Problem - Kevin Tafuro

sign_key
If the sign_cert member is non-NULL, this member must be filled in with a
pointer to the private key to use in signing the request. It is ignored if the sign_
cert member is NULL.
skew
An OCSP response contains three time fields: thisUpdate, nextUpdate, and
producedAt. These fields must be checked to determine how reliable the results
from the responder are. For example, under no circumstance should thisUpdate
ever be greater than nextUpdate. However, it is likely that there will be some
amount of clock skew between the server and the client. skew defines an acceptable
amount of skew in units of seconds. It should be set to a reasonably low
value. In most cases, five seconds should work out fine.
maxage
RFC 2560 OCSP responders are allowed to precompute responses to improve
response time by eliminating the need to sign a response for every request. There
are obvious security implications if a server opts to do this, as we discussed in
Recipe 10.1. The producedAt field in the response will contain the time at which
the response was computed, whether or not it was precomputed. The maxage
member specifies the maximum age in seconds of responses that should be considered
acceptable. Setting maxage to 0 will effectively cause the producedAt field
in the response to be ignored and any otherwise acceptable response to be
accepted, regardless of its age. OpenSSL’s command-line ocsp command defaults
to ignoring the producedAt field. However, we think it is too risky to accept precomputed
responses. Unfortunately, there is no way to completely disable the
acceptance of precomputed responses. The closest we can get is to set this value
to one second, which is what we recommend you do.
Querying an OCSP responder is actually a complex operation, even though we are
effectively reducing the amount of work necessary for you to a single function call.
Because of the complexity of the operation, a number of things can go wrong, and so
we have defined a sizable number of possible error codes. In some cases, we have
lumped a number of finer-grained errors into a single error code, but the code presented
here can easily be expanded to provide more detailed error information.
typedef enum {
SPC_OCSPRESULT_ERROR_INVALIDRESPONSE = -12,
SPC_OCSPRESULT_ERROR_CONNECTFAILURE = -11,
SPC_OCSPRESULT_ERROR_SIGNFAILURE = -10,
SPC_OCSPRESULT_ERROR_BADOCSPADDRESS = -9,
SPC_OCSPRESULT_ERROR_OUTOFMEMORY = -8,
SPC_OCSPRESULT_ERROR_UNKNOWN = -7,
SPC_OCSPRESULT_ERROR_UNAUTHORIZED = -6,
SPC_OCSPRESULT_ERROR_SIGREQUIRED = -5,
SPC_OCSPRESULT_ERROR_TRYLATER = -3,
SPC_OCSPRESULT_ERROR_INTERNALERROR = -2,
SPC_OCSPRESULT_ERROR_MALFORMEDREQUEST = -1,
564 | Chapter 10: Public Key Infrastructure
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.