Problem - Kevin Tafuro

of tunable variables that affect the verification process are supported, so we have created
a data structure to hold this information:
#include
#include
typedef struct {
char *url;
X509 *cert;
X509 *issuer;
spc_x509store_t *store;
X509 *sign_cert;
EVP_PKEY *sign_key;
long skew;
long maxage;
} spc_ocsprequest_t;
The fields in this structure are as follows:
url
Address of the OCSP responder to which to connect; this should always be a
URLthat specifies either HTTP or HTTPS as the service. For example, Veri-
Sign’s OCSP responder address is http://ocsp.verisign.com.
cert
Pointer to the certificate whose revocation status you want to check. In many
cases, this will likely come from the peer when establishing or renegotiating an
SSL session.
issuer
Pointer to the certificate that issued the certificate whose revocation status you
want to check. This should be a trusted root certificate.
store
Any information required for building an X509_STORE object internally. This
object will be used for verifying the OCSP responder’s certificate. A full discussion
of this object can be found in Recipe 10.5, but basically it contains trusted
certificates and CRLs that OpenSSL can use to verify the validity of the certificate
received from the OCSP responder.
sign_cert
An OCSP request can optionally be signed. Some servers require signed requests.
Any server will accept a signed request provided that the server is able to verify
the signature. If you want the request to be signed, this field should be non-NULL
and should be a pointer to the certificate to use to sign the request. If you are
going to sign your request, you should use a certificate that has been issued by a
CA that is trusted by the OCSP responder so that the responder will be able to
verify its validity.
Checking Revocation Status via OCSP with OpenSSL | 563
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.