summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--src/lib/libcrypto/man/Makefile8
-rw-r--r--src/lib/libcrypto/man/OCSP_REQUEST_new.3241
-rw-r--r--src/lib/libcrypto/man/OCSP_cert_to_id.3187
-rw-r--r--src/lib/libcrypto/man/OCSP_request_add1_nonce.3160
-rw-r--r--src/lib/libcrypto/man/OCSP_resp_find_status.3285
-rw-r--r--src/lib/libcrypto/man/OCSP_response_status.3134
-rw-r--r--src/lib/libcrypto/man/OCSP_sendreq_new.3245
7 files changed, 1259 insertions, 1 deletions
diff --git a/src/lib/libcrypto/man/Makefile b/src/lib/libcrypto/man/Makefile
index 447c7d23c3..a1cc37cb35 100644
--- a/src/lib/libcrypto/man/Makefile
+++ b/src/lib/libcrypto/man/Makefile
@@ -1,4 +1,4 @@
1# $OpenBSD: Makefile,v 1.55 2016/11/26 18:09:35 schwarze Exp $ 1# $OpenBSD: Makefile,v 1.56 2016/11/27 20:40:07 schwarze Exp $
2 2
3.include <bsd.own.mk> 3.include <bsd.own.mk>
4 4
@@ -122,6 +122,12 @@ MAN= \
122 HMAC.3 \ 122 HMAC.3 \
123 MD5.3 \ 123 MD5.3 \
124 OBJ_nid2obj.3 \ 124 OBJ_nid2obj.3 \
125 OCSP_REQUEST_new.3 \
126 OCSP_cert_to_id.3 \
127 OCSP_request_add1_nonce.3 \
128 OCSP_resp_find_status.3 \
129 OCSP_response_status.3 \
130 OCSP_sendreq_new.3 \
125 OPENSSL_VERSION_NUMBER.3 \ 131 OPENSSL_VERSION_NUMBER.3 \
126 OPENSSL_config.3 \ 132 OPENSSL_config.3 \
127 OPENSSL_load_builtin_modules.3 \ 133 OPENSSL_load_builtin_modules.3 \
diff --git a/src/lib/libcrypto/man/OCSP_REQUEST_new.3 b/src/lib/libcrypto/man/OCSP_REQUEST_new.3
new file mode 100644
index 0000000000..dd08b7c2ca
--- /dev/null
+++ b/src/lib/libcrypto/man/OCSP_REQUEST_new.3
@@ -0,0 +1,241 @@
1.\" $OpenBSD: OCSP_REQUEST_new.3,v 1.1 2016/11/27 20:40:07 schwarze Exp $
2.\" OpenSSL b97fdb57 Nov 11 09:33:09 2016 +0100
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2014, 2016 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: November 27 2016 $
52.Dt OCSP_REQUEST_NEW 3
53.Os
54.Sh NAME
55.Nm OCSP_REQUEST_new ,
56.Nm OCSP_REQUEST_free ,
57.Nm OCSP_request_add0_id ,
58.Nm OCSP_request_sign ,
59.Nm OCSP_request_add1_cert ,
60.Nm OCSP_request_onereq_count ,
61.Nm OCSP_request_onereq_get0 ,
62.Nd OCSP request functions
63.Sh SYNOPSIS
64.In openssl/ocsp.h
65.Ft OCSP_REQUEST *
66.Fn OCSP_REQUEST_new void
67.Ft void
68.Fo OCSP_REQUEST_free
69.Fa "OCSP_REQUEST *req"
70.Fc
71.Ft OCSP_ONEREQ *
72.Fo OCSP_request_add0_id
73.Fa "OCSP_REQUEST *req"
74.Fa "OCSP_CERTID *cid"
75.Fc
76.Ft int
77.Fo OCSP_request_sign
78.Fa "OCSP_REQUEST *req"
79.Fa "X509 *signer"
80.Fa "EVP_PKEY *key"
81.Fa "const EVP_MD *dgst"
82.Fa "STACK_OF(X509) *certs"
83.Fa "unsigned long flags"
84.Fc
85.Ft int
86.Fo OCSP_request_add1_cert
87.Fa "OCSP_REQUEST *req"
88.Fa "X509 *cert"
89.Fc
90.Ft int
91.Fo OCSP_request_onereq_count
92.Fa "OCSP_REQUEST *req"
93.Fc
94.Ft OCSP_ONEREQ *
95.Fo OCSP_request_onereq_get0
96.Fa "OCSP_REQUEST *req"
97.Fa "int i"
98.Fc
99.Sh DESCRIPTION
100.Fn OCSP_REQUEST_new
101allocates and returns an empty
102.Vt OCSP_REQUEST
103structure.
