §4.1.2 makes signing optional and names mandatory when signed. Requestor-name binding is reported separately: certificate path, key usage, name interpretation and server authorization remain with callers. Included certificates are never automatically selected or trusted. https://www.rfc-editor.org/rfc/rfc6960#section-4.1.2

impl<'a> OcspRequest<'a>

pub fn nonce<W: Work>(&self, execution: &W) -> Result<Option<RequestNonce<'a>>>

Decode the original request-wide nonce with the same RFC9654 kernel as responses. Received legacy sizes 1..128 are readable; generation of new requests must still supply at least 32 strong random octets.

pub fn check_extensions<W: Work>( &self, execution: &W, ) -> Result<ExtensionProcessing<'a>>

Process known request-wide nonce syntax and preserve unknown critical demands. RFC6960 §4.1.2 makes all specific extensions optional; unknown noncritical values remain in the original model, never silently dropped.

pub fn bind_response<'q, 'r, 'response, 'd, D: AsnDigest<'d> + ?Sized, W: Work>( &'q self, response: SignedResponse<'r, 'response>, digest: &'d D, execution: &W, ) -> CallbackResult<BoundResponse<'q, 'a, 'r, 'response>, D::Error>

Bind the complete original batch to an already authenticated response. RFC6960 §3.2 requires actual requested-certificate binding. This query proves neither responder authority nor that a found status is Good. On any execution/provider refusal all partial lookup storage is dropped. https://www.rfc-editor.org/rfc/rfc6960#section-3.2

impl<'a> OcspRequest<'a>

pub fn read(parser: &'a Parser, bytes: &'a [u8], base: u64) -> Result<Self>

Decode one complete request window. No signing, fetching, randomness, default-budget parser or certificate selection is performed.

pub fn read_element(parent: &Reader<'a>, element: &Element<'a>) -> Result<Self>

Decode an embedded request under DER and its actual producing session. RFC6960 §§4/4.1.1–4.1.2 require DER TBS, explicit wrappers, at least one request, and a requestorName when a signature is present. https://www.rfc-editor.org/rfc/rfc6960#section-4.1.1

pub fn as_bytes(&self) -> &'a [u8]

Whole original request DER; no re-encoding or copy.

pub fn signed_bytes(&self) -> &'a [u8]

Exact DER TBSRequest signed by the optional signature, excluding its wrapper.

pub fn signed_span(&self) -> Span

Original whole TBS range.

pub fn span(&self) -> Span

Original whole request range.

pub fn requestor(&self) -> Option<&GeneralName<'a>>

Original optional requestor name; not an authenticated identity by itself.

pub fn requests(&self) -> &[RequestEntry<'a>]

Every original entry in wire order, including duplicate CertIDs.

pub fn extensions(&self) -> &Extensions<'a>

Request-wide extensions, independently of each entry’s extensions.

pub fn signature(&self) -> Option<&RequestSignature<'a>>

Optional original signature; absent never means an authenticated request.

pub fn execution_in<'op, W: Work>(&self, current: &'op W) -> Execution<'op>

where 'a: 'op,

Attach this original request to the current operation without scanning, cloning an account, or discarding either operation’s cumulative ceiling.

Trait Implementations

impl<'a> Debug for OcspRequest<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.