1*0Sstevel@tonic-gate /* ocsp.h */ 2*0Sstevel@tonic-gate /* Written by Tom Titchener <Tom_Titchener@groove.net> for the OpenSSL 3*0Sstevel@tonic-gate * project. */ 4*0Sstevel@tonic-gate 5*0Sstevel@tonic-gate /* History: 6*0Sstevel@tonic-gate This file was transfered to Richard Levitte from CertCo by Kathy 7*0Sstevel@tonic-gate Weinhold in mid-spring 2000 to be included in OpenSSL or released 8*0Sstevel@tonic-gate as a patch kit. */ 9*0Sstevel@tonic-gate 10*0Sstevel@tonic-gate /* ==================================================================== 11*0Sstevel@tonic-gate * Copyright (c) 1998-2000 The OpenSSL Project. All rights reserved. 12*0Sstevel@tonic-gate * 13*0Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without 14*0Sstevel@tonic-gate * modification, are permitted provided that the following conditions 15*0Sstevel@tonic-gate * are met: 16*0Sstevel@tonic-gate * 17*0Sstevel@tonic-gate * 1. Redistributions of source code must retain the above copyright 18*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer. 19*0Sstevel@tonic-gate * 20*0Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright 21*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in 22*0Sstevel@tonic-gate * the documentation and/or other materials provided with the 23*0Sstevel@tonic-gate * distribution. 24*0Sstevel@tonic-gate * 25*0Sstevel@tonic-gate * 3. All advertising materials mentioning features or use of this 26*0Sstevel@tonic-gate * software must display the following acknowledgment: 27*0Sstevel@tonic-gate * "This product includes software developed by the OpenSSL Project 28*0Sstevel@tonic-gate * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 29*0Sstevel@tonic-gate * 30*0Sstevel@tonic-gate * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 31*0Sstevel@tonic-gate * endorse or promote products derived from this software without 32*0Sstevel@tonic-gate * prior written permission. For written permission, please contact 33*0Sstevel@tonic-gate * openssl-core@openssl.org. 34*0Sstevel@tonic-gate * 35*0Sstevel@tonic-gate * 5. Products derived from this software may not be called "OpenSSL" 36*0Sstevel@tonic-gate * nor may "OpenSSL" appear in their names without prior written 37*0Sstevel@tonic-gate * permission of the OpenSSL Project. 38*0Sstevel@tonic-gate * 39*0Sstevel@tonic-gate * 6. Redistributions of any form whatsoever must retain the following 40*0Sstevel@tonic-gate * acknowledgment: 41*0Sstevel@tonic-gate * "This product includes software developed by the OpenSSL Project 42*0Sstevel@tonic-gate * for use in the OpenSSL Toolkit (http://www.openssl.org/)" 43*0Sstevel@tonic-gate * 44*0Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 45*0Sstevel@tonic-gate * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 46*0Sstevel@tonic-gate * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 47*0Sstevel@tonic-gate * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 48*0Sstevel@tonic-gate * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 49*0Sstevel@tonic-gate * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 50*0Sstevel@tonic-gate * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 51*0Sstevel@tonic-gate * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 52*0Sstevel@tonic-gate * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 53*0Sstevel@tonic-gate * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 54*0Sstevel@tonic-gate * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 55*0Sstevel@tonic-gate * OF THE POSSIBILITY OF SUCH DAMAGE. 56*0Sstevel@tonic-gate * ==================================================================== 57*0Sstevel@tonic-gate * 58*0Sstevel@tonic-gate * This product includes cryptographic software written by Eric Young 59*0Sstevel@tonic-gate * (eay@cryptsoft.com). This product includes software written by Tim 60*0Sstevel@tonic-gate * Hudson (tjh@cryptsoft.com). 