104.Pp
105.Fn OCSP_REQUEST_free
106frees up the request structure
107.Fa req .
108.Pp
109.Fn OCSP_request_add0_id
110adds certificate ID
111.Fa cid
112to
113.Fa req .
114It returns the
115.Vt OCSP_ONEREQ
116structure added so an application can add additional extensions to the
117request.
118The
119.Fa cid
120parameter must not be freed up after the operation.
121.Pp
122.Fn OCSP_request_sign
123signs OCSP request
124.Fa req
125using certificate
126.Fa signer ,
127private key
128.Fa key ,
129digest
130.Fa dgst ,
131and additional certificates
132.Fa certs .
133If the
134.Fa flags
135option
136.Dv OCSP_NOCERTS
137is set, then no certificates will be included in the request.
138.Pp
139.Fn OCSP_request_add1_cert
140adds certificate
141.Fa cert
142to request
143.Fa req .
144The application is responsible for freeing up
145.Fa cert
146after use.
147.Pp
148.Fn OCSP_request_onereq_count
149returns the total number of
150.Vt OCSP_ONEREQ
151structures in
152.Fa req .
153.Pp
154.Fn OCSP_request_onereq_get0
155returns an internal pointer to the
156.Vt OCSP_ONEREQ
157contained in
158.Fa req
159of index
160.Fa i .
161The index value
162.Fa i
163runs from 0 to
164.Fn OCSP_request_onereq_count req No - 1 .
165.Pp
166An
167.Vt OCSP_REQUEST
168structure contains one or more
169.Vt OCSP_ONEREQ
170structures corresponding to each certificate.
171.Pp
172.Fn OCSP_request_onereq_count
173and
174.Fn OCSP_request_onereq_get0
175are mainly used by OCSP responders.
176.Sh RETURN VALUES
177.Fn OCSP_REQUEST_new
178returns an empty
179.Vt OCSP_REQUEST
180structure or
181.Dv NULL
182if an error occurred.
183.Pp
184.Fn OCSP_request_add0_id
185returns the
186.Vt OCSP_ONEREQ
187structure containing
188.Fa cid
189or
190.Dv NULL
191if an error occurred.
192.Pp
193.Fn OCSP_request_sign
194and
195.Fn OCSP_request_add1_cert
196return 1 for success or 0 for failure.
197.Pp
198.Fn OCSP_request_onereq_count
199returns the total number of
200.Vt OCSP_ONEREQ
201structures in
202.Fa req .
203.Pp
204.Fn OCSP_request_onereq_get0
205returns a pointer to an
206.Vt OCSP_ONEREQ
207structure or
208.Dv NULL
209if the index value is out or range.
210.Sh EXAMPLE
211Create an
212.Vt OCSP_REQUEST
213structure for certificate
214.Fa cert
215with issuer
216.Fa issuer :
217.Bd -literal -offset indent
218OCSP_REQUEST *req;
219OCSP_ID *cid;
220
221req = OCSP_REQUEST_new();
222if (req == NULL)
223 /* error */
224cid = OCSP_cert_to_id(EVP_sha1(), cert, issuer);
225if (cid == NULL)
226 /* error */
227
228if (OCSP_REQUEST_add0_id(req, cid) == NULL)
229 /* error */
230
231 /* Do something with req, e.g. query responder */
232
233OCSP_REQUEST_free(req);
234.Ed
235.Sh SEE ALSO
236.Xr crypto 3 ,
237.Xr OCSP_cert_to_id 3 ,
238.Xr OCSP_request_add1_nonce 3 ,
239.Xr OCSP_resp_find_status 3 ,
240.Xr OCSP_response_status 3 ,
241.Xr OCSP_sendreq_new 3
diff --git a/src/lib/libcrypto/man/OCSP_cert_to_id.3 b/src/lib/libcrypto/man/OCSP_cert_to_id.3
new file mode 100644
index 0000000000..6742e45415
--- /dev/null
