2 /* Written by Tom Titchener <Tom_Titchener@groove.net> for the OpenSSL
6 This file was transfered to Richard Levitte from CertCo by Kathy
7 Weinhold in mid-spring 2000 to be included in OpenSSL or released
10 /* ====================================================================
11 * Copyright (c) 1998-2000 The OpenSSL Project. All rights reserved.
13 * Redistribution and use in source and binary forms, with or without
14 * modification, are permitted provided that the following conditions
17 * 1. Redistributions of source code must retain the above copyright
18 * notice, this list of conditions and the following disclaimer.
20 * 2. Redistributions in binary form must reproduce the above copyright
21 * notice, this list of conditions and the following disclaimer in
22 * the documentation and/or other materials provided with the
25 * 3. All advertising materials mentioning features or use of this
26 * software must display the following acknowledgment:
27 * "This product includes software developed by the OpenSSL Project
28 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
30 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
31 * endorse or promote products derived from this software without
32 * prior written permission. For written permission, please contact
33 * openssl-core@openssl.org.
35 * 5. Products derived from this software may not be called "OpenSSL"
36 * nor may "OpenSSL" appear in their names without prior written
37 * permission of the OpenSSL Project.
39 * 6. Redistributions of any form whatsoever must retain the following
41 * "This product includes software developed by the OpenSSL Project
42 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
44 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
45 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
46 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
47 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
48 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
49 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
50 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
51 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
52 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
53 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
54 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
55 * OF THE POSSIBILITY OF SUCH DAMAGE.
56 * ====================================================================
58 * This product includes cryptographic software written by Eric Young
59 * (eay@cryptsoft.com). This product includes software written by Tim
60 * Hudson (tjh@cryptsoft.com).
67 #include <openssl/x509.h>
68 #include <openssl/x509v3.h>
69 #include <openssl/safestack.h>
75 /* CertID ::= SEQUENCE {
76 * hashAlgorithm AlgorithmIdentifier,
77 * issuerNameHash OCTET STRING, -- Hash of Issuer's DN
78 * issuerKeyHash OCTET STRING, -- Hash of Issuers public key (excluding the tag & length fields)
79 * serialNumber CertificateSerialNumber }
81 typedef struct ocsp_cert_id_st
83 X509_ALGOR *hashAlgorithm;
84 ASN1_OCTET_STRING *issuerNameHash;