61*0Sstevel@tonic-gate * 62*0Sstevel@tonic-gate */ 63*0Sstevel@tonic-gate 64*0Sstevel@tonic-gate #ifndef HEADER_OCSP_H 65*0Sstevel@tonic-gate #define HEADER_OCSP_H 66*0Sstevel@tonic-gate 67*0Sstevel@tonic-gate #include <openssl/x509.h> 68*0Sstevel@tonic-gate #include <openssl/x509v3.h> 69*0Sstevel@tonic-gate #include <openssl/safestack.h> 70*0Sstevel@tonic-gate 71*0Sstevel@tonic-gate #ifdef __cplusplus 72*0Sstevel@tonic-gate extern "C" { 73*0Sstevel@tonic-gate #endif 74*0Sstevel@tonic-gate 75*0Sstevel@tonic-gate /* Various flags and values */ 76*0Sstevel@tonic-gate 77*0Sstevel@tonic-gate #define OCSP_DEFAULT_NONCE_LENGTH 16 78*0Sstevel@tonic-gate 79*0Sstevel@tonic-gate #define OCSP_NOCERTS 0x1 80*0Sstevel@tonic-gate #define OCSP_NOINTERN 0x2 81*0Sstevel@tonic-gate #define OCSP_NOSIGS 0x4 82*0Sstevel@tonic-gate #define OCSP_NOCHAIN 0x8 83*0Sstevel@tonic-gate #define OCSP_NOVERIFY 0x10 84*0Sstevel@tonic-gate #define OCSP_NOEXPLICIT 0x20 85*0Sstevel@tonic-gate #define OCSP_NOCASIGN 0x40 86*0Sstevel@tonic-gate #define OCSP_NODELEGATED 0x80 87*0Sstevel@tonic-gate #define OCSP_NOCHECKS 0x100 88*0Sstevel@tonic-gate #define OCSP_TRUSTOTHER 0x200 89*0Sstevel@tonic-gate #define OCSP_RESPID_KEY 0x400 90*0Sstevel@tonic-gate #define OCSP_NOTIME 0x800 91*0Sstevel@tonic-gate 92*0Sstevel@tonic-gate /* CertID ::= SEQUENCE { 93*0Sstevel@tonic-gate * hashAlgorithm AlgorithmIdentifier, 94*0Sstevel@tonic-gate * issuerNameHash OCTET STRING, -- Hash of Issuer's DN 95*0Sstevel@tonic-gate * issuerKeyHash OCTET STRING, -- Hash of Issuers public key (excluding the tag & length fields) 96*0Sstevel@tonic-gate * serialNumber CertificateSerialNumber } 97*0Sstevel@tonic-gate */ 98*0Sstevel@tonic-gate typedef struct ocsp_cert_id_st 99*0Sstevel@tonic-gate { 100*0Sstevel@tonic-gate X509_ALGOR *hashAlgorithm; 101*0Sstevel@tonic-gate ASN1_OCTET_STRING *issuerNameHash; 102*0Sstevel@tonic-gate ASN1_OCTET_STRING *issuerKeyHash; 103*0Sstevel@tonic-gate ASN1_INTEGER *serialNumber; 104*0Sstevel@tonic-gate } OCSP_CERTID; 105*0Sstevel@tonic-gate 106*0Sstevel@tonic-gate DECLARE_STACK_OF(OCSP_CERTID) 107*0Sstevel@tonic-gate 108*0Sstevel@tonic-gate /* Request ::= SEQUENCE { 109*0Sstevel@tonic-gate * reqCert CertID, 110*0Sstevel@tonic-gate * singleRequestExtensions [0] EXPLICIT Extensions OPTIONAL } 111*0Sstevel@tonic-gate */ 112*0Sstevel@tonic-gate typedef struct ocsp_one_request_st 113*0Sstevel@tonic-gate { 114*0Sstevel@tonic-gate OCSP_CERTID *reqCert; 115*0Sstevel@tonic-gate STACK_OF(X509_EXTENSION) *singleRequestExtensions; 116*0Sstevel@tonic-gate } OCSP_ONEREQ; 117*0Sstevel@tonic-gate 118*0Sstevel@tonic-gate DECLARE_STACK_OF(OCSP_ONEREQ) 119*0Sstevel@tonic-gate DECLARE_ASN1_SET_OF(OCSP_ONEREQ) 120*0Sstevel@tonic-gate 121*0Sstevel@tonic-gate 122*0Sstevel@tonic-gate /* TBSRequest ::= SEQUENCE { 123*0Sstevel@tonic-gate * version [0] EXPLICIT Version DEFAULT v1, 124*0Sstevel@tonic-gate * requestorName [1] EXPLICIT GeneralName OPTIONAL, 125*0Sstevel@tonic-gate * requestList SEQUENCE OF Request, 126*0Sstevel@tonic-gate * requestExtensions [2] EXPLICIT Extensions OPTIONAL } 127*0Sstevel@tonic-gate */ 128*0Sstevel@tonic-gate typedef struct ocsp_req_info_st 129*0Sstevel@tonic-gate { 130*0Sstevel@tonic-gate ASN1_INTEGER *version; 131*0Sstevel@tonic-gate GENERAL_NAME *requestorName; 132*0Sstevel@tonic-gate STACK_OF(OCSP_ONEREQ) *requestList; 133*0Sstevel@tonic-gate STACK_OF(X509_EXTENSION) *requestExtensions; 134*0Sstevel@tonic-gate } OCSP_REQINFO; 135*0Sstevel@tonic-gate 136*0Sstevel@tonic-gate /* Signature ::= SEQUENCE { 137*0Sstevel@tonic-gate * signatureAlgorithm AlgorithmIdentifier, 138*0Sstevel@tonic-gate * signature BIT STRING, 139*0Sstevel@tonic-gate * certs [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL } 140*0Sstevel@tonic-gate */ 141*0Sstevel@tonic-gate typedef struct ocsp_signature_st 142*0Sstevel@tonic-gate { 143*0Sstevel@tonic-gate X509_ALGOR *signatureAlgorithm; 144*0Sstevel@tonic-gate ASN1_BIT_STRING *signature; 145*0Sstevel@tonic-gate STACK_OF(X509) *certs; 146*0Sstevel@tonic-gate } OCSP_SIGNATURE; 147*0Sstevel@tonic-gate 148*0Sstevel@tonic-gate /* OCSPRequest ::= SEQUENCE { 149*0Sstevel@tonic-gate * tbsRequest TBSRequest, 150*0Sstevel@tonic-gate * optionalSignature [0] EXPLICIT Signature OPTIONAL } 151*0Sstevel@tonic-gate */ 152*0Sstevel@tonic-gate typedef struct ocsp_request_st 153*0Sstevel@tonic-gate { 154*0Sstevel@tonic-gate OCSP_REQINFO *tbsRequest; 155*0Sstevel@tonic-gate OCSP_SIGNATURE *optionalSignature; /* OPTIONAL */ 156*0Sstevel@tonic-gate } OCSP_REQUEST; 157*0Sstevel@tonic-gate 158*0Sstevel@tonic-gate /* OCSPResponseStatus ::= ENUMERATED { 159*0Sstevel@tonic-gate * successful (0), --Response has valid confirmations 160*0Sstevel@tonic-gate * malformedRequest (1), --Illegal confirmation request 161*0Sstevel@tonic-gate * internalError (2), --Internal error in issuer 162*0Sstevel@tonic-gate * tryLater (3), --Try again later 163*0Sstevel@tonic-gate * --(4) is not used 164*0Sstevel@tonic-gate * sigRequired (5), --Must sign the request 165*0Sstevel@tonic-gate * unauthorized (6) --Request unauthorized 166*0Sstevel@tonic-gate * } 167*0Sstevel@tonic-gate */ 168*0Sstevel@tonic-gate #define