function FreshOcspResponse(const Der: TBytes; UtcNow: TDateTime): Boolean;
function CryptoUtcNow: TDateTime;
| Function | Description |
|---|---|
FreshOcspResponse | Returns True only if Der contains a size-limited, successful basic OCSP response and all its responses satisfy the freshness rules relative to UtcNow; the check filters input but does not authenticate evidence |
CryptoUtcNow | Obtains the current UTC TDateTime through platform time-zone conversion, rather than assuming that local time is UTC |
| Check | Limit or behaviour |
|---|---|
| DER response size | Must be nonempty and no larger than 1 MiB |
| SingleResponse entries | Requires at least one entry and accepts at most 64 |
| Clock skew | Allows 300 seconds when testing future times or expiry |
producedAt and thisUpdate | Must be no more than one day old or further into the future than the permitted skew |
nextUpdate | If supplied, must be at least thisUpdate and remain valid after allowing for skew |
| Malformed or unsupported response | Returns False for these inputs, including failed outer OCSP responses and unsupported response types |
True merely allows the native verifier to proceed with the response; it establishes neither the responder's signature or authority nor the issuer match, certificate identifier or positive certificate status
FPdfCryptoSsl authenticates OCSP using OpenSSL, whilst FPdfCryptoMac uses Security.framework for supplied responses; inspect their separate signature, trust and revocation results instead of treating FreshOcspResponse as a revocation decision
The helper makes no HTTP requests, installs no trust anchors, leaves system trust unchanged and keeps no persistent cache; supplying UTC explicitly also makes time-boundary tests deterministic