Struct OcspClient 

pub struct OcspClient { /* private fields */ }

OCSP client for checking certificate revocation status.

Thread-safe: all methods take &self and the cache uses DashMap for lock-free concurrent access.

Implementations

impl OcspClient

pub fn new(config: OcspConfig) -> Self

Creates a new OCSP client with the given configuration.

pub async fn check_certificate_status( &self, cert_der: &[u8], issuer_der: &[u8], ) -> OcspResult<OcspStatus>

Check the revocation status of a certificate.

Per RFC 6960 §4.1, builds an OCSPRequest with a CertID computed from the certificate and its issuer, sends it to the responder via HTTP POST with Content-Type application/ocsp-request, and parses the response.

Arguments

• cert_der - DER-encoded certificate to check
• issuer_der - DER-encoded issuer certificate (needed for CertID)

Errors

Returns OcspError if the request fails, the response is invalid, or the nonce does not match (when required).

pub async fn get_stapled_response( &self, server_cert_der: &[u8], issuer_der: &[u8], ) -> OcspResult<Vec<u8>>

Returns a stapled OCSP response for the EST server’s own certificate.

OCSP stapling (RFC 6066 §8) allows the server to include a pre-fetched OCSP response in the TLS handshake, avoiding the client needing to contact the OCSP responder separately.

Arguments

• server_cert_der - DER-encoded server certificate
• issuer_der - DER-encoded issuer certificate

Returns

The DER-encoded OCSP response suitable for TLS stapling, or an error if the response cannot be obtained.

pub fn evict_expired(&self)

Evict expired entries from the response cache.

pub fn cache_size(&self) -> usize

Returns the number of cached responses.