THPDFOCSPNoncePolicy Type

Controls how strictly an OCSP response nonce must match the expected request nonce during revocation checking

Declaration

THPDFOCSPNoncePolicy= (
  onpIgnore,
  onpMatchIfPresent,
  onpRequireMatch
  );

HPDFSignVerify

Value	Purpose
`onpIgnore`	Response nonces are never compared, so nonce presence or equality does not affect the revocation verdict
`onpMatchIfPresent`	Default; when the response carries a nonce, an expected nonce must be supplied and match byte-for-byte, otherwise the evidence counts as unknown
`onpRequireMatch`	The response must carry a nonce, an expected nonce must be supplied, and both must be equal; any other outcome counts the evidence as unknown

Set the policy through THPDFCertificateValidationOptions.OCSPNoncePolicy together with ExpectedOCSPNonce, whose length must be between 1 and 32 bytes
The option record default is onpMatchIfPresent, which tolerates nonce-less responses but rejects a nonce that does not match
The observed outcome is reported in THPDFCertificateValidationInfo.OCSPNoncePresent and OCSPNonceMatched