BuildOCSPRequest

Digital signatures

Description

Encodes an RFC 6960 OCSP status request for a certificate.

Syntax

Delphi

Function TPDFlib.BuildOCSPRequest(Const SubjectCertDER, IssuerCertDER: AnsiString): AnsiString;

Parameters

SubjectCertDER	The certificate whose status is being asked about, DER encoded.
IssuerCertDER	The certificate that issued it, DER encoded.

Return values

Request	The OCSPRequest, DER encoded.
Empty string	Either certificate could not be read, or the two do not belong together; GetTimeStampError carries the reason.

Remarks

The CertID is built from the subject certificate's issuer name and serial number and the issuer certificate's public key, hashed with SHA-1 as RFC 6960 §4.1.1 fixes. The hash identifies the certificate; it does not protect anything.

The pair is checked before anything is encoded: the subject certificate's issuer name must be the issuer certificate's subject name. A mismatched pair produces a request the responder answers with unknown, which reads like a revocation problem rather than a caller mistake, so it is refused here instead.

No nonce is requested. Many authorities serve pre-produced responses and reject a nonced request outright, and a response stored in the document security store is validated later rather than checked live.