ol.clave.certificate.impl.ocsp
Pure Clojure OCSP (Online Certificate Status Protocol) utilities.
Provides functionality to: - Extract OCSP responder URLs from certificates - Fetch OCSP responses from responders - Parse and validate OCSP responses
extract-ocsp-urls
(extract-ocsp-urls cert)
Extract OCSP responder URLs from a certificate’s AIA extension.
Returns a vector of OCSP URLs, or empty vector if none found.
| key | description |
|-----|-------------|
| cert | X509Certificate to extract OCSP URLs from |
create-ocsp-request
(create-ocsp-request cert issuer)
Create an OCSP request for a certificate.
Requires both the leaf certificate and its issuer certificate. Returns the DER-encoded OCSP request bytes.
parse-ocsp-response
(parse-ocsp-response response-bytes)
Parse an OCSP response and extract status information.
Returns a map with:
- :status - One of :good, :revoked, :unknown, or :error
- :this-update - When this response was generated
- :next-update - When the response expires
- :revocation-time - For revoked certs, when it was revoked
- :revocation-reason - For revoked certs, the reason code
- :raw-bytes - The original DER-encoded response
- :error-code - For error responses, the OCSP error code
- :message - For error responses, the error message
fetch-ocsp-response
(fetch-ocsp-response cert issuer responder-url http-opts)
Fetch OCSP response for a certificate from the specified responder.
| key | description |
|-----|-------------|
| cert | The X509Certificate to check |
| issuer | The issuer certificate |
| responder-url | URL of the OCSP responder |
| http-opts | HTTP client options map |
Returns a result map:
- On success: {:status :success :ocsp-response {…}}
- On failure: {:status :error :message "…"}
fetch-ocsp-for-bundle
(fetch-ocsp-for-bundle bundle http-opts responder-overrides)
Fetch OCSP response for a certificate bundle.
Extracts the OCSP URL from the leaf certificate and fetches the response. Supports responder URL overrides for testing.
| key | description |
|-----|-------------|
| bundle | Certificate bundle with :certificate chain |
| http-opts | HTTP client options |
| responder-overrides | Optional map of original-url → override-url |
Returns a result map:
- On success: {:status :success :ocsp-response {…}}
- On failure: {:status :error :message "…"}