Botan::Cert_Extension::OCSP_NoCheck Class Reference

#include <x509_ext.h>

Inheritance diagram for Botan::Cert_Extension::OCSP_NoCheck:

Public Member Functions
std::unique_ptr< Certificate_Extension >	copy () const override
	OCSP_NoCheck ()=default
OID	oid_of () const override
void	validate (const X509_Certificate &subject, const std::optional< X509_Certificate > &issuer, const std::vector< X509_Certificate > &cert_path, std::vector< std::set< Certificate_Status_Code > > &cert_status, size_t pos) const override

Static Public Member Functions
static OID	static_oid ()

Detailed Description

OCSP NoCheck Extension

RFC6960 4.2.2.2.1 A CA may specify that an OCSP client can trust a responder for the lifetime of the responder's certificate. The CA does so by including the extension id-pkix-ocsp-nocheck.

In other words: OCSP responder certificates with this extension do not need to be validated against some revocation info.

Definition at line 785 of file x509_ext.h.

Constructor & Destructor Documentation

OCSP_NoCheck()

Botan::Cert_Extension::OCSP_NoCheck::OCSP_NoCheck ( )

default

Member Function Documentation

copy()

std::unique_ptr< Certificate_Extension > Botan::Cert_Extension::OCSP_NoCheck::copy ( ) const

inlineoverridevirtual

Make a copy of this extension

Returns

copy of this

Implements Botan::Certificate_Extension.

Definition at line 789 of file x509_ext.h.

{ return std::make_unique<OCSP_NoCheck>(); }

oid_of()

OID Botan::Cert_Extension::OCSP_NoCheck::oid_of ( ) const

inlineoverridevirtual

Return object identifier for this extension

Returns

OID representing this extension

Implements Botan::Certificate_Extension.

Definition at line 793 of file x509_ext.h.

{ return static_oid(); }

References static_oid().

static_oid()

OID Botan::Cert_Extension::OCSP_NoCheck::static_oid ( )

inlinestatic

Definition at line 791 of file x509_ext.h.

{ return OID({1, 3, 6, 1, 5, 5, 7, 48, 1, 5}); }

Referenced by oid_of().

validate()

void Botan::Cert_Extension::OCSP_NoCheck::validate ( const X509_Certificate & subject, const std::optional< X509_Certificate > & issuer, const std::vector< X509_Certificate > & cert_path, std::vector< std::set< Certificate_Status_Code > > & cert_status, size_t pos ) const

overridevirtual

Callback visited during path validation.

An extension can implement this callback to inspect the path during path validation.

If an error occurs during validation of this extension, an appropriate status code shall be added to cert_status.

Parameters

subject	Subject certificate that contains this extension
issuer	Issuer certificate. nullopt for certificates with no available issuer (e.g. non self-signed trust anchors).
cert_path	Certificate path which is currently validated
cert_status	Certificate validation status codes for subject certificate
pos	Position of subject certificate in cert_path

Reimplemented from Botan::Certificate_Extension.

Definition at line 2514 of file x509_ext.cpp.

                                              {
   /*
   * RFC 6960 is not particularly explicit about when id-pkix-ocsp-nocheck can
   * or cannot be included in a certificate, but reasonably we should require
   * that id-pkix-ocsp-nocheck is only included for certificates that are marked
   * as OCSP responders. This checks for compatible key usage and also the OCSP
   * signer extended key usage.
   */
   if(!subject.allowed_usage(Usage_Type::OCSP_RESPONDER)) {
      cert_status.at(pos).insert(Certificate_Status_Code::INVALID_OCSP_NOCHECK);
   }
}

References Botan::X509_Certificate::allowed_usage(), Botan::INVALID_OCSP_NOCHECK, and Botan::OCSP_RESPONDER.

---

The documentation for this class was generated from the following files:

• src/lib/x509/x509_ext.h
• src/lib/x509/x509_ext.cpp