Documentation
¶
Index ¶
- func CreateOCSPRequest(cert *x509.Certificate, issuer *x509.Certificate) ([]byte, error)
- func GenerateOCSPResponse(config *OCSPConfig) ([]byte, error)
- func ParseOCSPRequest(reqBytes []byte) (map[string]interface{}, error)
- func ParseOCSPResponse(respBytes []byte, issuer *x509.Certificate) (map[string]interface{}, error)
- func VerifyOCSPResponse(respBytes []byte, cert *x509.Certificate, issuer *x509.Certificate) (map[string]interface{}, error)
- type OCSPCertificateStatus
- type OCSPConfig
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CreateOCSPRequest ¶
func CreateOCSPRequest(cert *x509.Certificate, issuer *x509.Certificate) ([]byte, error)
CreateOCSPRequest creates a DER-encoded OCSP request for cert, issued by issuer.
func GenerateOCSPResponse ¶
func GenerateOCSPResponse(config *OCSPConfig) ([]byte, error)
GenerateOCSPResponse generates a signed OCSP response for the certificate described by config.
func ParseOCSPRequest ¶
ParseOCSPRequest parses a DER-encoded OCSP request.
func ParseOCSPResponse ¶
func ParseOCSPResponse(respBytes []byte, issuer *x509.Certificate) (map[string]interface{}, error)
ParseOCSPResponse parses an OCSP response, verifying its signature against issuer.
func VerifyOCSPResponse ¶
func VerifyOCSPResponse( respBytes []byte, cert *x509.Certificate, issuer *x509.Certificate, ) (map[string]interface{}, error)
VerifyOCSPResponse parses and verifies an OCSP response against the given certificate and issuer.
Types ¶
type OCSPCertificateStatus ¶
type OCSPCertificateStatus struct {
Serial *big.Int
Status string // "good", "revoked", or "unknown"
ThisUpdate time.Time
NextUpdate time.Time
RevocationTime time.Time
RevocationReason string
ResponderURL string
ProducedAt time.Time
}
OCSPCertificateStatus represents the status of a certificate in OCSP
func CheckCertificateStatus ¶
func CheckCertificateStatus( cert *x509.Certificate, issuer *x509.Certificate, ocspURL string, ) (*OCSPCertificateStatus, error)
CheckCertificateStatus checks the status of a certificate by building an OCSP request, POSTing it to the responder, and verifying the signed response against issuer. If ocspURL is empty, the responder URL is taken from cert's Authority Information Access extension (cert.OCSPServer).
type OCSPConfig ¶
type OCSPConfig struct {
// OCSP responder certificate (should be signed by CA)
ResponderCertificate *x509.Certificate
// OCSP responder private key
ResponderPrivateKey crypto.PrivateKey
// CA certificate
CACertificate *x509.Certificate
// Certificate to create response for
Certificate *x509.Certificate
// Certificate status (0 = good, 1 = revoked, 2 = unknown)
Status int
// Revocation time (if revoked)
RevocationTime time.Time
// Revocation reason (if revoked)
RevocationReason int
// This update time
ThisUpdate time.Time
// Next update time
NextUpdate time.Time
}
OCSPConfig holds configuration for OCSP responder
Source Files