Client

RFC 6960 OCSP codec. build() assembles an OCSPRequest with a SHA-1 CertID over the issuer's subject Name and public key and the target's serial number. parseResponse() applies the RFC 6960 section 3.2 acceptance rules before a response is used: successful status, a basic response type, a signature that verifies against a responder the issuer authorised and that is itself inside its validity period, a CertID matching the request, a good certificate status, and a validity interval that covers the moment of use.

Table of contents

Namespace: Com\Tecnick\Pdf\Sign\Ocsp

Final: Yes

File: Client.php line 53

RFC 6960 OCSP codec. build() assembles an OCSPRequest with a SHA-1 CertID over the issuer’s subject Name and public key and the target’s serial number. parseResponse() applies the RFC 6960 section 3.2 acceptance rules before a response is used: successful status, a basic response type, a signature that verifies against a responder the issuer authorised and that is itself inside its validity period, a CertID matching the request, a good certificate status, and a validity interval that covers the moment of use.

Rule 5, that thisUpdate is sufficiently recent, is applied whether or not the response carries a nextUpdate: a response is accepted only while it is younger than $maxAge.

HTTP transport is injected into fetch(), so the codec performs no network access and the host controls networking and SSRF protection.

Tags

Constants

CLOCK_SKEW

File: Client.php line 102

public mixed CLOCK_SKEW = 300

DEFAULT_MAX_AGE

File: Client.php line 107

public mixed DEFAULT_MAX_AGE = 604800

MAX_RESPONDER_CERTIFICATES

File: Client.php line 115

public mixed MAX_RESPONDER_CERTIFICATES = \Com\Tecnick\Pdf\Sign\Cms\Certificate::MAX_EMBEDDED_CERTIFICATES

Read from Cms\Certificate, as Signer::MAX_PATH_CERTIFICATES is, so every unauthenticated certificate bag is held to the same bound.

Methods

__construct()

File: Client.php line 131

public __construct([Asn1|null $asn1 = null ][, Certificate|null $certificate = null ][, SignatureVerifier|null $verifier = null ][, int $maxAge = self::DEFAULT_MAX_AGE ][, int $clockSkew = self::CLOCK_SKEW ]) : mixed

Parameters

  • $asn1 : Asn1|null = null
  • $certificate : Certificate|null = null
  • $verifier : SignatureVerifier|null = null
  • $maxAge : int = self::DEFAULT_MAX_AGE: Age limit applied to thisUpdate, in seconds. Zero disables the bound.
  • $clockSkew : int = self::CLOCK_SKEW: Skew tolerated between the response validity interval and the moment of use, in seconds.

Tags

  • throws: Exception If the age limit or the skew is negative.

build()

File: Client.php line 166

public build(string $issuerDer, string $leafDer) : Request

No nonce extension is sent: RFC 6960 section 4.4.1 makes it optional and many responders pre-sign and reject it. The response age is bounded by $maxAge instead.

Parameters

  • $issuerDer : string: DER of the issuing certificate.
  • $leafDer : string: DER of the certificate whose status is queried.

Tags

  • throws: Exception If either certificate cannot be parsed or encoded, or the issuer did not issue the leaf.

Return values

Request —

The DER request and the CertID a response has to quote back.

fetch()

File: Client.php line 232

public fetch(string $url, string $issuerDer, string $leafDer, callable $transport[, int|null $now = null ]) : string

Parameters

  • $url : string: OCSP responder URL.
  • $issuerDer : string: DER of the issuing certificate.
  • $leafDer : string: DER of the target certificate.
  • $transport : callable: Receives (url, DER request) and must return the DER response string.
  • $now : int|null = null: Unix time the validity interval is checked against; defaults to the current time.

Tags

  • throws: Exception If building, transport, or validation fails.

Return values

string —

The DER response bytes, once accepted.

parseResponse()

File: Client.php line 267

public parseResponse(string $response, Request $request[, int|null $now = null ]) : string

Applies the RFC 6960 section 3.2 acceptance rules. A response that fails any of them is rejected rather than returned.

Parameters

  • $response : string: DER-encoded OCSPResponse.
  • $request : Request: The request this response answers.
  • $now : int|null = null: Unix time the validity interval is checked against; defaults to the current time.

Tags

  • throws: RevokedException If the responder states that the certificate is revoked.
  • throws: Exception If the response is malformed, unsuccessful, unmatched, not good, or outside its validity interval.

Return values

string —

The response bytes unchanged, once accepted.