OCSP_RESPONSE_STATUS_SUCCESSFUL 0 169*0Sstevel@tonic-gate #define OCSP_RESPONSE_STATUS_MALFORMEDREQUEST 1 170*0Sstevel@tonic-gate #define OCSP_RESPONSE_STATUS_INTERNALERROR 2 171*0Sstevel@tonic-gate #define OCSP_RESPONSE_STATUS_TRYLATER 3 172*0Sstevel@tonic-gate #define OCSP_RESPONSE_STATUS_SIGREQUIRED 5 173*0Sstevel@tonic-gate #define OCSP_RESPONSE_STATUS_UNAUTHORIZED 6 174*0Sstevel@tonic-gate 175*0Sstevel@tonic-gate /* ResponseBytes ::= SEQUENCE { 176*0Sstevel@tonic-gate * responseType OBJECT IDENTIFIER, 177*0Sstevel@tonic-gate * response OCTET STRING } 178*0Sstevel@tonic-gate */ 179*0Sstevel@tonic-gate typedef struct ocsp_resp_bytes_st 180*0Sstevel@tonic-gate { 181*0Sstevel@tonic-gate ASN1_OBJECT *responseType; 182*0Sstevel@tonic-gate ASN1_OCTET_STRING *response; 183*0Sstevel@tonic-gate } OCSP_RESPBYTES; 184*0Sstevel@tonic-gate 185*0Sstevel@tonic-gate /* OCSPResponse ::= SEQUENCE { 186*0Sstevel@tonic-gate * responseStatus OCSPResponseStatus, 187*0Sstevel@tonic-gate * responseBytes [0] EXPLICIT ResponseBytes OPTIONAL } 188*0Sstevel@tonic-gate */ 189*0Sstevel@tonic-gate typedef struct ocsp_response_st 190*0Sstevel@tonic-gate { 191*0Sstevel@tonic-gate ASN1_ENUMERATED *responseStatus; 192*0Sstevel@tonic-gate OCSP_RESPBYTES *responseBytes; 193*0Sstevel@tonic-gate } OCSP_RESPONSE; 194*0Sstevel@tonic-gate 195*0Sstevel@tonic-gate /* ResponderID ::= CHOICE { 196*0Sstevel@tonic-gate * byName [1] Name, 197*0Sstevel@tonic-gate * byKey [2] KeyHash } 198*0Sstevel@tonic-gate */ 199*0Sstevel@tonic-gate #define V_OCSP_RESPID_NAME 0 200*0Sstevel@tonic-gate #define V_OCSP_RESPID_KEY 1 201*0Sstevel@tonic-gate typedef struct ocsp_responder_id_st 202*0Sstevel@tonic-gate { 203*0Sstevel@tonic-gate int type; 204*0Sstevel@tonic-gate union { 205*0Sstevel@tonic-gate X509_NAME* byName; 206*0Sstevel@tonic-gate ASN1_OCTET_STRING *byKey; 207*0Sstevel@tonic-gate } value; 208*0Sstevel@tonic-gate } OCSP_RESPID; 209*0Sstevel@tonic-gate /* KeyHash ::= OCTET STRING --SHA-1 hash of responder's public key 210*0Sstevel@tonic-gate * --(excluding the tag and length fields) 211*0Sstevel@tonic-gate */ 212*0Sstevel@tonic-gate 213*0Sstevel@tonic-gate /* RevokedInfo ::= SEQUENCE { 214*0Sstevel@tonic-gate * revocationTime GeneralizedTime, 215*0Sstevel@tonic-gate * revocationReason [0] EXPLICIT CRLReason OPTIONAL } 216*0Sstevel@tonic-gate */ 217*0Sstevel@tonic-gate typedef struct ocsp_revoked_info_st 218*0Sstevel@tonic-gate { 219*0Sstevel@tonic-gate ASN1_GENERALIZEDTIME *revocationTime; 220*0Sstevel@tonic-gate ASN1_ENUMERATED *revocationReason; 221*0Sstevel@tonic-gate } OCSP_REVOKEDINFO; 222*0Sstevel@tonic-gate 223*0Sstevel@tonic-gate /* CertStatus ::= CHOICE { 224*0Sstevel@tonic-gate * good [0] IMPLICIT NULL, 225*0Sstevel@tonic-gate * revoked [1] IMPLICIT RevokedInfo, 226*0Sstevel@tonic-gate * unknown [2] IMPLICIT UnknownInfo } 227*0Sstevel@tonic-gate */ 228*0Sstevel@tonic-gate #define V_OCSP_CERTSTATUS_GOOD 0 229*0Sstevel@tonic-gate #define V_OCSP_CERTSTATUS_REVOKED 1 230*0Sstevel@tonic-gate #define V_OCSP_CERTSTATUS_UNKNOWN 2 231*0Sstevel@tonic-gate typedef struct ocsp_cert_status_st 232*0Sstevel@tonic-gate { 233*0Sstevel@tonic-gate int type; 234*0Sstevel@tonic-gate union { 235*0Sstevel@tonic-gate ASN1_NULL *good; 236*0Sstevel@tonic-gate OCSP_REVOKEDINFO *revoked; 237*0Sstevel@tonic-gate ASN1_NULL *unknown; 238*0Sstevel@tonic-gate } value; 239*0Sstevel@tonic-gate } OCSP_CERTSTATUS; 240*0Sstevel@tonic-gate 241*0Sstevel@tonic-gate /* SingleResponse ::= SEQUENCE { 242*0Sstevel@tonic-gate * certID CertID, 243*0Sstevel@tonic-gate * certStatus CertStatus, 244*0Sstevel@tonic-gate * thisUpdate GeneralizedTime, 245*0Sstevel@tonic-gate * nextUpdate [0] EXPLICIT GeneralizedTime OPTIONAL, 246*0Sstevel@tonic-gate * singleExtensions [1] EXPLICIT Extensions OPTIONAL } 247*0Sstevel@tonic-gate */ 248*0Sstevel@tonic-gate typedef struct ocsp_single_response_st 249*0Sstevel@tonic-gate { 250*0Sstevel@tonic-gate OCSP_CERTID *certId; 251*0Sstevel@tonic-gate OCSP_CERTSTATUS *certStatus; 252*0Sstevel@tonic-gate ASN1_GENERALIZEDTIME *thisUpdate; 253*0Sstevel@tonic-gate ASN1_GENERALIZEDTIME *nextUpdate; 254*0Sstevel@tonic-gate STACK_OF(X509_EXTENSION) *singleExtensions; 255*0Sstevel@tonic-gate } OCSP_SINGLERESP; 256*0Sstevel@tonic-gate 257*0Sstevel@tonic-gate DECLARE_STACK_OF(OCSP_SINGLERESP) 258*0Sstevel@tonic-gate DECLARE_ASN1_SET_OF(OCSP_SINGLERESP) 259*0Sstevel@tonic-gate 260*0Sstevel@tonic-gate /* ResponseData ::= SEQUENCE { 261*0Sstevel@tonic-gate * version [0] EXPLICIT Version DEFAULT v1, 262*0Sstevel@tonic-gate * responderID ResponderID, 263*0Sstevel@tonic-gate * producedAt GeneralizedTime, 264*0Sstevel@tonic-gate * responses SEQUENCE OF SingleResponse, 265*0Sstevel@tonic-gate * responseExtensions [1] EXPLICIT Extensions OPTIONAL } 266*0Sstevel@tonic-gate */ 267*0Sstevel@tonic-gate typedef struct ocsp_response_data_st 268*0Sstevel@tonic-gate { 269*0Sstevel@tonic-gate ASN1_INTEGER *version; 270*0Sstevel@tonic-gate OCSP_RESPID *responderId; 271*0Sstevel@tonic-gate ASN1_GENERALIZEDTIME *producedAt; 272*0Sstevel@tonic-gate STACK_OF(OCSP_SINGLERESP) *responses; 273*0Sstevel@tonic-gate STACK_OF(X509_EXTENSION) *responseExtensions; 274*0Sstevel@tonic-gate } OCSP_RESPDATA; 275*0Sstevel@tonic-gate 276*0Sstevel@tonic-gate /* BasicOCSPResponse ::= SEQUENCE { 277*0Sstevel@tonic-gate * tbsResponseData ResponseData, 278*0Sstevel@tonic-gate * signatureAlgorithm AlgorithmIdentifier, 279*0Sstevel@tonic-gate * signature BIT STRING, 280*0Sstevel@tonic-gate * certs [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL } 281*0Sstevel@tonic-gate */ 282*0Sstevel@tonic-gate /* Note 1: 283*0Sstevel@tonic-gate The value for "signature" is specified in the OCSP rfc2560 as follows: 284*0Sstevel@tonic-gate "The value for the signature SHALL be computed on the hash of the DER 285*0Sstevel@tonic-gate encoding ResponseData." This means that you must hash the DER-encoded 286*0Sstevel@tonic-gate tbsResponseData, and then run it through a crypto-signing function, which 287*0Sstevel@tonic-gate will (at least w/RSA) do a hash-'n'-private-encrypt operation. This seems 288*0Sstevel@tonic-gate a bit odd, but that's the spec. Also note that the data structures do not 289*0Sstevel@tonic-gate leave anywhere to independently specify the algorithm used for the initial 290*0Sstevel@tonic-gate hash. So, we look at the signature-specification algorithm, and try to do 291*0Sstevel@tonic-gate something intelligent. -- Kathy Weinhold, CertCo */ 292*0Sstevel@tonic-gate /* Note 2: 293*0Sstevel@tonic-gate It seems that the mentioned passage from RFC 2560 (section 4.2.1) is open 294*0Sstevel@tonic-gate for interpretation. I've done tests against another responder, and found 295*0Sstevel@tonic-gate that it doesn't do the double hashing that the RFC seems to say one 296*0Sstevel@tonic-gate should. Therefore, all relevant functions take a flag saying which 297*0Sstevel@tonic-gate variant should be used. -- Richard Levitte, OpenSSL team and CeloCom */ 298*0Sstevel@tonic-gate typedef struct ocsp_basic_response_st 299*0Sstevel@tonic-gate { 300*0Sstevel@tonic-gate OCSP_RESPDATA *tbsResponseData; 301*0Sstevel@tonic-gate X509_ALGOR *signatureAlgorithm; 302*0Sstevel@tonic-gate ASN1_BIT_STRING *signature; 303*0Sstevel@tonic-gate STACK_OF(X509) *certs; 304*0Sstevel@tonic-gate } OCSP_BASICRESP; 305*0Sstevel@tonic-gate 306*0Sstevel@tonic-gate /* 307*0Sstevel@tonic-gate * CRLReason ::= ENUMERATED { 308*0Sstevel@tonic-gate * unspecified (0), 309*0Sstevel@tonic-gate * keyCompromise (1), 310*0Sstevel@tonic-gate * cACompromise (2), 311*0Sstevel@tonic-gate * affiliationChanged (3), 312*0Sstevel@tonic-gate * superseded (4), 313*0Sstevel@tonic-gate * cessationOfOperation (5), 314*0Sstevel@tonic-gate * certificateHold (6), 315*0Sstevel@tonic-gate * removeFromCRL (8) } 316*0Sstevel@tonic-gate */ 317*0Sstevel@tonic-gate #define OCSP_REVOKED_STATUS_NOSTATUS -1 318*0Sstevel@tonic-gate #define OCSP_REVOKED_STATUS_UNSPECIFIED 0 319*0Sstevel@tonic-gate #define OCSP_REVOKED_STATUS_KEYCOMPROMISE 1 320*0Sstevel@tonic-gate #define OCSP_REVOKED_STATUS_CACOMPROMISE 2 321*0Sstevel@tonic-gate #define OCSP_REVOKED_STATUS_AFFILIATIONCHANGED 3 322*0Sstevel@tonic-gate #define OCSP_REVOKED_STATUS_SUPERSEDED 4 323*0Sstevel@tonic-gate #define OCSP_REVOKED_STATUS_CESSATIONOFOPERATION 5 324*0Sstevel@tonic-gate #define OCSP_REVOKED_STATUS_CERTIFICATEHOLD 6 325*0Sstevel@tonic-gate #define OCSP_REVOKED_STATUS_REMOVEFROMCRL 8 326*0Sstevel@tonic-gate 327*0Sstevel@tonic-gate /* CrlID ::= SEQUENCE { 328*0Sstevel@tonic-gate * crlUrl [0] EXPLICIT IA5String OPTIONAL, 329*0Sstevel@tonic-gate * crlNum [1] EXPLICIT INTEGER OPTIONAL, 330*0Sstevel@tonic-gate * crlTime [2] EXPLICIT GeneralizedTime OPTIONAL } 331*0Sstevel@tonic-gate */ 332*0Sstevel@tonic-gate typedef struct ocsp_crl_id_st 333*0Sstevel@tonic-gate { 334*0Sstevel@tonic-gate ASN1_IA5STRING *crlUrl; 335*0Sstevel@tonic-gate ASN1_INTEGER *crlNum; 336*0Sstevel@tonic-gate ASN1_GENERALIZEDTIME *crlTime; 337*0Sstevel@tonic-gate } OCSP_CRLID; 338*0Sstevel@tonic-gate 339*0Sstevel@tonic-gate /* ServiceLocator ::= SEQUENCE { 340*0Sstevel@tonic-gate * issuer Name, 341*0Sstevel@tonic-gate * locator AuthorityInfoAccessSyntax OPTIONAL } 342*0Sstevel@tonic-gate */ 343*0Sstevel@tonic-gate typedef struct ocsp_service_locator_st 344*0Sstevel@tonic-gate { 345*0Sstevel@tonic-gate X509_NAME* issuer; 346*0Sstevel@tonic-gate STACK_OF(ACCESS_DESCRIPTION) *locator; 347*0Sstevel@tonic-gate } OCSP_SERVICELOC; 348*0Sstevel@tonic-gate 349*0Sstevel@tonic-gate #define PEM_STRING_OCSP_REQUEST "OCSP REQUEST" 350*0Sstevel@tonic-gate #define PEM_STRING_OCSP_RESPONSE "OCSP RESPONSE" 351*0Sstevel@tonic-gate 352*0Sstevel@tonic-gate #define d2i_OCSP_REQUEST_bio(bp,p) (OCSP_REQUEST*)ASN1_d2i_bio((char*(*)()) \ 353*0Sstevel@tonic-gate OCSP_REQUEST_new,(char *(*)())d2i_OCSP_REQUEST, (bp),\ 354*0Sstevel@tonic-gate (unsigned char **)(p)) 355*0Sstevel@tonic-gate 356*0Sstevel@tonic-gate #define d2i_OCSP_RESPONSE_bio(bp,p) (OCSP_RESPONSE*)ASN1_d2i_bio((char*(*)())\ 357*0Sstevel@tonic-gate OCSP_REQUEST_new,(char *(*)())d2i_OCSP_RESPONSE, (bp),\ 358*0Sstevel@tonic-gate (unsigned char **)(p)) 359*0Sstevel@tonic-gate 360*0Sstevel@tonic-gate #define PEM_read_bio_OCSP_REQUEST(bp,x,cb) (OCSP_REQUEST *)PEM_ASN1_read_bio( \ 361*0Sstevel@tonic-gate (char *(*)())d2i_OCSP_REQUEST,PEM_STRING_OCSP_REQUEST,bp,(char **)x,cb,NULL) 362*0Sstevel@tonic-gate 363*0Sstevel@tonic-gate #define PEM_read_bio_OCSP_RESPONSE(bp,x,cb)(OCSP_RESPONSE *)PEM_ASN1_read_bio(\ 364*0Sstevel@tonic-gate (char *(*)())d2i_OCSP_RESPONSE,PEM_STRING_OCSP_RESPONSE,bp,(char **)x,cb,NULL) 365*0Sstevel@tonic-gate 366*0Sstevel@tonic-gate #define PEM_write_bio_OCSP_REQUEST(bp,o) \ 367*0Sstevel@tonic-gate PEM_ASN1_write_bio((int (*)())i2d_OCSP_REQUEST,PEM_STRING_OCSP_REQUEST,\ 368*0Sstevel@tonic-gate bp,(char *)o, NULL,NULL,0,NULL,NULL) 369*0Sstevel@tonic-gate 370*0Sstevel@tonic-gate #define PEM_write_bio_OCSP_RESPONSE(bp,o) \ 371*0Sstevel@tonic-gate PEM_ASN1_write_bio((int (*)())i2d_OCSP_RESPONSE,PEM_STRING_OCSP_RESPONSE,\ 372*0Sstevel@tonic-gate bp,(char *)o, NULL,NULL,0,NULL,NULL) 373*0Sstevel@tonic-gate 374*0Sstevel@tonic-gate #define i2d_OCSP_RESPONSE_bio(bp,o) ASN1_i2d_bio(i2d_OCSP_RESPONSE,bp,\ 375*0Sstevel@tonic-gate (unsigned char *)o) 376*0Sstevel@tonic-gate 377*0Sstevel@tonic-gate #define i2d_OCSP_REQUEST_bio(bp,o) ASN1_i2d_bio(i2d_OCSP_REQUEST,bp,\ 378*0Sstevel@tonic-gate (unsigned char *)o) 379*0Sstevel@tonic-gate 380*0Sstevel@tonic-gate #define OCSP_REQUEST_sign(o,pkey,md) \ 381*0Sstevel@tonic-gate ASN1_item_sign(ASN1_ITEM_rptr(OCSP_REQINFO),\ 382*0Sstevel@tonic-gate o->optionalSignature->signatureAlgorithm,NULL,\ 383*0Sstevel@tonic-gate o->optionalSignature->signature,o->tbsRequest,pkey,md) 384*0Sstevel@tonic-gate 385*0Sstevel@tonic-gate #define OCSP_BASICRESP_sign(o,pkey,md,d) \ 386*0Sstevel@tonic-gate ASN1_item_sign(ASN1_ITEM_rptr(OCSP_RESPDATA),o->signatureAlgorithm,NULL,\ 387*0Sstevel@tonic-gate o->signature,o->tbsResponseData,pkey,md) 388*0Sstevel@tonic-gate 389*0Sstevel@tonic-gate #define OCSP_REQUEST_verify(a,r) ASN1_item_verify(ASN1_ITEM_rptr(OCSP_REQINFO),\ 390*0Sstevel@tonic-gate a->optionalSignature->signatureAlgorithm,\ 391*0Sstevel@tonic-gate a->optionalSignature->signature,a->tbsRequest,r) 392*0Sstevel@tonic-gate 393*0Sstevel@tonic-gate #define OCSP_BASICRESP_verify(a,r,d) ASN1_item_verify(ASN1_ITEM_rptr(OCSP_RESPDATA),\ 394*0Sstevel@tonic-gate a->signatureAlgorithm,a->signature,a->tbsResponseData,r) 395*0Sstevel@tonic-gate 396*0Sstevel@tonic-gate #define ASN1_BIT_STRING_digest(data,type,md,len) \ 397*0Sstevel@tonic-gate ASN1_item_digest(ASN1_ITEM_rptr(ASN1_BIT_STRING),type,data,md,len) 398*0Sstevel@tonic-gate 399*0Sstevel@tonic-gate #define OCSP_CERTID_dup(cid) (OCSP_CERTID*)ASN1_dup((int(*)())i2d_OCSP_CERTID,\ 400*0Sstevel@tonic-gate (char *(*)())d2i_OCSP_CERTID,(char *)(cid)) 401*0Sstevel@tonic-gate 402*0Sstevel@tonic-gate #define OCSP_CERTSTATUS_dup(cs)\ 403*0Sstevel@tonic-gate (OCSP_CERTSTATUS*)ASN1_dup((int(*)())i2d_OCSP_CERTSTATUS,\ 404*0Sstevel@tonic-gate (char *(*)())d2i_OCSP_CERTSTATUS,(char *)(cs)) 405*0Sstevel@tonic-gate 406*0Sstevel@tonic-gate OCSP_RESPONSE *OCSP_sendreq_bio(BIO *b, char *path, OCSP_REQUEST *req); 407*0Sstevel@tonic-gate 408*0Sstevel@tonic-gate OCSP_CERTID *OCSP_cert_to_id(const EVP_MD *dgst, X509 *subject, X509 *issuer); 409*0Sstevel@tonic-gate 410*0Sstevel@tonic-gate OCSP_CERTID *OCSP_cert_id_new(const EVP_MD *dgst, 411*0Sstevel@tonic-gate X509_NAME *issuerName, 412*0Sstevel@tonic-gate ASN1_BIT_STRING* issuerKey, 413*0Sstevel@tonic-gate ASN1_INTEGER *serialNumber); 