THPDFOCSPNoncePolicy Type

Controls how strictly an OCSP response nonce must match the expected request nonce whilst revocation checking is under way

Declaration

THPDFOCSPNoncePolicy= (
  onpIgnore,
  onpMatchIfPresent,
  onpRequireMatch
  );

HPDFSignVerify

Value	Purpose
`onpIgnore`	Response nonces are never compared, so nonce presence or equality has no bearing on the revocation verdict
`onpMatchIfPresent`	Default; when the response carries a nonce, an expected nonce must be supplied and must match byte-for-byte; otherwise the evidence counts as unknown
`onpRequireMatch`	The response must carry a nonce, an expected nonce must be supplied and both must be equal; any other outcome counts the evidence as unknown

Set the policy via THPDFCertificateValidationOptions.OCSPNoncePolicy together with ExpectedOCSPNonce, whose length must lie between 1 and 32 bytes
The option record default is onpMatchIfPresent, which tolerates nonce-less responses but will not accept a nonce that does not match
The observed outcome is reported through THPDFCertificateValidationInfo.OCSPNoncePresent and OCSPNonceMatched