85 ASN1_OCTET_STRING *issuerKeyHash;
86 ASN1_INTEGER *serialNumber;
89 /* Request ::= SEQUENCE {
91 * singleRequestExtensions [0] EXPLICIT Extensions OPTIONAL }
93 typedef struct ocsp_one_request_st
96 STACK_OF(X509_EXTENSION) *singleRequestExtensions;
99 DECLARE_STACK_OF(OCSP_ONEREQ)
100 DECLARE_ASN1_SET_OF(OCSP_ONEREQ)
103 /* TBSRequest ::= SEQUENCE {
104 * version [0] EXPLICIT Version DEFAULT v1,
105 * requestorName [1] EXPLICIT GeneralName OPTIONAL,
106 * requestList SEQUENCE OF Request,
107 * requestExtensions [2] EXPLICIT Extensions OPTIONAL }
109 typedef struct ocsp_req_info_st
111 ASN1_INTEGER *version;
112 GENERAL_NAME *requestorName;
113 STACK_OF(OCSP_ONEREQ) *requestList;
114 STACK_OF(X509_EXTENSION) *requestExtensions;
117 /* Signature ::= SEQUENCE {
118 * signatureAlgorithm AlgorithmIdentifier,
119 * signature BIT STRING,
120 * certs [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL }
122 typedef struct ocsp_signature_st
124 X509_ALGOR *signatureAlgorithm;
125 ASN1_BIT_STRING *signature;
126 STACK_OF(X509) *certs;
129 /* OCSPRequest ::= SEQUENCE {
130 * tbsRequest TBSRequest,
131 * optionalSignature [0] EXPLICIT Signature OPTIONAL }
133 typedef struct ocsp_request_st
135 OCSP_REQINFO *tbsRequest;
136 OCSP_SIGNATURE *optionalSignature; /* OPTIONAL */
139 /* OCSPResponseStatus ::= ENUMERATED {
140 * successful (0), --Response has valid confirmations
141 * malformedRequest (1), --Illegal confirmation request
142 * internalError (2), --Internal error in issuer
143 * tryLater (3), --Try again later
145 * sigRequired (5), --Must sign the request
146 * unauthorized (6) --Request unauthorized
149 #define OCSP_RESPONSE_STATUS_SUCCESSFULL 0
150 #define OCSP_RESPONSE_STATUS_MALFORMEDREQUEST 1
151 #define OCSP_RESPONSE_STATUS_INTERNALERROR 2
152 #define OCSP_RESPONSE_STATUS_TRYLATER 3
153 #define OCSP_RESPONSE_STATUS_SIGREQUIRED 5
154 #define OCSP_RESPONSE_STATUS_UNAUTHORIZED 6
156 /* ResponseBytes ::= SEQUENCE {
157 * responseType OBJECT IDENTIFIER,
158 * response OCTET STRING }
160 typedef struct ocsp_resp_bytes_st
162 ASN1_OBJECT *responseType;
163 ASN1_OCTET_STRING *response;
166 /* OCSPResponse ::= SEQUENCE {
167 * responseStatus OCSPResponseStatus,
168 * responseBytes [0] EXPLICIT ResponseBytes OPTIONAL }
170 typedef struct ocsp_response_st
172 ASN1_ENUMERATED *responseStatus;
173 OCSP_RESPBYTES *responseBytes;
176 /* ResponderID ::= CHOICE {
178 * byKey [2] KeyHash }
180 #define V_OCSP_RESPID_NAME 0
181 #define V_OCSP_RESPID_KEY 1
182 typedef struct ocsp_responder_id_st
187 ASN1_OCTET_STRING *byKey;
190 /* KeyHash ::= OCTET STRING --SHA-1 hash of responder's public key
191 * --(excluding the tag and length fields)
194 /* RevokedInfo ::= SEQUENCE {
195 * revocationTime GeneralizedTime,
196 * revocationReason [0] EXPLICIT CRLReason OPTIONAL }
198 typedef struct ocsp_revoked_info_st
200 ASN1_GENERALIZEDTIME *revocationTime;
201 ASN1_ENUMERATED *revocationReason;
204 /* CertStatus ::= CHOICE {
205 * good [0] IMPLICIT NULL,
206 * revoked [1] IMPLICIT RevokedInfo,
207 * unknown [2] IMPLICIT UnknownInfo }
