U:RDoc::NormalModule[iI" OCSP:ETI"OpenSSL::OCSP;T0o:RDoc::Markup::Document: @parts[o;;[(o:RDoc::Markup::Paragraph;[I"JOpenSSL::OCSP implements Online Certificate Status Protocol requests ;TI"and responses.;To:RDoc::Markup::BlankLineo; ;[ I"ICreating and sending an OCSP request requires a subject certificate ;TI"Kthat contains an OCSP URL in an authorityInfoAccess extension and the ;TI"Missuer certificate for the subject certificate. First, load the issuer ;TI"and subject certificates:;T@o:RDoc::Markup::Verbatim;[I":subject = OpenSSL::X509::Certificate.new subject_pem ;TI"9issuer = OpenSSL::X509::Certificate.new issuer_pem ;T: @format0o; ;[I"FTo create the request we need to create a certificate ID for the ;TI"Isubject certificate so the CA knows which certificate we are asking ;TI" about:;T@o; ;[I"(digest = OpenSSL::Digest::SHA1.new ;TI"certificate_id = ;TI"@ OpenSSL::OCSP::CertificateId.new subject, issuer, digest ;T; 0o; ;[I" Net::HTTP.start ocsp_uri.hostname, ocsp.port do |http| ;TI"2 http.post ocsp_uri.path, request.to_der, ;TI"@ 'content-type' => 'application/ocsp-request' ;TI" end ;TI" ;TI"?response = OpenSSL::OCSP::Response.new http_response.body ;TI"%response_basic = response.basic ;T; 0o; ;[ I"LFirst we check if the response has a valid signature. Without a valid ;TI"Isignature we cannot trust it. If you get a failure here you may be ;TI"Kmissing a system certificate store or may be missing the intermediate ;TI"certificates.;T@o; ;[ I"&store = OpenSSL::X509::Store.new ;TI"store.set_default_paths ;TI" ;TI"1unless response_basic.verify [], store then ;TI"? raise 'response is not signed by a trusted certificate' ;TI" end ;T; 0o; ;[I"JThe response contains the status information (success/fail). We can ;TI"$display the status as a string:;T@o; ;[I"0puts response.status_string #=> successful ;T; 0o; ;[ I"LNext we need to know the response details to determine if the response ;TI"Imatches our request. First we check the nonce. Again, not all CAs ;TI"Gsupport a nonce. See Request#check_nonce for the meanings of the ;TI"return values.;T@o; ;[I"Ap request.check_nonce basic_response #=> value from -1 to 3 ;T; 0o; ;[I"LThen extract the status information for the certificate from the basic ;TI"response.;T@o; ;[ I"Dsingle_response = basic_response.find_response(certificate_id) ;TI" ;TI"unless single_response ;TI"L raise 'basic_response does not have the status for the certificiate' ;TI" end ;T; 0o; ;[I"MThen check the validity. A status issued in the future must be rejected.;T@o; ;[I"+unless single_response.check_validity ;TI"K raise 'this_update is in the future or next_update time has passed' ;TI" end ;TI" ;TI"&case single_response.cert_status ;TI"+when OpenSSL::OCSP::V_CERTSTATUS_GOOD ;TI") puts 'certificate is still valid' ;TI".when OpenSSL::OCSP::V_CERTSTATUS_REVOKED ;TI"Q puts "certificate has been revoked at #{single_response.revocation_time}" ;TI".when OpenSSL::OCSP::V_CERTSTATUS_UNKNOWN ;TI"; puts 'responder doesn't know about the certificate' ;TI"end;T; 0: @fileI"ext/openssl/ossl_ocsp.c;T:0@omit_headings_from_table_of_contents_below0; 0;0[[%U:RDoc::Constant[iI""RESPONSE_STATUS_INTERNALERROR;TI"1OpenSSL::OCSP::RESPONSE_STATUS_INTERNALERROR;T00o;;[o; ;[I"Internal error in issuer;T@; @Œ;0@Œ@cRDoc::NormalModule0U;[iI"%RESPONSE_STATUS_MALFORMEDREQUEST;TI"4OpenSSL::OCSP::RESPONSE_STATUS_MALFORMEDREQUEST;T00o;;[o; ;[I"!Illegal confirmation request;T@; @Œ;0@Œ@@˜0U;[iI"REVOKED_STATUS_NOSTATUS;TI"+OpenSSL::OCSP::REVOKED_STATUS_NOSTATUS;T00o;;[o; ;[I"6The certificate was revoked for an unknown reason;T@; @Œ;0@Œ@@˜0U;[iI" RESPONSE_STATUS_SIGREQUIRED;TI"/OpenSSL::OCSP::RESPONSE_STATUS_SIGREQUIRED;T00o;;[o; ;[I"+You must sign the request and resubmit;T@; @Œ;0@Œ@@˜0U;[iI"RESPONSE_STATUS_SUCCESSFUL;TI".OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL;T00o;;[o; ;[I"%Response has valid confirmations;T@; @Œ;0@Œ@@˜0U;[iI"RESPONSE_STATUS_TRYLATER;TI",OpenSSL::OCSP::RESPONSE_STATUS_TRYLATER;T00o;;[o; ;[I"Try again later;T@; @Œ;0@Œ@@˜0U;[iI"&REVOKED_STATUS_AFFILIATIONCHANGED;TI"5OpenSSL::OCSP::REVOKED_STATUS_AFFILIATIONCHANGED;T00o;;[o; ;[I"@The certificate subject's name or other information changed;T@; @Œ;0@Œ@@˜0U;[iI" REVOKED_STATUS_CACOMPROMISE;TI"/OpenSSL::OCSP::REVOKED_STATUS_CACOMPROMISE;T00o;;[o; ;[I"