+++ b/src/lib/libcrypto/man/OCSP_cert_to_id.3
@@ -0,0 +1,187 @@
1.\" $OpenBSD: OCSP_cert_to_id.3,v 1.1 2016/11/27 20:40:07 schwarze Exp $
2.\" OpenSSL b97fdb57 Nov 11 09:33:09 2016 +0100
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2014, 2016 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: November 27 2016 $
52.Dt OCSP_CERT_TO_ID 3
53.Os
54.Sh NAME
55.Nm OCSP_cert_to_id ,
56.Nm OCSP_cert_id_new ,
57.Nm OCSP_CERTID_free ,
58.Nm OCSP_id_issuer_cmp ,
59.Nm OCSP_id_cmp ,
60.Nm OCSP_id_get0_info
61.Nd OCSP certificate ID utility functions
62.Sh SYNOPSIS
63.In openssl/ocsp.h
64.Ft OCSP_CERTID *
65.Fo OCSP_cert_to_id
66.Fa "const EVP_MD *dgst"
67.Fa "X509 *subject"
68.Fa "X509 *issuer"
69.Fc
70.Ft OCSP_CERTID *
71.Fo OCSP_cert_id_new
72.Fa "const EVP_MD *dgst"
73.Fa "X509_NAME *issuerName"
74.Fa "ASN1_BIT_STRING *issuerKey"
75.Fa "ASN1_INTEGER *serialNumber"
76.Fc
77.Ft void
78.Fo OCSP_CERTID_free
79.Fa "OCSP_CERTID *id"
80.Fc
81.Ft int
82.Fo OCSP_id_issuer_cmp
83.Fa "OCSP_CERTID *a"
84.Fa "OCSP_CERTID *b"
85.Fc
86.Ft int
87.Fo OCSP_id_cmp
88.Fa "OCSP_CERTID *a"
89.Fa "OCSP_CERTID *b"
90.Fc
91.Ft int
92.Fo OCSP_id_get0_info
93.Fa "ASN1_OCTET_STRING **piNameHash"
94.Fa "ASN1_OBJECT **pmd"
95.Fa "ASN1_OCTET_STRING **pikeyHash"
96.Fa "ASN1_INTEGER **pserial"
97.Fa "OCSP_CERTID *cid"
98.Fc
99.Sh DESCRIPTION
100.Fn OCSP_cert_to_id
101creates and returns a new
102.Vt OCSP_CERTID
103structure using message digest
104.Fa dgst
105for certificate
106.Fa subject
107with issuer
108.Fa issuer .
109If
110.Fa dgst
111is
112.Dv NULL
113then SHA1 is used.
114.Pp
115.Fn OCSP_cert_id_new
116creates and returns a new
117.Vt OCSP_CERTID
118using
119.Fa dgst
120and issuer name
121.Fa issuerName ,
122issuer key hash
123.Fa issuerKey
124and serial number
125.Fa serialNumber .
126.Pp
127.Fn OCSP_CERTID_free
128frees up
129.Fa id .
130.Pp
131.Fn OCSP_id_cmp
132compares
133.Vt OCSP_CERTID
134.Fa a
135and
136.Fa b .
137.Pp
138.Fn OCSP_id_issuer_cmp
139compares only the issuer name of
140.Vt OCSP_CERTID
141.Fa a
142and
143.Fa b .
144.Pp
145.Fn OCSP_id_get0_info
146returns the issuer name hash, hash OID, issuer key hash and serial
147number contained in
148.Fa cid .
149If any of the values are not required the corresponding parameter can be
150set to
151.Dv NULL .
152The values returned by
153.Fn OCSP_id_get0_info
154are internal pointers and must not be freed up by an application:
155they will be freed when the corresponding
156.Vt OCSP_CERTID
157structure is freed.
158.Pp
159OCSP clients will typically only use
160.Fn OCSP_cert_to_id
161or
162.Fn OCSP_cert_id_new :
163the other functions are used by responder applications.
164.Sh RETURN VALUES
165.Fn OCSP_cert_to_id
166and
167.Fn OCSP_cert_id_new
168return either a pointer to a valid
169.Vt OCSP_CERTID
170structure or
171.Dv NULL
172if an error occurred.
173.Pp
174.Fn OCSP_id_cmp
175and
176.Fn OCSP_id_issuer_cmp
177returns 0 for a match or non-zero otherwise.
178.Pp
179.Fn OCSP_id_get0_info
180returns 1 for success or 0 for failure.