414*0Sstevel@tonic-gate 415*0Sstevel@tonic-gate OCSP_ONEREQ *OCSP_request_add0_id(OCSP_REQUEST *req, OCSP_CERTID *cid); 416*0Sstevel@tonic-gate 417*0Sstevel@tonic-gate int OCSP_request_add1_nonce(OCSP_REQUEST *req, unsigned char *val, int len); 418*0Sstevel@tonic-gate int OCSP_basic_add1_nonce(OCSP_BASICRESP *resp, unsigned char *val, int len); 419*0Sstevel@tonic-gate int OCSP_check_nonce(OCSP_REQUEST *req, OCSP_BASICRESP *bs); 420*0Sstevel@tonic-gate int OCSP_copy_nonce(OCSP_BASICRESP *resp, OCSP_REQUEST *req); 421*0Sstevel@tonic-gate 422*0Sstevel@tonic-gate int OCSP_request_set1_name(OCSP_REQUEST *req, X509_NAME *nm); 423*0Sstevel@tonic-gate int OCSP_request_add1_cert(OCSP_REQUEST *req, X509 *cert); 424*0Sstevel@tonic-gate 425*0Sstevel@tonic-gate int OCSP_request_sign(OCSP_REQUEST *req, 426*0Sstevel@tonic-gate X509 *signer, 427*0Sstevel@tonic-gate EVP_PKEY *key, 428*0Sstevel@tonic-gate const EVP_MD *dgst, 429*0Sstevel@tonic-gate STACK_OF(X509) *certs, 430*0Sstevel@tonic-gate unsigned long flags); 431*0Sstevel@tonic-gate 432*0Sstevel@tonic-gate int OCSP_response_status(OCSP_RESPONSE *resp); 433*0Sstevel@tonic-gate OCSP_BASICRESP *OCSP_response_get1_basic(OCSP_RESPONSE *resp); 434*0Sstevel@tonic-gate 435*0Sstevel@tonic-gate int OCSP_resp_count(OCSP_BASICRESP *bs); 436*0Sstevel@tonic-gate OCSP_SINGLERESP *OCSP_resp_get0(OCSP_BASICRESP *bs, int idx); 437*0Sstevel@tonic-gate int OCSP_resp_find(OCSP_BASICRESP *bs, OCSP_CERTID *id, int last); 438*0Sstevel@tonic-gate int OCSP_single_get0_status(OCSP_SINGLERESP *single, int *reason, 439*0Sstevel@tonic-gate ASN1_GENERALIZEDTIME **revtime, 440*0Sstevel@tonic-gate ASN1_GENERALIZEDTIME **thisupd, 441*0Sstevel@tonic-gate ASN1_GENERALIZEDTIME **nextupd); 442*0Sstevel@tonic-gate int OCSP_resp_find_status(OCSP_BASICRESP *bs, OCSP_CERTID *id, int *status, 443*0Sstevel@tonic-gate int *reason, 444*0Sstevel@tonic-gate ASN1_GENERALIZEDTIME **revtime, 445*0Sstevel@tonic-gate ASN1_GENERALIZEDTIME **thisupd, 446*0Sstevel@tonic-gate ASN1_GENERALIZEDTIME **nextupd); 447*0Sstevel@tonic-gate int OCSP_check_validity(ASN1_GENERALIZEDTIME *thisupd, 448*0Sstevel@tonic-gate ASN1_GENERALIZEDTIME *nextupd, 449*0Sstevel@tonic-gate long sec, long maxsec); 450*0Sstevel@tonic-gate 451*0Sstevel@tonic-gate int OCSP_request_verify(OCSP_REQUEST *req, STACK_OF(X509) *certs, X509_STORE *store, unsigned long flags); 452*0Sstevel@tonic-gate 453*0Sstevel@tonic-gate int OCSP_parse_url(char *url, char **phost, char **pport, char **ppath, int *pssl); 454*0Sstevel@tonic-gate 455*0Sstevel@tonic-gate int OCSP_id_issuer_cmp(OCSP_CERTID *a, OCSP_CERTID *b); 456*0Sstevel@tonic-gate int OCSP_id_cmp(OCSP_CERTID *a, OCSP_CERTID *b); 457*0Sstevel@tonic-gate 458*0Sstevel@tonic-gate int OCSP_request_onereq_count(OCSP_REQUEST *req); 459*0Sstevel@tonic-gate OCSP_ONEREQ *OCSP_request_onereq_get0(OCSP_REQUEST *req, int i); 460*0Sstevel@tonic-gate OCSP_CERTID *OCSP_onereq_get0_id(OCSP_ONEREQ *one); 461*0Sstevel@tonic-gate int OCSP_id_get0_info(ASN1_OCTET_STRING **piNameHash, ASN1_OBJECT **pmd, 462*0Sstevel@tonic-gate ASN1_OCTET_STRING **pikeyHash, 463*0Sstevel@tonic-gate ASN1_INTEGER **pserial, OCSP_CERTID *cid); 464*0Sstevel@tonic-gate int OCSP_request_is_signed(OCSP_REQUEST *req); 465*0Sstevel@tonic-gate OCSP_RESPONSE *OCSP_response_create(int status, OCSP_BASICRESP *bs); 466*0Sstevel@tonic-gate OCSP_SINGLERESP *OCSP_basic_add1_status(OCSP_BASICRESP *rsp, 467*0Sstevel@tonic-gate OCSP_CERTID *cid, 468*0Sstevel@tonic-gate int status, int reason, 469*0Sstevel@tonic-gate ASN1_TIME *revtime, 470*0Sstevel@tonic-gate ASN1_TIME *thisupd, ASN1_TIME *nextupd); 471*0Sstevel@tonic-gate int OCSP_basic_add1_cert(OCSP_BASICRESP *resp, X509 *cert); 472*0Sstevel@tonic-gate int OCSP_basic_sign(OCSP_BASICRESP *brsp, 473*0Sstevel@tonic-gate X509 *signer, EVP_PKEY *key, const EVP_MD *dgst, 474*0Sstevel@tonic-gate STACK_OF(X509) *certs, unsigned long flags); 475*0Sstevel@tonic-gate 476*0Sstevel@tonic-gate ASN1_STRING *ASN1_STRING_encode(ASN1_STRING *s, int (*i2d)(), 477*0Sstevel@tonic-gate char *data, STACK_OF(ASN1_OBJECT) *sk); 478*0Sstevel@tonic-gate 479*0Sstevel@tonic-gate X509_EXTENSION *OCSP_crlID_new(char *url, long *n, char *tim); 480*0Sstevel@tonic-gate 481*0Sstevel@tonic-gate X509_EXTENSION *OCSP_accept_responses_new(char **oids); 482*0Sstevel@tonic-gate 483*0Sstevel@tonic-gate X509_EXTENSION *OCSP_archive_cutoff_new(char* tim); 484*0Sstevel@tonic-gate 485*0Sstevel@tonic-gate X509_EXTENSION *OCSP_url_svcloc_new(X509_NAME* issuer, char **urls); 486*0Sstevel@tonic-gate 