gnutls_ocsp_resp_verify_direct(3)

Usage

#include <gnutls/ocsp.h>

int gnutls_ocsp_resp_verify_direct(gnutls_ocsp_resp_const_t resp, gnutls_x509_crt_t issuer, unsigned int * verify, unsigned int flags);

Arguments

`gnutls_ocsp_resp_const_t resp`	should contain a `gnutls_ocsp_resp_t` type
`gnutls_x509_crt_t issuer`	certificate believed to have signed the response
`unsigned int * verify`	output variable with verification status, an `gnutls_ocsp_verify_reason_t`
`unsigned int flags`	verification flags from `gnutls_certificate_verify_flags`

Overview

Verify signature of the Basic OCSP Response against the public key in the issuer certificate.

The output verify variable will hold verification status codes (e.g., GNUTLS_OCSP_VERIFY_SIGNER_NOT_FOUND, GNUTLS_OCSP_VERIFY_INSECURE_ALGORITHM) which are only valid if the function returned GNUTLS_E_SUCCESS.

Note that the function returns GNUTLS_E_SUCCESS even when verification failed. The caller must always inspect the verify variable to find out the verification status.

The flags variable should be 0 for now.

Returns

On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.

Releases

7 releases since Debian 8 (Jessie); the text changed 6 times.

8
9
10
11
12
13
Arch