181.Sh SEE ALSO
182.Xr crypto 3 ,
183.Xr OCSP_request_add1_nonce 3 ,
184.Xr OCSP_REQUEST_new 3 ,
185.Xr OCSP_resp_find_status 3 ,
186.Xr OCSP_response_status 3 ,
187.Xr OCSP_sendreq_new 3
diff --git a/src/lib/libcrypto/man/OCSP_request_add1_nonce.3 b/src/lib/libcrypto/man/OCSP_request_add1_nonce.3
new file mode 100644
index 0000000000..8de58d2731
--- /dev/null
+++ b/src/lib/libcrypto/man/OCSP_request_add1_nonce.3
@@ -0,0 +1,160 @@
1.\" $OpenBSD: OCSP_request_add1_nonce.3,v 1.1 2016/11/27 20:40:07 schwarze Exp $
2.\" OpenSSL b97fdb57 Nov 11 09:33:09 2016 +0100
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2014, 2016 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: November 27 2016 $
52.Dt OCSP_REQUEST_ADD1_NONCE 3
53.Os
54.Sh NAME
55.Nm OCSP_request_add1_nonce ,
56.Nm OCSP_basic_add1_nonce ,
57.Nm OCSP_check_nonce ,
58.Nm OCSP_copy_nonce
59.Nd OCSP nonce functions
60.Sh SYNOPSIS
61.In openssl/ocsp.h
62.Ft int
63.Fo OCSP_request_add1_nonce
64.Fa "OCSP_REQUEST *req"
65.Fa "unsigned char *val"
66.Fa "int len"
67.Fc
68.Ft int
69.Fo OCSP_basic_add1_nonce
70.Fa "OCSP_BASICRESP *resp"
71.Fa "unsigned char *val"
72.Fa "int len"
73.Fc
74.Ft int
75.Fo OCSP_copy_nonce
76.Fa "OCSP_BASICRESP *resp"
77.Fa "OCSP_REQUEST *req"
78.Fc
79.Ft int
80.Fo OCSP_check_nonce
81.Fa "OCSP_REQUEST *req"
82.Fa "OCSP_BASICRESP *resp"
83.Fc
84.Sh DESCRIPTION
85An OCSP nonce is typically added to an OCSP request to thwart replay
86attacks by checking the same nonce value appears in the response.
87.Pp
88.Fn OCSP_request_add1_nonce
89adds a nonce of value
90.Fa val
91and length
92.Fa len
93to OCSP request
94.Fa req .
95If
96.Fa val
97is
98.Dv NULL ,
99a random nonce is used.
100If
101.Fa len
102is zero or negative, a default length will be used (currently 16 bytes).
103For most purposes the nonce value in a request is set to a random value
104so the
105.Fa val
106parameter in
107.Fn OCSP_request_add1_nonce
108is usually NULL.
109.Pp
110.Fn OCSP_basic_add1_nonce
111is identical to
112.Fn OCSP_request_add1_nonce
113except it adds a nonce to OCSP basic response
114.Fa resp .
115.Pp
116.Fn OCSP_check_nonce
117compares the nonce value in
118.Fa req
119and
120.Fa resp .
121.Pp
122.Fn OCSP_copy_nonce
123copies any nonce value present in
124.Fa req
125to
126.Fa resp .
127.Pp
128Some responders may include a nonce in all responses even if one is not
129supplied.
130.Pp
131Some responders cache OCSP responses and do not sign each response for
132performance reasons.
133As a result they do not support nonces.
134.Sh RETURN VALUES
135.Fn OCSP_request_add1_nonce
136and
137.Fn OCSP_basic_add1_nonce
138return 1 for success or 0 for failure.
139.Pp
140.Fn OCSP_copy_nonce
141returns 1 if a nonce was successfully copied, 2 if no nonce was
142present in
143.Fa req ,
144or 0 if an error occurred.
145.Pp
146.Fn OCSP_check_nonce
147returns positive values for success: 1 if nonces are present and
148equal, 2 if both nonces are absent, or 3 if a nonce is present in
149the response only.
150A zero return value indicates that both nonces are present but
151mismatch: this should be treated as an error condition.
152A return value of -1 indicates that a nonce is present in the request
153only: this will happen if the responder doesn't support nonces.