209 #define V_OCSP_CERTSTATUS_GOOD 0
210 #define V_OCSP_CERTSTATUS_REVOKED 1
211 #define V_OCSP_CERTSTATUS_UNKNOWN 2
212 typedef struct ocsp_cert_status_st
217 OCSP_REVOKEDINFO *revoked;
222 /* SingleResponse ::= SEQUENCE {
224 * certStatus CertStatus,
225 * thisUpdate GeneralizedTime,
226 * nextUpdate [0] EXPLICIT GeneralizedTime OPTIONAL,
227 * singleExtensions [1] EXPLICIT Extensions OPTIONAL }
229 typedef struct ocsp_single_response_st
232 OCSP_CERTSTATUS *certStatus;
233 ASN1_GENERALIZEDTIME *thisUpdate;
234 ASN1_GENERALIZEDTIME *nextUpdate;
235 STACK_OF(X509_EXTENSION) *singleExtensions;
238 DECLARE_STACK_OF(OCSP_SINGLERESP)
239 DECLARE_ASN1_SET_OF(OCSP_SINGLERESP)
241 /* ResponseData ::= SEQUENCE {
242 * version [0] EXPLICIT Version DEFAULT v1,
243 * responderID ResponderID,
244 * producedAt GeneralizedTime,
245 * responses SEQUENCE OF SingleResponse,
246 * responseExtensions [1] EXPLICIT Extensions OPTIONAL }
248 typedef struct ocsp_response_data_st
250 ASN1_INTEGER *version;
251 OCSP_RESPID *responderId;
252 ASN1_GENERALIZEDTIME *producedAt;
253 STACK_OF(OCSP_SINGLERESP) *responses;
254 STACK_OF(X509_EXTENSION) *responseExtensions;
257 /* BasicOCSPResponse ::= SEQUENCE {
258 * tbsResponseData ResponseData,
259 * signatureAlgorithm AlgorithmIdentifier,
260 * signature BIT STRING,
261 * certs [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL }
264 The value for "signature" is specified in the OCSP rfc2560 as follows:
265 "The value for the signature SHALL be computed on the hash of the DER
266 encoding ResponseData." This means that you must hash the DER-encoded
267 tbsResponseData, and then run it through a crypto-signing function, which
268 will (at least w/RSA) do a hash-'n'-private-encrypt operation. This seems
269 a bit odd, but that's the spec. Also note that the data structures do not
270 leave anywhere to independently specify the algorithm used for the initial
271 hash. So, we look at the signature-specification algorithm, and try to do
272 something intelligent. -- Kathy Weinhold, CertCo */
274 It seems that the mentioned passage from RFC 2560 (section 4.2.1) is open
275 for interpretation. I've done tests against another responder, and found
276 that it doesn't do the double hashing that the RFC seems to say one
277 should. Therefore, all relevant functions take a flag saying which
278 variant should be used. -- Richard Levitte, OpenSSL team and CeloCom */
279 typedef struct ocsp_basic_response_st
281 OCSP_RESPDATA *tbsResponseData;
282 X509_ALGOR *signatureAlgorithm;
283 ASN1_BIT_STRING *signature;
284 STACK_OF(X509) *certs;
288 * CRLReason ::= ENUMERATED {
292 * affiliationChanged (3),
294 * cessationOfOperation (5),
295 * certificateHold (6),
296 * removeFromCRL (8) }
298 #define OCSP_REVOKED_STATUS_NOSTATUS -1
299 #define OCSP_REVOKED_STATUS_UNSPECIFIED 0
300 #define OCSP_REVOKED_STATUS_KEYCOMPROMISE 1
301 #define OCSP_REVOKED_STATUS_CACOMPROMISE 2
302 #define OCSP_REVOKED_STATUS_AFFILIATIONCHANGED 3
303 #define OCSP_REVOKED_STATUS_SUPERSEDED 4
304 #define OCSP_REVOKED_STATUS_CESSATIONOFOPERATION 5