487*0Sstevel@tonic-gate int OCSP_REQUEST_get_ext_count(OCSP_REQUEST *x); 488*0Sstevel@tonic-gate int OCSP_REQUEST_get_ext_by_NID(OCSP_REQUEST *x, int nid, int lastpos); 489*0Sstevel@tonic-gate int OCSP_REQUEST_get_ext_by_OBJ(OCSP_REQUEST *x, ASN1_OBJECT *obj, int lastpos); 490*0Sstevel@tonic-gate int OCSP_REQUEST_get_ext_by_critical(OCSP_REQUEST *x, int crit, int lastpos); 491*0Sstevel@tonic-gate X509_EXTENSION *OCSP_REQUEST_get_ext(OCSP_REQUEST *x, int loc); 492*0Sstevel@tonic-gate X509_EXTENSION *OCSP_REQUEST_delete_ext(OCSP_REQUEST *x, int loc); 493*0Sstevel@tonic-gate void *OCSP_REQUEST_get1_ext_d2i(OCSP_REQUEST *x, int nid, int *crit, int *idx); 494*0Sstevel@tonic-gate int OCSP_REQUEST_add1_ext_i2d(OCSP_REQUEST *x, int nid, void *value, int crit, 495*0Sstevel@tonic-gate unsigned long flags); 496*0Sstevel@tonic-gate int OCSP_REQUEST_add_ext(OCSP_REQUEST *x, X509_EXTENSION *ex, int loc); 497*0Sstevel@tonic-gate 498*0Sstevel@tonic-gate int OCSP_ONEREQ_get_ext_count(OCSP_ONEREQ *x); 499*0Sstevel@tonic-gate int OCSP_ONEREQ_get_ext_by_NID(OCSP_ONEREQ *x, int nid, int lastpos); 500*0Sstevel@tonic-gate int OCSP_ONEREQ_get_ext_by_OBJ(OCSP_ONEREQ *x, ASN1_OBJECT *obj, int lastpos); 501*0Sstevel@tonic-gate int OCSP_ONEREQ_get_ext_by_critical(OCSP_ONEREQ *x, int crit, int lastpos); 502*0Sstevel@tonic-gate X509_EXTENSION *OCSP_ONEREQ_get_ext(OCSP_ONEREQ *x, int loc); 503*0Sstevel@tonic-gate X509_EXTENSION *OCSP_ONEREQ_delete_ext(OCSP_ONEREQ *x, int loc); 504*0Sstevel@tonic-gate void *OCSP_ONEREQ_get1_ext_d2i(OCSP_ONEREQ *x, int nid, int *crit, int *idx); 505*0Sstevel@tonic-gate int OCSP_ONEREQ_add1_ext_i2d(OCSP_ONEREQ *x, int nid, void *value, int crit, 506*0Sstevel@tonic-gate unsigned long flags); 507*0Sstevel@tonic-gate int OCSP_ONEREQ_add_ext(OCSP_ONEREQ *x, X509_EXTENSION *ex, int loc); 508*0Sstevel@tonic-gate 509*0Sstevel@tonic-gate int OCSP_BASICRESP_get_ext_count(OCSP_BASICRESP *x); 510*0Sstevel@tonic-gate int OCSP_BASICRESP_get_ext_by_NID(OCSP_BASICRESP *x, int nid, int lastpos); 511*0Sstevel@tonic-gate int OCSP_BASICRESP_get_ext_by_OBJ(OCSP_BASICRESP *x, ASN1_OBJECT *obj, int lastpos); 512*0Sstevel@tonic-gate int OCSP_BASICRESP_get_ext_by_critical(OCSP_BASICRESP *x, int crit, int lastpos); 513*0Sstevel@tonic-gate X509_EXTENSION *OCSP_BASICRESP_get_ext(OCSP_BASICRESP *x, int loc); 514*0Sstevel@tonic-gate X509_EXTENSION *OCSP_BASICRESP_delete_ext(OCSP_BASICRESP *x, int loc); 515*0Sstevel@tonic-gate void *OCSP_BASICRESP_get1_ext_d2i(OCSP_BASICRESP *x, int nid, int *crit, int *idx); 516*0Sstevel@tonic-gate int OCSP_BASICRESP_add1_ext_i2d(OCSP_BASICRESP *x, int nid, void *value, int crit, 517*0Sstevel@tonic-gate unsigned long flags); 518*0Sstevel@tonic-gate int OCSP_BASICRESP_add_ext(OCSP_BASICRESP *x, X509_EXTENSION *ex, int loc); 519*0Sstevel@tonic-gate 520*0Sstevel@tonic-gate int OCSP_SINGLERESP_get_ext_count(OCSP_SINGLERESP *x); 521*0Sstevel@tonic-gate int OCSP_SINGLERESP_get_ext_by_NID(OCSP_SINGLERESP *x, int nid, int lastpos); 522*0Sstevel@tonic-gate int OCSP_SINGLERESP_get_ext_by_OBJ(OCSP_SINGLERESP *x, ASN1_OBJECT *obj, int lastpos); 523*0Sstevel@tonic-gate int OCSP_SINGLERESP_get_ext_by_critical(OCSP_SINGLERESP *x, int crit, int lastpos); 524*0Sstevel@tonic-gate X509_EXTENSION *OCSP_SINGLERESP_get_ext(OCSP_SINGLERESP *x, int loc); 525*0Sstevel@tonic-gate X509_EXTENSION *OCSP_SINGLERESP_delete_ext(OCSP_SINGLERESP *x, int loc); 526*0Sstevel@tonic-gate void *OCSP_SINGLERESP_get1_ext_d2i(OCSP_SINGLERESP *x, int nid, int *crit, int *idx); 527*0Sstevel@tonic-gate int OCSP_SINGLERESP_add1_ext_i2d(OCSP_SINGLERESP *x, int nid, void *value, int crit, 528*0Sstevel@tonic-gate unsigned long flags); 529*0Sstevel@tonic-gate int OCSP_SINGLERESP_add_ext(OCSP_SINGLERESP *x, X509_EXTENSION *ex, int loc); 530*0Sstevel@tonic-gate 531*0Sstevel@tonic-gate DECLARE_ASN1_FUNCTIONS(OCSP_SINGLERESP) 532*0Sstevel@tonic-gate DECLARE_ASN1_FUNCTIONS(OCSP_CERTSTATUS) 533*0Sstevel@tonic-gate DECLARE_ASN1_FUNCTIONS(OCSP_REVOKEDINFO) 534*0Sstevel@tonic-gate DECLARE_ASN1_FUNCTIONS(OCSP_BASICRESP) 535*0Sstevel@tonic-gate DECLARE_ASN1_FUNCTIONS(OCSP_RESPDATA) 536*0Sstevel@tonic-gate DECLARE_ASN1_FUNCTIONS(OCSP_RESPID) 537*0Sstevel@tonic-gate DECLARE_ASN1_FUNCTIONS(OCSP_RESPONSE) 538*0Sstevel@tonic-gate DECLARE_ASN1_FUNCTIONS(OCSP_RESPBYTES) 539*0Sstevel@tonic-gate DECLARE_ASN1_FUNCTIONS(OCSP_ONEREQ) 540*0Sstevel@tonic-gate DECLARE_ASN1_FUNCTIONS(OCSP_CERTID) 541*0Sstevel@tonic-gate DECLARE_ASN1_FUNCTIONS(OCSP_REQUEST) 542*0Sstevel@tonic-gate DECLARE_ASN1_FUNCTIONS(OCSP_SIGNATURE) 