154.Sh SEE ALSO
155.Xr crypto 3 ,
156.Xr OCSP_cert_to_id 3 ,
157.Xr OCSP_REQUEST_new 3 ,
158.Xr OCSP_resp_find_status 3 ,
159.Xr OCSP_response_status 3 ,
160.Xr OCSP_sendreq_new 3
diff --git a/src/lib/libcrypto/man/OCSP_resp_find_status.3 b/src/lib/libcrypto/man/OCSP_resp_find_status.3
new file mode 100644
index 0000000000..603b155455
--- /dev/null
+++ b/src/lib/libcrypto/man/OCSP_resp_find_status.3
@@ -0,0 +1,285 @@
1.\" $OpenBSD: OCSP_resp_find_status.3,v 1.1 2016/11/27 20:40:07 schwarze Exp $
2.\" OpenSSL c952780c Jun 21 07:03:34 2016 -0400
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2014 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: November 27 2016 $
52.Dt OCSP_RESP_FIND_STATUS 3
53.Os
54.Sh NAME
55.Nm OCSP_resp_find_status ,
56.Nm OCSP_resp_count ,
57.Nm OCSP_resp_get0 ,
58.Nm OCSP_resp_find ,
59.Nm OCSP_single_get0_status ,
60.Nm OCSP_check_validity
61.Nd OCSP response utility functions
62.Sh SYNOPSIS
63.In openssl/ocsp.h
64.Ft int
65.Fo OCSP_resp_find_status
66.Fa "OCSP_BASICRESP *bs"
67.Fa "OCSP_CERTID *id"
68.Fa "int *status"
69.Fa "int *reason"
70.Fa "ASN1_GENERALIZEDTIME **revtime"
71.Fa "ASN1_GENERALIZEDTIME **thisupd"
72.Fa "ASN1_GENERALIZEDTIME **nextupd"
73.Fc
74.Ft int
75.Fo OCSP_resp_count
76.Fa "OCSP_BASICRESP *bs"
77.Fc
78.Ft OCSP_SINGLERESP *
79.Fo OCSP_resp_get0
80.Fa "OCSP_BASICRESP *bs"
81.Fa "int idx"
82.Fc
83.Ft int
84.Fo OCSP_resp_find
85.Fa "OCSP_BASICRESP *bs"
86.Fa "OCSP_CERTID *id"
87.Fa "int last"
88.Fc
89.Ft int
90.Fo OCSP_single_get0_status
91.Fa "OCSP_SINGLERESP *single"
92.Fa "int *reason"
93.Fa "ASN1_GENERALIZEDTIME **revtime"
94.Fa "ASN1_GENERALIZEDTIME **thisupd"
95.Fa "ASN1_GENERALIZEDTIME **nextupd"
96.Fc
97.Ft int
98.Fo OCSP_check_validity
99.Fa "ASN1_GENERALIZEDTIME *thisupd"
100.Fa "ASN1_GENERALIZEDTIME *nextupd"
101.Fa "long sec"
102.Fa "long maxsec"
103.Fc
104.Sh DESCRIPTION
105.Fn OCSP_resp_find_status
106searches
107.Fa bs
108for an OCSP response for
109.Fa id .
110If it is successful, the fields of the response are returned in
111.Pf * Fa status ,
112.Pf * Fa reason ,
113.Pf * Fa revtime ,
114.Pf * Fa thisupd
115and
116.Pf * Fa nextupd .
117The
118.Pf * Fa status
119value will be one of
120.Dv V_OCSP_CERTSTATUS_GOOD ,
121.Dv V_OCSP_CERTSTATUS_REVOKED ,
122or
123.Dv V_OCSP_CERTSTATUS_UNKNOWN .
124The
125.Pf * Fa reason
126and
127.Pf * Fa revtime
128fields are only set if the status is
129.Dv V_OCSP_CERTSTATUS_REVOKED .
130If set, the
131.Pf * Fa reason
132field will be set to the revocation reason which will be one of
133.Dv OCSP_REVOKED_STATUS_NOSTATUS ,
134.Dv OCSP_REVOKED_STATUS_UNSPECIFIED ,
135.Dv OCSP_REVOKED_STATUS_KEYCOMPROMISE ,
136.Dv OCSP_REVOKED_STATUS_CACOMPROMISE ,
137.Dv OCSP_REVOKED_STATUS_AFFILIATIONCHANGED ,
138.Dv OCSP_REVOKED_STATUS_SUPERSEDED ,
139.Dv OCSP_REVOKED_STATUS_CESSATIONOFOPERATION ,
140.Dv OCSP_REVOKED_STATUS_CERTIFICATEHOLD
141or
142.Dv OCSP_REVOKED_STATUS_REMOVEFROMCRL .
143.Pp
144.Fn OCSP_resp_count
145returns the number of
146.Vt OCSP_SINGLERESP
147structures in
148.Fa bs .
149.Pp
150.Fn OCSP_resp_get0
151returns the
152.Vt OCSP_SINGLERESP
153structure in
154.Fa bs
155corresponding to index
156.Fa idx ,
157where
158.Fa idx
159runs from 0 to
160.Fn OCSP_resp_count bs No - 1 .
161.Pp
162.Fn OCSP_resp_find
163searches
164.Fa bs
165for
166.Fa id
167and returns the index of the first matching entry after
168.Fa last
169or starting from the beginning if
170.Fa last
171is -1.
172.Pp
173.Fn OCSP_single_get0_status
174extracts the fields of
175.Fa single
176in
177.Pf * Fa reason ,
178.Pf * Fa revtime ,
179.Pf * Fa thisupd ,
180and
181.Pf * Fa nextupd .
182.Pp
183.Fn OCSP_check_validity
184checks the validity of
185.Fa thisupd
186and
187.Fa nextupd
188values which will be typically obtained from
189.Fn OCSP_resp_find_status
190or
191.Fn OCSP_single_get0_status .