305 #define OCSP_REVOKED_STATUS_CERTIFICATEHOLD 6
306 #define OCSP_REVOKED_STATUS_REMOVEFROMCRL 8
308 /* CrlID ::= SEQUENCE {
309 * crlUrl [0] EXPLICIT IA5String OPTIONAL,
310 * crlNum [1] EXPLICIT INTEGER OPTIONAL,
311 * crlTime [2] EXPLICIT GeneralizedTime OPTIONAL }
313 typedef struct ocsp_crl_id_st
315 ASN1_IA5STRING *crlUrl;
316 ASN1_INTEGER *crlNum;
317 ASN1_GENERALIZEDTIME *crlTime;
320 /* ServiceLocator ::= SEQUENCE {
322 * locator AuthorityInfoAccessSyntax OPTIONAL }
324 typedef struct ocsp_service_locator_st
327 STACK_OF(ACCESS_DESCRIPTION) *locator;
330 #define PEM_STRING_OCSP_REQUEST "OCSP REQUEST"
331 #define PEM_STRING_OCSP_RESPONSE "OCSP RESPONSE"
333 #define d2i_OCSP_REQUEST_bio(bp,p) (OCSP_REQUEST*)ASN1_d2i_bio((char*(*)()) \
334 OCSP_REQUEST_new,(char *(*)())d2i_OCSP_REQUEST, (bp),\
335 (unsigned char **)(p))
337 #define d2i_OCSP_RESPONSE_bio(bp,p) (OCSP_RESPONSE*)ASN1_d2i_bio((char*(*)())\
338 OCSP_REQUEST_new,(char *(*)())d2i_OCSP_RESPONSE, (bp),\
339 (unsigned char **)(p))
341 #define PEM_read_bio_OCSP_REQUEST(bp,x,cb) (OCSP_REQUEST *)PEM_ASN1_read_bio( \
342 (char *(*)())d2i_OCSP_REQUEST,PEM_STRING_OCSP_REQUEST,bp,(char **)x,cb,NULL)
344 #define PEM_read_bio_OCSP_RESPONSE(bp,x,cb)(OCSP_RESPONSE *)PEM_ASN1_read_bio(\
345 (char *(*)())d2i_OCSP_RESPONSE,PEM_STRING_OCSP_RESPONSE,bp,(char **)x,cb,NULL)
347 #define PEM_write_bio_OCSP_REQUEST(bp,o) \
348 PEM_ASN1_write_bio((int (*)())i2d_OCSP_REQUEST,PEM_STRING_OCSP_REQUEST,\
349 bp,(char *)o, NULL,NULL,0,NULL,NULL)
351 #define PEM_write_bio_OCSP_RESPONSE(bp,o) \
352 PEM_ASN1_write_bio((int (*)())i2d_OCSP_RESPONSE,PEM_STRING_OCSP_RESPONSE,\
353 bp,(char *)o, NULL,NULL,0,NULL,NULL)
355 #define i2d_OCSP_RESPONSE_bio(bp,o) ASN1_i2d_bio(i2d_OCSP_RESPONSE,bp,\
358 #define i2d_OCSP_REQUEST_bio(bp,o) ASN1_i2d_bio(i2d_OCSP_REQUEST,bp,\
361 #define OCSP_REQUEST_sign(o,pkey,md) \
362 ASN1_item_sign(&OCSP_REQINFO_it,\
363 o->optionalSignature->signatureAlgorithm,NULL,\
364 o->optionalSignature->signature,(char *)o->tbsRequest,pkey,md)
366 #define OCSP_BASICRESP_sign(o,pkey,md,d) \
367 ASN1_item_sign(&OCSP_RESPDATA_it,o->signatureAlgorithm,NULL,\
368 o->signature,(char *)o->tbsResponseData,pkey,md)
370 #define OCSP_REQUEST_verify(a,r) ASN1_item_verify(&OCSP_REQINFO_it,\
371 a->optionalSignature->signatureAlgorithm,\
372 a->optionalSignature->signature,(char *)a->tbsRequest,r)
374 #define OCSP_BASICRESP_verify(a,r,d) ASN1_item_verify(&OCSP_RESPDATA_it,\
375 a->signatureAlgorithm,a->signature,(char *)a->tbsResponseData,r)
377 #define ASN1_BIT_STRING_digest(data,type,md,len) \
378 ASN1_item_digest(&ASN1_BIT_STRING_it,type,(char *)data,md,len)
380 #define OCSP_CERTID_dup(cid) (OCSP_CERTID*)ASN1_dup((int(*)())i2d_OCSP_CERTID,\
381 (char *(*)())d2i_OCSP_CERTID,(char *)(cid))
383 #define OCSP_CERTSTATUS_dup(cs)\
384 (OCSP_CERTSTATUS*)ASN1_dup((int(*)())i2d_OCSP_CERTSTATUS,\
385 (char *(*)())d2i_OCSP_CERTSTATUS,(char *)(cs))
387 OCSP_CERTID *OCSP_cert_id_new(const EVP_MD *dgst,
388 X509_NAME *issuerName,
389 ASN1_BIT_STRING* issuerKey,
390 ASN1_INTEGER *serialNumber);
