OCSP Client#

OCSP client to check the revocation status of RIM and device identity certificate chains.

Enumerations#

nvat_ocsp_cert_id_hash_algorithm_t

Hash algorithm used to construct an OCSP CertID.

Functions#

nvat_rc_t nvat_ocsp_cert_id_hash_algorithm_from_name(const char *name, nvat_ocsp_cert_id_hash_algorithm_t *out_algorithm)

Parse a CertID hash algorithm name.

nvat_rc_t nvat_ocsp_client_create_aia(nvat_ocsp_client_t *out_client, const char *base_url, const char *service_key, const nvat_http_options_t http_options, const char *const *rewrite_patterns, const char *const *rewrite_replacements, size_t num_rewrites, const nvat_ocsp_client_options_t options)

Create an OCSP client that derives each responder URL from the certificate's Authority Information Access extension — the client required by the V2 local CoRIM verifier.

nvat_rc_t nvat_ocsp_client_create_cached(nvat_ocsp_client_t *out_client, const nvat_ocsp_client_t inner_client, uint64_t max_size_bytes, time_t ttl_seconds)

Create a cached OCSP client that wraps an existing OCSP client.

nvat_rc_t nvat_ocsp_client_create_default(nvat_ocsp_client_t *out_client, const char *base_url, const char *service_key, const nvat_http_options_t http_options)

Create an OCSP client with default settings.

nvat_rc_t nvat_ocsp_client_create_default_with_options(nvat_ocsp_client_t *out_client, const char *base_url, const char *service_key, const nvat_http_options_t http_options, const nvat_ocsp_client_options_t options)

Create an OCSP client with explicit construction options.

void nvat_ocsp_client_free(nvat_ocsp_client_t *ocsp_client)

nvat_rc_t nvat_ocsp_client_options_create_default(nvat_ocsp_client_options_t *out_options)

Allocate OCSP client construction options with SHA-256 defaults.

void nvat_ocsp_client_options_free(nvat_ocsp_client_options_t *options)

nvat_rc_t nvat_ocsp_client_options_set_cert_id_hash_algorithm(nvat_ocsp_client_options_t options, nvat_ocsp_cert_id_hash_algorithm_t algorithm)

Set the hash algorithm used to construct OCSP CertIDs.

Typedefs#

nvat_ocsp_client_options_t

Construction options for an OCSP client.

nvat_ocsp_client_t

Enumerations#

enum nvat_ocsp_cert_id_hash_algorithm_t#

Hash algorithm used to construct an OCSP CertID.

Values:

enumerator NVAT_OCSP_CERT_ID_HASH_SHA256#
enumerator NVAT_OCSP_CERT_ID_HASH_SHA1#
enumerator NVAT_OCSP_CERT_ID_HASH_SHA384#

Functions#

nvat_rc_t nvat_ocsp_cert_id_hash_algorithm_from_name(
const char *name,
nvat_ocsp_cert_id_hash_algorithm_t *out_algorithm,
)#

Parse a CertID hash algorithm name.

Accepts SHA-1, SHA-256, and SHA-384, with or without a hyphen and case-insensitively.

Parameters:

  • name – Algorithm name to parse. Must not be NULL.

  • out_algorithm – Receives the parsed algorithm. Must not be NULL.

nvat_rc_t nvat_ocsp_client_create_aia(
nvat_ocsp_client_t *out_client,
const char *base_url,
const char *service_key,
const nvat_http_options_t http_options,
const char *const *rewrite_patterns,
const char *const *rewrite_replacements,
size_t num_rewrites,
const nvat_ocsp_client_options_t options,
)#

Create an OCSP client that derives each responder URL from the certificate’s Authority Information Access extension — the client required by the V2 local CoRIM verifier.

Unlike nvat_ocsp_client_create_default, AIA responder lookup is on: the responder URL is taken from each certificate’s AIA extension. A certificate that carries no AIA responder is skipped (its revocation status is not checked) rather than falling back to base_url. URL rewrites and the AIA behavior are fixed at construction, so the client is safe to wrap with nvat_ocsp_client_create_cached. The options are copied during this call and remain owned by the caller. Passing NULL uses fixed SHA-256 defaults and does not consult NVAT_OCSP_CERT_ID_HASH_ALGORITHM.