192If
193.Fa sec
194is non-zero it indicates how many seconds leeway should be allowed in
195the check.
196If
197.Fa maxsec
198is positive it indicates the maximum age of
199.Fa thisupd
200in seconds.
201.Pp
202Applications will typically call
203.Fn OCSP_resp_find_status
204using the certificate ID of interest and then check its validity using
205.Fn OCSP_check_validity .
206They can then take appropriate action based on the status of the
207certificate.
208.Pp
209An OCSP response for a certificate contains
210.Sy thisUpdate
211and
212.Sy nextUpdate
213fields.
214Normally the current time should be between these two values.
215To account for clock skew, the
216.Fa maxsec
217field can be set to non-zero in
218.Fn OCSP_check_validity .
219Some responders do not set the
220.Sy nextUpdate
221field.
222This would otherwise mean an ancient response would be considered
223valid: the
224.Fa maxsec
225parameter to
226.Fn OCSP_check_validity
227can be used to limit the permitted age of responses.
228.Pp
229The values written to
230.Pf * Fa revtime ,
231.Pf * Fa thisupd ,
232and
233.Pf * Fa nextupd
234by
235.Fn OCSP_resp_find_status
236and
237.Fn OCSP_single_get0_status
238are internal pointers which must not be freed up by the calling
239application.
240Any or all of these parameters can be set to
241.Dv NULL
242if their value is not required.
243.Sh RETURN VALUES
244.Fn OCSP_resp_find_status
245returns 1 if
246.Fa id
247is found in
248.Fa bs
249or 0 otherwise.
250.Pp
251.Fn OCSP_resp_count
252returns the total number of
253.Vt OCSP_SINGLERESP
254fields in
255.Fa bs .
256.Pp
257.Fn OCSP_resp_get0
258returns a pointer to an
259.Vt OCSP_SINGLERESP
260structure or
261.Dv NULL
262if
263.Fa idx
264is out of range.
265.Pp
266.Fn OCSP_resp_find
267returns the index of
268.Fa id
269in
270.Fa bs
271(which may be 0) or -1 if
272.Fa id
273was not found.
274.Pp
275.Fn OCSP_single_get0_status
276returns the status of
277.Fa single
278or -1 if an error occurred.
279.Sh SEE ALSO
280.Xr crypto 3 ,
281.Xr OCSP_cert_to_id 3 ,
282.Xr OCSP_request_add1_nonce 3 ,
283.Xr OCSP_REQUEST_new 3 ,
284.Xr OCSP_response_status 3 ,
285.Xr OCSP_sendreq_new 3
diff --git a/src/lib/libcrypto/man/OCSP_response_status.3 b/src/lib/libcrypto/man/OCSP_response_status.3
new file mode 100644
index 0000000000..c6fef0dc2e
--- /dev/null
+++ b/src/lib/libcrypto/man/OCSP_response_status.3
@@ -0,0 +1,134 @@
1.\" $OpenBSD: OCSP_response_status.3,v 1.1 2016/11/27 20:40:07 schwarze Exp $
2.\" OpenSSL bb9ad09e Jun 6 00:43:05 2016 -0400
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2014, 2016 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: November 27 2016 $
52.Dt OCSP_RESPONSE_STATUS 3
53.Os
54.Sh NAME
55.Nm OCSP_response_status ,
56.Nm OCSP_response_get1_basic ,
57.Nm OCSP_response_create ,
58.Nm OCSP_RESPONSE_free
59.Nd OCSP response functions
60.Sh SYNOPSIS
61.In openssl/ocsp.h
62.Ft int
63.Fo OCSP_response_status
64.Fa "OCSP_RESPONSE *resp"
65.Fc
66.Ft OCSP_BASICRESP *
67.Fo OCSP_response_get1_basic
68.Fa "OCSP_RESPONSE *resp"
69.Fc
70.Ft OCSP_RESPONSE *
71.Fo OCSP_response_create
72.Fa "int status"
73.Fa "OCSP_BASICRESP *bs"
74.Fc
75.Ft void
76.Fo OCSP_RESPONSE_free
77.Fa "OCSP_RESPONSE *resp"
78.Fc
79.Sh DESCRIPTION
80.Fn OCSP_response_status
81returns the OCSP response status of
82.Fa resp .
83It returns one of the values:
84.Dv OCSP_RESPONSE_STATUS_SUCCESSFUL ,
85.Dv OCSP_RESPONSE_STATUS_MALFORMEDREQUEST ,
86.Dv OCSP_RESPONSE_STATUS_INTERNALERROR ,
87.Dv OCSP_RESPONSE_STATUS_TRYLATER ,
88.Dv OCSP_RESPONSE_STATUS_SIGREQUIRED ,
89or
90.Dv OCSP_RESPONSE_STATUS_UNAUTHORIZED .
