+
+/*
+ * Certificate Status callback. This is called when a client includes a
+ * certificate status request extension. The response is either obtained from a
+ * file, or from an OCSP responder.
+ */
+static int cert_status_cb(SSL *s, void *arg)
+{
+ tlsextstatusctx *srctx = arg;
+ OCSP_RESPONSE *resp = NULL;
+ unsigned char *rspder = NULL;
+ int rspderlen;
+ int ret = SSL_TLSEXT_ERR_ALERT_FATAL;
+
+ if (srctx->verbose)
+ BIO_puts(bio_err, "cert_status: callback called\n");
+
+ if (srctx->respin != NULL) {
+ BIO *derbio = bio_open_default(srctx->respin, 'r', FORMAT_ASN1);
+ if (derbio == NULL) {
+ BIO_puts(bio_err, "cert_status: Cannot open OCSP response file\n");
+ goto err;
+ }
+ resp = d2i_OCSP_RESPONSE_bio(derbio, NULL);
+ BIO_free(derbio);
+ if (resp == NULL) {
+ BIO_puts(bio_err, "cert_status: Error reading OCSP response\n");
+ goto err;
+ }
+ } else {
+ ret = get_ocsp_resp_from_responder(s, srctx, &resp);
+ if (ret != SSL_TLSEXT_ERR_OK)
+ goto err;
+ }
+
+ rspderlen = i2d_OCSP_RESPONSE(resp, &rspder);
+ if (rspderlen <= 0)
+ goto err;
+
+ SSL_set_tlsext_status_ocsp_resp(s, rspder, rspderlen);
+ if (srctx->verbose) {
+ BIO_puts(bio_err, "cert_status: ocsp response sent:\n");
+ OCSP_RESPONSE_print(bio_err, resp, 2);
+ }
+
+ ret = SSL_TLSEXT_ERR_OK;
+
+ err:
+ if (ret != SSL_TLSEXT_ERR_OK)
+ ERR_print_errors(bio_err);
+
+ OCSP_RESPONSE_free(resp);
+
+ return ret;
+}