Parameters:

  • out_client – On success, receives the client handle.

  • base_url – Default responder URL used at construction. NULL uses the default. Not consulted per-certificate when AIA lookup is on.

  • service_key – Service key for authenticated calls. NULL or “” for none.

  • http_options – HTTP options. NULL uses defaults.

  • rewrite_patterns – Prefix-substitution patterns applied to the responder URL before the request; first match wins. NULL when num_rewrites is 0.

  • rewrite_replacements – Replacements paired with rewrite_patterns.

  • num_rewrites – Number of entries in the rewrite arrays.

  • options – Construction options to copy. NULL uses fixed SHA-256.

nvat_rc_t nvat_ocsp_client_create_cached(
nvat_ocsp_client_t *out_client,
const nvat_ocsp_client_t inner_client,
uint64_t max_size_bytes,
time_t ttl_seconds,
)#

Create a cached OCSP client that wraps an existing OCSP client.

Ownership: On success, the inner_client is safe to be free’d as it is refcounted

Parameters:

  • inner_client – The inner OCSP client to wrap. Must not be NULL.

  • max_size_bytes – The maximum size of the cache in bytes.

  • ttl_seconds – The time-to-live for cached items in seconds. The ocsp response will be cached for min(ttl_seconds, ocsp response next update time)

nvat_rc_t nvat_ocsp_client_create_default(
nvat_ocsp_client_t *out_client,
const char *base_url,
const char *service_key,
const nvat_http_options_t http_options,
)#

Create an OCSP client with default settings.

Ownership

: On success, the caller assumes ownership of the allocated nvat_ocsp_client_t handle. The client is refcounted and safe to share between multiple verifier components.

URL can also be set using the NVAT_OCSP_BASE_URL environment variable.

Parameters:

  • base_url – If NULL, the default base URL of the NVIDIA OCSP Response is used.

  • http_options – If NULL, default HTTP options will be used.

nvat_rc_t nvat_ocsp_client_create_default_with_options(
nvat_ocsp_client_t *out_client,
const char *base_url,
const char *service_key,
const nvat_http_options_t http_options,
const nvat_ocsp_client_options_t options,
)#

Create an OCSP client with explicit construction options.

The options are copied during this call and remain owned by the caller. Passing NULL uses fixed SHA-256 defaults and does not consult NVAT_OCSP_CERT_ID_HASH_ALGORITHM. Other environment-backed settings, such as the default base URL, retain their existing behavior.

Parameters:

  • out_client – On success, receives the client handle.

  • base_url – If NULL, the default base URL is used.

  • service_key – Service key for authenticated calls. NULL or “” for none.

  • http_options – HTTP options. NULL uses defaults.

  • options – Construction options to copy. NULL uses fixed SHA-256.

void nvat_ocsp_client_free(nvat_ocsp_client_t *ocsp_client)#
nvat_rc_t nvat_ocsp_client_options_create_default(
nvat_ocsp_client_options_t *out_options,
)#

Allocate OCSP client construction options with SHA-256 defaults.

Parameters:

  • out_options – On success, receives an options handle. Free with nvat_ocsp_client_options_free.

void nvat_ocsp_client_options_free(
nvat_ocsp_client_options_t *options,
)#
nvat_rc_t nvat_ocsp_client_options_set_cert_id_hash_algorithm(
nvat_ocsp_client_options_t options,
nvat_ocsp_cert_id_hash_algorithm_t algorithm,
)#

Set the hash algorithm used to construct OCSP CertIDs.

Parameters:

  • options – Options handle to update.

  • algorithm – CertID hash algorithm.

Typedefs#

typedef struct nvat_ocsp_client_options_st *nvat_ocsp_client_options_t#

Construction options for an OCSP client.

typedef struct nvat_ocsp_client_st *nvat_ocsp_client_t#