543*0Sstevel@tonic-gate DECLARE_ASN1_FUNCTIONS(OCSP_REQINFO) 544*0Sstevel@tonic-gate DECLARE_ASN1_FUNCTIONS(OCSP_CRLID) 545*0Sstevel@tonic-gate DECLARE_ASN1_FUNCTIONS(OCSP_SERVICELOC) 546*0Sstevel@tonic-gate 547*0Sstevel@tonic-gate char *OCSP_response_status_str(long s); 548*0Sstevel@tonic-gate char *OCSP_cert_status_str(long s); 549*0Sstevel@tonic-gate char *OCSP_crl_reason_str(long s); 550*0Sstevel@tonic-gate 551*0Sstevel@tonic-gate int OCSP_REQUEST_print(BIO *bp, OCSP_REQUEST* a, unsigned long flags); 552*0Sstevel@tonic-gate int OCSP_RESPONSE_print(BIO *bp, OCSP_RESPONSE* o, unsigned long flags); 553*0Sstevel@tonic-gate 554*0Sstevel@tonic-gate int OCSP_basic_verify(OCSP_BASICRESP *bs, STACK_OF(X509) *certs, 555*0Sstevel@tonic-gate X509_STORE *st, unsigned long flags); 556*0Sstevel@tonic-gate 557*0Sstevel@tonic-gate /* BEGIN ERROR CODES */ 558*0Sstevel@tonic-gate /* The following lines are auto generated by the script mkerr.pl. Any changes 559*0Sstevel@tonic-gate * made after this point may be overwritten when the script is next run. 560*0Sstevel@tonic-gate */ 561*0Sstevel@tonic-gate void ERR_load_OCSP_strings(void); 562*0Sstevel@tonic-gate 563*0Sstevel@tonic-gate /* Error codes for the OCSP functions. */ 564*0Sstevel@tonic-gate 565*0Sstevel@tonic-gate /* Function codes. */ 566*0Sstevel@tonic-gate #define OCSP_F_ASN1_STRING_ENCODE 100 567*0Sstevel@tonic-gate #define OCSP_F_CERT_ID_NEW 101 568*0Sstevel@tonic-gate #define OCSP_F_D2I_OCSP_NONCE 102 569*0Sstevel@tonic-gate #define OCSP_F_OCSP_BASIC_ADD1_STATUS 103 570*0Sstevel@tonic-gate #define OCSP_F_OCSP_BASIC_SIGN 104 571*0Sstevel@tonic-gate #define OCSP_F_OCSP_BASIC_VERIFY 105 572*0Sstevel@tonic-gate #define OCSP_F_OCSP_CHECK_DELEGATED 106 573*0Sstevel@tonic-gate #define OCSP_F_OCSP_CHECK_IDS 107 574*0Sstevel@tonic-gate #define OCSP_F_OCSP_CHECK_ISSUER 108 575*0Sstevel@tonic-gate #define OCSP_F_OCSP_CHECK_VALIDITY 115 576*0Sstevel@tonic-gate #define OCSP_F_OCSP_MATCH_ISSUERID 109 577*0Sstevel@tonic-gate #define OCSP_F_OCSP_PARSE_URL 114 578*0Sstevel@tonic-gate #define OCSP_F_OCSP_REQUEST_SIGN 110 579*0Sstevel@tonic-gate #define OCSP_F_OCSP_REQUEST_VERIFY 116 580*0Sstevel@tonic-gate #define OCSP_F_OCSP_RESPONSE_GET1_BASIC 111 581*0Sstevel@tonic-gate #define OCSP_F_OCSP_SENDREQ_BIO 112 582*0Sstevel@tonic-gate #define OCSP_F_REQUEST_VERIFY 113 583*0Sstevel@tonic-gate 584*0Sstevel@tonic-gate /* Reason codes. */ 585*0Sstevel@tonic-gate #define OCSP_R_BAD_DATA 100 586*0Sstevel@tonic-gate #define OCSP_R_CERTIFICATE_VERIFY_ERROR 101 587*0Sstevel@tonic-gate #define OCSP_R_DIGEST_ERR 102 588*0Sstevel@tonic-gate #define OCSP_R_ERROR_IN_NEXTUPDATE_FIELD 122 589*0Sstevel@tonic-gate #define OCSP_R_ERROR_IN_THISUPDATE_FIELD 123 590*0Sstevel@tonic-gate #define OCSP_R_ERROR_PARSING_URL 121 591*0Sstevel@tonic-gate #define OCSP_R_MISSING_OCSPSIGNING_USAGE 103 592*0Sstevel@tonic-gate #define OCSP_R_NEXTUPDATE_BEFORE_THISUPDATE 124 593*0Sstevel@tonic-gate #define OCSP_R_NOT_BASIC_RESPONSE 104 594*0Sstevel@tonic-gate #define OCSP_R_NO_CERTIFICATES_IN_CHAIN 105 595*0Sstevel@tonic-gate #define OCSP_R_NO_CONTENT 106 596*0Sstevel@tonic-gate #define OCSP_R_NO_PUBLIC_KEY 107 597*0Sstevel@tonic-gate #define OCSP_R_NO_RESPONSE_DATA 108 598*0Sstevel@tonic-gate #define OCSP_R_NO_REVOKED_TIME 109 599*0Sstevel@tonic-gate #define OCSP_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE 110 600*0Sstevel@tonic-gate #define OCSP_R_REQUEST_NOT_SIGNED 128 601*0Sstevel@tonic-gate #define OCSP_R_RESPONSE_CONTAINS_NO_REVOCATION_DATA 111 602*0Sstevel@tonic-gate #define OCSP_R_ROOT_CA_NOT_TRUSTED 112 603*0Sstevel@tonic-gate #define OCSP_R_SERVER_READ_ERROR 113 604*0Sstevel@tonic-gate #define OCSP_R_SERVER_RESPONSE_ERROR 114 605*0Sstevel@tonic-gate #define OCSP_R_SERVER_RESPONSE_PARSE_ERROR 115 606*0Sstevel@tonic-gate #define OCSP_R_SERVER_WRITE_ERROR 116 607*0Sstevel@tonic-gate #define OCSP_R_SIGNATURE_FAILURE 117 608*0Sstevel@tonic-gate #define OCSP_R_SIGNER_CERTIFICATE_NOT_FOUND 118 609*0Sstevel@tonic-gate #define OCSP_R_STATUS_EXPIRED 125 610*0Sstevel@tonic-gate #define OCSP_R_STATUS_NOT_YET_VALID 126 611*0Sstevel@tonic-gate #define OCSP_R_STATUS_TOO_OLD 127 612*0Sstevel@tonic-gate #define OCSP_R_UNKNOWN_MESSAGE_DIGEST 119 613*0Sstevel@tonic-gate #define OCSP_R_UNKNOWN_NID 120 614*0Sstevel@tonic-gate #define OCSP_R_UNSUPPORTED_REQUESTORNAME_TYPE 129 615*0Sstevel@tonic-gate 616*0Sstevel@tonic-gate #ifdef __cplusplus 617*0Sstevel@tonic-gate } 618*0Sstevel@tonic-gate #endif 619*0Sstevel@tonic-gate #endif 620