michael@0: /* This Source Code Form is subject to the terms of the Mozilla Public
michael@0:  * License, v. 2.0. If a copy of the MPL was not distributed with this
michael@0:  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
michael@0: 
michael@0: // Implements generating OCSP responses of various types. Used by the
michael@0: // programs in tlsserver/cmd.
michael@0: 
michael@0: #ifndef OCSPCommon_h
michael@0: #define OCSPCommon_h
michael@0: 
michael@0: #include "certt.h"
michael@0: #include "seccomon.h"
michael@0: 
michael@0: enum OCSPResponseType
michael@0: {
michael@0:   ORTNull = 0,
michael@0:   ORTGood,             // the certificate is good
michael@0:   ORTRevoked,          // the certificate has been revoked
michael@0:   ORTRevokedOld,       // same, but the response is old
michael@0:   ORTUnknown,          // the responder doesn't know if the cert is good
michael@0:   ORTUnknownOld,       // same, but the response is old
michael@0:   ORTGoodOtherCert,    // the response references a different certificate
michael@0:   ORTGoodOtherCA,      // the wrong CA has signed the response
michael@0:   ORTExpired,          // the signature on the response has expired
michael@0:   ORTExpiredFreshCA,   // fresh signature, but old validity period
michael@0:   ORTNone,             // no stapled response
michael@0:   ORTEmpty,            // an empty stapled response
michael@0:   ORTMalformed,        // the response from the responder was malformed
michael@0:   ORTSrverr,           // the response indicates there was a server error
michael@0:   ORTTryLater,         // the responder replied with "try again later"
michael@0:   ORTNeedsSig,         // the response needs a signature
michael@0:   ORTUnauthorized,     // the responder is not authorized for this certificate
michael@0:   ORTBadSignature,     // the response has a signature that does not verify
michael@0:   ORTSkipResponseBytes, // the response does not include responseBytes
michael@0:   ORTCriticalExtension, // the response includes a critical extension
michael@0:   ORTNoncriticalExtension, // the response includes an extension that is not critical
michael@0:   ORTEmptyExtensions,  // the response includes a SEQUENCE OF Extension that is empty
michael@0:   ORTDelegatedIncluded, // the response is signed by an included delegated responder
michael@0:   ORTDelegatedIncludedLast, // same, but multiple other certificates are included
michael@0:   ORTDelegatedMissing, // the response is signed by a not included delegated responder
michael@0:   ORTDelegatedMissingMultiple, // same, but multiple other certificates are included
michael@0:   ORTLongValidityAlmostExpired, // a good response, but that was generated a almost a year ago
michael@0:   ORTAncientAlmostExpired, // a good response, with a validity of almost two years almost expiring
michael@0: };
michael@0: 
michael@0: struct OCSPHost
michael@0: {
michael@0:   const char *mHostName;
michael@0:   OCSPResponseType mORT;
michael@0:   const char *mAdditionalCertName; // useful for ORTGoodOtherCert, etc.
michael@0: };
michael@0: 
michael@0: SECItemArray *
michael@0: GetOCSPResponseForType(OCSPResponseType aORT, CERTCertificate *aCert,
michael@0:                        PLArenaPool *aArena, const char *aAdditionalCertName);
michael@0: 
michael@0: #endif // OCSPCommon_h