function FreshOcspResponse(const Der: TBytes; UtcNow: TDateTime): Boolean;
function CryptoUtcNow: TDateTime;
| Function | Description |
|---|---|
FreshOcspResponse | Returns True only when Der has a bounded, successful basic OCSP response structure and every included response passes the freshness checks against UtcNow; this is a prefilter and never authenticates the evidence |
CryptoUtcNow | Returns the current UTC TDateTime, using the platform time-zone conversion rather than treating local time as UTC |
| Check | Limit or behavior |
|---|---|
| DER response size | Nonempty and at most 1 MiB |
| SingleResponse entries | At least one, with a hard limit of 64 |
| Clock skew | 300 seconds for future or expiry comparisons |
producedAt and thisUpdate | At most one day old and not beyond the permitted future skew |
nextUpdate | When present, must not precede thisUpdate and must remain valid within the permitted skew |
| Malformed or unsupported response | Returns False, including an unsuccessful outer OCSP response or an unsupported response type |
A True result only permits the native verifier to examine the response. It does not prove a responder signature, responder authority, issuer match, certificate identifier, or positive certificate status
FPdfCryptoSsl authenticates OCSP through OpenSSL, and FPdfCryptoMac authenticates supplied responses through Security.framework. Applications should inspect their independent signature, trust, and revocation results rather than using FreshOcspResponse as a revocation verdict
The helper performs no HTTP requests, adds no trust anchors, changes no system trust, and does not use a persistent cache. Callers supply UTC explicitly, which also permits deterministic time-boundary testing