Unicode C
Unicode C
Validate Certificate using OCSP Protocol
See more Certificates Examples
Demonstrates how to validate a certificate (check the revoked status) using the OCSP protocol.Chilkat Unicode C Downloads
#include <C_CkCertW.h>
#include <C_CkPrngW.h>
#include <C_CkJsonObjectW.h>
#include <C_CkBinDataW.h>
#include <C_CkHttpW.h>
#include <C_CkHttpResponseW.h>
void ChilkatSample(void)
{
BOOL success;
HCkCertW cert;
const wchar_t *ocspUrl;
const wchar_t *hashAlg;
HCkPrngW prng;
HCkJsonObjectW json;
HCkBinDataW ocspRequest;
HCkHttpW http;
HCkHttpResponseW resp;
HCkBinDataW ocspReply;
HCkJsonObjectW jsonReply;
int ocspStatus;
int certStatus;
success = FALSE;
// This requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.
// This example will check the revoked status of a certificate loaded from a file.
cert = CkCertW_Create();
success = CkCertW_LoadFromFile(cert,L"qa_data/certs/google.crt");
if (success == FALSE) {
wprintf(L"%s\n",CkCertW_lastErrorText(cert));
CkCertW_Dispose(cert);
return;
}
// Get the cert's OCSP URL.
ocspUrl = CkCertW_ocspUrl(cert);
// Build the JSON that will be the OCSP request.
// Possible hash algorithms are sha1, sha256, sha384, sha512.
hashAlg = L"sha256";
prng = CkPrngW_Create();
json = CkJsonObjectW_Create();
CkJsonObjectW_putEmitCompact(json,FALSE);
// Read more about OCSP nonce lengths
CkJsonObjectW_UpdateString(json,L"extensions.ocspNonce",CkPrngW_genRandom(prng,16,L"base64"));
CkJsonObjectW_putI(json,0);
CkJsonObjectW_UpdateString(json,L"request[i].cert.hashAlg",hashAlg);
CkJsonObjectW_UpdateString(json,L"request[i].cert.issuerNameHash",CkCertW_hashOf(cert,L"IssuerDN",hashAlg,L"base64"));
CkJsonObjectW_UpdateString(json,L"request[i].cert.issuerKeyHash",CkCertW_hashOf(cert,L"IssuerPublicKey",hashAlg,L"base64"));
CkJsonObjectW_UpdateString(json,L"request[i].cert.serialNumber",CkCertW_serialNumber(cert));
wprintf(L"%s\n",CkJsonObjectW_emit(json));
// Our OCSP request looks something like this:
// {
// "extensions": {
// "ocspNonce": "qZDfbpO+nUxRzz6c/SPjE5QCAsPfpkQlRDxTnGl0gnxt7iXO"
// },
// "request": [
// {
// "cert": {
// "hashAlg": "sha1",
// "issuerNameHash": "9u2wY2IygZo19o11oJ0CShGqbK0=",
// "issuerKeyHash": "d8K4UJpndnaxLcKG0IOgfqZ+uks=",
// "serialNumber": "6175535D87BF94B6"
// }
// }
// ]
// }
ocspRequest = CkBinDataW_Create();
http = CkHttpW_Create();
// Convert our JSON to a binary (ASN.1) OCSP request
success = CkHttpW_CreateOcspRequest(http,json,ocspRequest);
if (success == FALSE) {
wprintf(L"%s\n",CkHttpW_lastErrorText(http));
CkCertW_Dispose(cert);
CkPrngW_Dispose(prng);
CkJsonObjectW_Dispose(json);
CkBinDataW_Dispose(ocspRequest);
CkHttpW_Dispose(http);
return;
}
// Send the OCSP request to the OCSP server
resp = CkHttpResponseW_Create();
success = CkHttpW_HttpBd(http,L"POST",ocspUrl,ocspRequest,L"application/ocsp-request",resp);
if (success == FALSE) {
wprintf(L"%s\n",CkHttpW_lastErrorText(http));
CkCertW_Dispose(cert);
CkPrngW_Dispose(prng);
CkJsonObjectW_Dispose(json);
CkBinDataW_Dispose(ocspRequest);
CkHttpW_Dispose(http);
CkHttpResponseW_Dispose(resp);
return;
}
// Get the binary (ASN.1) OCSP reply
ocspReply = CkBinDataW_Create();
CkHttpResponseW_GetBodyBd(resp,ocspReply);
// Convert the binary reply to JSON.
// Also returns the overall OCSP response status.
jsonReply = CkJsonObjectW_Create();
ocspStatus = CkHttpW_ParseOcspReply(http,ocspReply,jsonReply);
// The ocspStatus can have one of these values:
// -1: The ARG1 does not contain a valid OCSP reply.
// 0: Successful - Response has valid confirmations..
// 1: Malformed request - Illegal confirmation request.
// 2: Internal error - Internal error in issuer.
// 3: Try later - Try again later.
// 4: Not used - This value is never returned.
// 5: Sig required - Must sign the request.
// 6: Unauthorized - Request unauthorized.
if (ocspStatus < 0) {
wprintf(L"Invalid OCSP reply.\n");
CkCertW_Dispose(cert);
CkPrngW_Dispose(prng);
CkJsonObjectW_Dispose(json);
CkBinDataW_Dispose(ocspRequest);
CkHttpW_Dispose(http);
CkHttpResponseW_Dispose(resp);
CkBinDataW_Dispose(ocspReply);
CkJsonObjectW_Dispose(jsonReply);
return;
}
wprintf(L"Overall OCSP Response Status: %d\n",ocspStatus);
// Let's examine the OCSP response (in JSON).
CkJsonObjectW_putEmitCompact(jsonReply,FALSE);
wprintf(L"%s\n",CkJsonObjectW_emit(jsonReply));
// The JSON reply looks like this:
// (Use the online tool at https://tools.chilkat.io/jsonParse.cshtml
// to generate JSON parsing code.)
// {
// "responseStatus": 0,
// "responseTypeOid": "1.3.6.1.5.5.7.48.1.1",
// "responseTypeName": "ocspBasic",
// "response": {
// "responderIdChoice": "KeyHash",
// "responderKeyHash": "d8K4UJpndnaxLcKG0IOgfqZ+uks=",
// "dateTime": "20180803193937Z",
// "cert": [
// {
// "hashOid": "1.3.14.3.2.26",
// "hashAlg": "SHA-1",
// "issuerNameHash": "9u2wY2IygZo19o11oJ0CShGqbK0=",
// "issuerKeyHash": "d8K4UJpndnaxLcKG0IOgfqZ+uks=",
// "serialNumber": "6175535D87BF94B6",
// "status": 0,
// "thisUpdate": "20180803193937Z",
// "nextUpdate": "20180810193937Z"
// }
// ]
// }
// }
//
// The certificate status:
certStatus = -1;
if (CkJsonObjectW_HasMember(jsonReply,L"response.cert[0].status") == TRUE) {
certStatus = CkJsonObjectW_IntOf(jsonReply,L"response.cert[0].status");
}
// Possible certStatus values are:
// -1: No status returned.
// 0: Good
// 1: Revoked
// 2: Unknown.
wprintf(L"Certificate Status: %d\n",certStatus);
CkCertW_Dispose(cert);
CkPrngW_Dispose(prng);
CkJsonObjectW_Dispose(json);
CkBinDataW_Dispose(ocspRequest);
CkHttpW_Dispose(http);
CkHttpResponseW_Dispose(resp);
CkBinDataW_Dispose(ocspReply);
CkJsonObjectW_Dispose(jsonReply);
}