392 OCSP_CERTSTATUS *OCSP_cert_status_new(int status, int reason, char *tim);
394 OCSP_REQUEST *OCSP_request_new(X509_NAME* name,
395 STACK_OF(X509_EXTENSION) *extensions);
397 int OCSP_request_add(OCSP_REQUEST *req,
399 STACK_OF(X509_EXTENSION) *extensions);
401 int OCSP_request_sign(OCSP_REQUEST *req,
404 STACK_OF(X509) *certs);
406 int OCSP_request_verify(OCSP_REQUEST *req, EVP_PKEY *pkey);
408 OCSP_BASICRESP *OCSP_basic_response_new(int tag,
410 STACK_OF(X509_EXTENSION) *extensions);
412 int OCSP_basic_response_add(OCSP_BASICRESP *rsp,
414 OCSP_CERTSTATUS *cst,
417 STACK_OF(X509_EXTENSION) *extensions);
419 int OCSP_basic_response_sign(OCSP_BASICRESP *brsp,
422 STACK_OF(X509) *certs);
424 int OCSP_response_verify(OCSP_RESPONSE *rsp, EVP_PKEY *pkey);
426 int OCSP_basic_response_verify(OCSP_BASICRESP *rsp, EVP_PKEY *pkey);
429 OCSP_RESPONSE *OCSP_response_new(int status,
434 ASN1_STRING *ASN1_STRING_encode(ASN1_STRING *s, int (*i2d)(),
435 char *data, STACK_OF(ASN1_OBJECT) *sk);
437 X509_EXTENSION *OCSP_nonce_new(void *p, unsigned int len);
439 X509_EXTENSION *OCSP_crlID_new(char *url, long *n, char *tim);
441 X509_EXTENSION *OCSP_accept_responses_new(char **oids);
443 X509_EXTENSION *OCSP_archive_cutoff_new(char* tim);
445 X509_EXTENSION *OCSP_url_svcloc_new(X509_NAME* issuer, char **urls);
447 int OCSP_REQUEST_get_ext_count(OCSP_REQUEST *x);
448 int OCSP_REQUEST_get_ext_by_NID(OCSP_REQUEST *x, int nid, int lastpos);
449 int OCSP_REQUEST_get_ext_by_OBJ(OCSP_REQUEST *x, ASN1_OBJECT *obj, int lastpos);
450 int OCSP_REQUEST_get_ext_by_critical(OCSP_REQUEST *x, int crit, int lastpos);
451 X509_EXTENSION *OCSP_REQUEST_get_ext(OCSP_REQUEST *x, int loc);
452 X509_EXTENSION *OCSP_REQUEST_delete_ext(OCSP_REQUEST *x, int loc);
453 void *OCSP_REQUEST_get1_ext_d2i(OCSP_REQUEST *x, int nid, int *crit, int *idx);
454 int OCSP_REQUEST_add1_ext_i2d(OCSP_REQUEST *x, int nid, void *value, int crit,
455 unsigned long flags);
456 int OCSP_REQUEST_add_ext(OCSP_REQUEST *x, X509_EXTENSION *ex, int loc);
458 int OCSP_ONEREQ_get_ext_count(OCSP_ONEREQ *x);
459 int OCSP_ONEREQ_get_ext_by_NID(OCSP_ONEREQ *x, int nid, int lastpos);
460 int OCSP_ONEREQ_get_ext_by_OBJ(OCSP_ONEREQ *x, ASN1_OBJECT *obj, int lastpos);
461 int OCSP_ONEREQ_get_ext_by_critical(OCSP_ONEREQ *x, int crit, int lastpos);
462 X509_EXTENSION *OCSP_ONEREQ_get_ext(OCSP_ONEREQ *x, int loc);
463 X509_EXTENSION *OCSP_ONEREQ_delete_ext(OCSP_ONEREQ *x, int loc);
464 void *OCSP_ONEREQ_get1_ext_d2i(OCSP_ONEREQ *x, int nid, int *crit, int *idx);
465 int OCSP_ONEREQ_add1_ext_i2d(OCSP_ONEREQ *x, int nid, void *value, int crit,
466 unsigned long flags);
467 int OCSP_ONEREQ_add_ext(OCSP_ONEREQ *x, X509_EXTENSION *ex, int loc);
469 int OCSP_BASICRESP_get_ext_count(OCSP_BASICRESP *x);
470 int OCSP_BASICRESP_get_ext_by_NID(OCSP_BASICRESP *x, int nid, int lastpos);
471 int OCSP_BASICRESP_get_ext_by_OBJ(OCSP_BASICRESP *x, ASN1_OBJECT *obj, int lastpos);
472 int OCSP_BASICRESP_get_ext_by_critical(OCSP_BASICRESP *x, int crit, int lastpos);
473 X509_EXTENSION *OCSP_BASICRESP_get_ext(OCSP_BASICRESP *x, int loc);