91.Pp
92.Fn OCSP_response_get1_basic
93decodes and returns the
94.Vt OCSP_BASICRESP
95structure contained in
96.Fa resp .
97It is only called if the status of a response is
98.Dv OCSP_RESPONSE_STATUS_SUCCESSFUL .
99.Pp
100.Fn OCSP_response_create
101creates and returns an
102.Vt OCSP_RESPONSE
103structure for
104.Fa status
105and optionally including basic response
106.Fa bs .
107.Pp
108.Fn OCSP_RESPONSE_free
109frees up OCSP response
110.Fa resp .
111.Sh RETURN VALUES
112.Fn OCSP_response_status
113returns a status value.
114.Pp
115.Fn OCSP_response_get1_basic
116returns an
117.Vt OCSP_BASICRESP
118structure pointer or
119.Dv NULL
120if an error occurred.
121.Pp
122.Fn OCSP_response_create
123returns an
124.Vt OCSP_RESPONSE
125structure pointer or
126.Dv NULL
127if an error occurred.
128.Sh SEE ALSO
129.Xr crypto 3 ,
130.Xr OCSP_cert_to_id 3 ,
131.Xr OCSP_request_add1_nonce 3 ,
132.Xr OCSP_REQUEST_new 3 ,
133.Xr OCSP_resp_find_status 3 ,
134.Xr OCSP_sendreq_new 3
diff --git a/src/lib/libcrypto/man/OCSP_sendreq_new.3 b/src/lib/libcrypto/man/OCSP_sendreq_new.3
new file mode 100644
index 0000000000..994ce9cc2a
--- /dev/null
+++ b/src/lib/libcrypto/man/OCSP_sendreq_new.3
@@ -0,0 +1,245 @@
1.\" $OpenBSD: OCSP_sendreq_new.3,v 1.1 2016/11/27 20:40:07 schwarze Exp $
2.\" OpenSSL b97fdb57 Nov 11 09:33:09 2016 +0100
3.\"
4.\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
5.\" Copyright (c) 2014, 2016 The OpenSSL Project. All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
9.\" are met:
10.\"
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\"
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\" notice, this list of conditions and the following disclaimer in
16.\" the documentation and/or other materials provided with the
17.\" distribution.
18.\"
19.\" 3. All advertising materials mentioning features or use of this
20.\" software must display the following acknowledgment:
21.\" "This product includes software developed by the OpenSSL Project
22.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
23.\"
24.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
25.\" endorse or promote products derived from this software without
26.\" prior written permission. For written permission, please contact
27.\" openssl-core@openssl.org.
28.\"
29.\" 5. Products derived from this software may not be called "OpenSSL"
30.\" nor may "OpenSSL" appear in their names without prior written
31.\" permission of the OpenSSL Project.
32.\"
33.\" 6. Redistributions of any form whatsoever must retain the following
34.\" acknowledgment:
35.\" "This product includes software developed by the OpenSSL Project
36.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
37.\"
38.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
39.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
40.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
41.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
42.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
43.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
44.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
46.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
47.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\"
51.Dd $Mdocdate: November 27 2016 $
52.Dt OCSP_SENDREQ_NEW 3
53.Os
54.Sh NAME
55.Nm OCSP_sendreq_new ,
56.Nm OCSP_sendreq_nbio ,
57.Nm OCSP_REQ_CTX_free ,
58.Nm OCSP_REQ_CTX_add1_header ,
59.Nm OCSP_REQ_CTX_set1_req ,
60.Nm OCSP_sendreq_bio
61.Nd OCSP responder query functions
62.Sh SYNOPSIS
63.In openssl/ocsp.h
64.Ft OCSP_REQ_CTX *
65.Fo OCSP_sendreq_new
66.Fa "BIO *io"
67.Fa "const char *path"
68.Fa "OCSP_REQUEST *req"
69.Fa "int maxline"
70.Fc
71.Ft int
72.Fo OCSP_sendreq_nbio
73.Fa "OCSP_RESPONSE **presp"
74.Fa "OCSP_REQ_CTX *rctx"
75.Fc
76.Ft void
77.Fo OCSP_REQ_CTX_free
78.Fa "OCSP_REQ_CTX *rctx"
79.Fc
80.Ft int
81.Fo OCSP_REQ_CTX_add1_header
82.Fa "OCSP_REQ_CTX *rctx"
83.Fa "const char *name"
84.Fa "const char *value"
85.Fc
86.Ft int
87.Fo OCSP_REQ_CTX_set1_req
88.Fa "OCSP_REQ_CTX *rctx"
89.Fa "OCSP_REQUEST *req"
90.Fc
91.Ft OCSP_RESPONSE *
92.Fo OCSP_sendreq_bio
93.Fa "BIO *io"
94.Fa "const char *path"
95.Fa "OCSP_REQUEST *req"
96.Fc
97.Sh DESCRIPTION
98The function
99.Fn OCSP_sendreq_new
100returns an
101.Vt OCSP_REQ_CTX
102structure using the responder
103.Fa io ,
104the URI path
105.Fa path ,
106the OCSP request
107.Fa req
108and with a response header maximum line length of
109.Fa maxline .
110If
111.Fa maxline
112is zero, a default value of 4k is used.
113The OCSP request
114.Fa req
115may be set to
116.Dv NULL
117and provided later if required.
118.Pp
119The arguments to
120.Fn OCSP_sendreq_new
121correspond to the components of the URI.
122For example, if the responder URI is
123.Pa http://ocsp.com/ocspreq ,
124the BIO
125.Fa io
126should be connected to host
127.Pa ocsp.com
128on port 80 and
129.Fa path
130should be set to
131.Qq /ocspreq .
132.Pp
133.Fn OCSP_sendreq_nbio
134performs non-blocking I/O on the OCSP request context
135.Fa rctx .
136When the operation is complete it returns the response in
137.Pf * Fa presp .
138If
139.Fn OCSP_sendreq_nbio
140indicates an operation should be retried, the corresponding BIO can
141be examined to determine which operation (read or write) should be
142retried and appropriate action can be taken, for example a
143.Xr select 3
144call on the underlying socket.
145.Pp
146.Fn OCSP_REQ_CTX_free
147frees up the OCSP context
148.Fa rctx .
149.Pp
150.Fn OCSP_REQ_CTX_add1_header
151adds header
152.Fa name
153with value
154.Fa value
155to the context
156.Fa rctx .
157The added headers are of the form
158.Qq Fa name : value
159or just
160.Qq Fa name
161if
162.Fa value
163is
164.Dv NULL .
165.Fn OCSP_REQ_CTX_add1_header
166can be called more than once to add multiple headers.
167It must be called before any calls to
168.Fn OCSP_sendreq_nbio .
169The
170.Fa req
171parameter in the initial to
172.Fn OCSP_sendreq_new
173call must be set to
174.Dv NULL
175if additional headers are set.
176.Pp
177.Fn OCSP_REQ_CTX_set1_req
178sets the OCSP request in
179.Fa rctx
180to
181.Fa req .
182This function should be called after any calls to
183.Fn OCSP_REQ_CTX_add1_header .
184.Pp
185.Fn OCSP_sendreq_bio
186performs an OCSP request using the responder
187.Fa io ,
188the URI path
189.Fa path ,
190the OCSP request
191.Fa req .
192It does not support retries and so cannot handle non-blocking I/O
193efficiently.
194It is retained for compatibility and its use in new applications
195is not recommended.
196.Sh RETURN VALUES
197.Fn OCSP_sendreq_new
198returns a valid
199.Vt OCSP_REQ_CTX
200structure or
201.Dv NULL
202if an error occurred.
203.Pp
204.Fn OCSP_sendreq_nbio
205returns
206.Sy 1
207if the operation was completed successfully,
208.Sy -1
209if the operation should be retried, or
210.Sy 0
211if an error occurred.
212.Pp
213.Fn OCSP_REQ_CTX_add1_header
214and
215.Fn OCSP_REQ_CTX_set1_req
216return
217.Sy 1
218for success or
219.Sy 0
220for failure.
221.Pp
222.Fn OCSP_sendreq_bio
223returns the
224.Vt OCSP_RESPONSE
225structure sent by the responder or
226.Dv NULL
227if an error occurred.
228.Sh EXAMPLES
229Add a Host header for
230.Pa ocsp.com :
231.Pp
232.Dl OCSP_REQ_CTX_add1_header(ctx, "Host", "ocsp.com");
233.Sh SEE ALSO
234.Xr crypto 3 ,
235.Xr OCSP_cert_to_id 3 ,
236.Xr OCSP_request_add1_nonce 3 ,
237.Xr OCSP_REQUEST_new 3 ,
238.Xr OCSP_resp_find_status 3 ,
239.Xr OCSP_response_status 3
240.Sh CAVEATS
241These functions only perform a minimal HTTP query to a responder.
242If an application wishes to support more advanced features, it
243should use an alternative more complete HTTP library.
244.Pp
245Currently only HTTP POST queries to responders are supported.
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-11-07 12:31:19 +0000