474 X509_EXTENSION *OCSP_BASICRESP_delete_ext(OCSP_BASICRESP *x, int loc);
475 void *OCSP_BASICRESP_get1_ext_d2i(OCSP_BASICRESP *x, int nid, int *crit, int *idx);
476 int OCSP_BASICRESP_add1_ext_i2d(OCSP_BASICRESP *x, int nid, void *value, int crit,
477 unsigned long flags);
478 int OCSP_BASICRESP_add_ext(OCSP_BASICRESP *x, X509_EXTENSION *ex, int loc);
480 int OCSP_SINGLERESP_get_ext_count(OCSP_SINGLERESP *x);
481 int OCSP_SINGLERESP_get_ext_by_NID(OCSP_SINGLERESP *x, int nid, int lastpos);
482 int OCSP_SINGLERESP_get_ext_by_OBJ(OCSP_SINGLERESP *x, ASN1_OBJECT *obj, int lastpos);
483 int OCSP_SINGLERESP_get_ext_by_critical(OCSP_SINGLERESP *x, int crit, int lastpos);
484 X509_EXTENSION *OCSP_SINGLERESP_get_ext(OCSP_SINGLERESP *x, int loc);
485 X509_EXTENSION *OCSP_SINGLERESP_delete_ext(OCSP_SINGLERESP *x, int loc);
486 void *OCSP_SINGLERESP_get1_ext_d2i(OCSP_SINGLERESP *x, int nid, int *crit, int *idx);
487 int OCSP_SINGLERESP_add1_ext_i2d(OCSP_SINGLERESP *x, int nid, void *value, int crit,
488 unsigned long flags);
489 int OCSP_SINGLERESP_add_ext(OCSP_SINGLERESP *x, X509_EXTENSION *ex, int loc);
491 DECLARE_ASN1_FUNCTIONS(OCSP_SINGLERESP)
492 DECLARE_ASN1_FUNCTIONS(OCSP_CERTSTATUS)
493 DECLARE_ASN1_FUNCTIONS(OCSP_REVOKEDINFO)
494 DECLARE_ASN1_FUNCTIONS(OCSP_BASICRESP)
495 DECLARE_ASN1_FUNCTIONS(OCSP_RESPDATA)
496 DECLARE_ASN1_FUNCTIONS(OCSP_RESPID)
497 DECLARE_ASN1_FUNCTIONS(OCSP_RESPONSE)
498 DECLARE_ASN1_FUNCTIONS(OCSP_RESPBYTES)
499 DECLARE_ASN1_FUNCTIONS(OCSP_ONEREQ)
500 DECLARE_ASN1_FUNCTIONS(OCSP_CERTID)
501 DECLARE_ASN1_FUNCTIONS(OCSP_REQUEST)
502 DECLARE_ASN1_FUNCTIONS(OCSP_SIGNATURE)
503 DECLARE_ASN1_FUNCTIONS(OCSP_REQINFO)
504 DECLARE_ASN1_FUNCTIONS(OCSP_CRLID)
505 DECLARE_ASN1_FUNCTIONS(OCSP_SERVICELOC)
507 int OCSP_REQUEST_print(BIO *bp, OCSP_REQUEST* a, unsigned long flags);
510 void ERR_load_OCSP_strings(void);
512 /* BEGIN ERROR CODES */
513 /* The following lines are auto generated by the script mkerr.pl. Any changes
514 * made after this point may be overwritten when the script is next run.
517 /* Error codes for the OCSP functions. */
519 /* Function codes. */
520 #define OCSP_F_ASN1_STRING_ENCODE 106
521 #define OCSP_F_BASIC_RESPONSE_NEW 100
522 #define OCSP_F_BASIC_RESPONSE_VERIFY 101
523 #define OCSP_F_CERT_ID_NEW 102
524 #define OCSP_F_CERT_STATUS_NEW 103
525 #define OCSP_F_D2I_OCSP_NONCE 109
526 #define OCSP_F_REQUEST_VERIFY 104
527 #define OCSP_F_RESPONSE_VERIFY 105
528 #define OCSP_F_S2I_OCSP_NONCE 107
529 #define OCSP_F_V2I_OCSP_CRLID 108
532 #define OCSP_R_BAD_DATA 108
533 #define OCSP_R_BAD_TAG 100
534 #define OCSP_R_DIGEST_ERR 101
535 #define OCSP_R_FAILED_TO_OPEN 109
536 #define OCSP_R_FAILED_TO_READ 110
537 #define OCSP_R_FAILED_TO_STAT 111
538 #define OCSP_R_MISSING_VALUE 112
539 #define OCSP_R_NO_CERTIFICATE 102
540 #define OCSP_R_NO_PUBLIC_KEY 103
541 #define OCSP_R_NO_RESPONSE_DATA 104
542 #define OCSP_R_NO_SIGNATURE 105
543 #define OCSP_R_REVOKED_NO_TIME 106
544 #define OCSP_R_UNKNOWN_NID 107
545 #define OCSP_R_UNSUPPORTED_OPTION 113
546 #define OCSP_R_VALUE_ALREADY 114