Check OCSP status (one response for one certificate: CertID, responder, freshness, nonce)
check_ocsp_statusVerify one fetched OCSP response against its certificate and issuer: recompute the CertID, check signer authorization, nonce and freshness, then return a good, revoked, or unknown verdict.
Instructions
The RFC 6960 verdict of ONE OCSP response you fetched (this server never queries a responder) for ONE certificate: the CertID is recomputed from issuer (with the hash the response used, or hashAlgorithm) and must be answered; the signature is verified with responder, else the certificates embedded in the response, else the issuer itself; the signer must be authorised (RFC 6960 §4.2.2.2: the CA, a delegate the CA issued carrying id-kp-OCSPSigning, or responderTrusted:true for a trust you hold out of band); then the engine judges the status (good; PKI_REASON_REVOKED / unknown otherwise), freshness at at (thisUpdate / nextUpdate / producedAt, staleTolerance and futureTolerance ms), and the nonce (nonce must be echoed; requireNonce:true refuses a response without one). A non-successful response status is a negative verdict with status null. valid:false + reasons[] is a verdict, never isError. Pin at for a reproducible, cacheable verdict. Token-frugal: verbosity:'summary' (valid, reasonCodes, status, signatureVerified, responderAuthorized, responder). create_ocsp_request builds the request you POST; inspect_ocsp_response shows the facts without a verdict.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| at | No | The instant the verdict is evaluated at. An ISO 8601 date-time (UTC unless zoned; e.g. 2027-01-01T00:00:00Z), epoch milliseconds as digits, or 'now'. Omitted: PKINATIVE_MCP_AT when the operator pinned it, else the wall clock (a clock-dependent result is never cached). | |
| nonce | No | The nonce you put in the request (1–32 bytes; create_ocsp_request summary.nonceHex): the response must echo it. Hexadecimal (an 0x prefix, colons and spaces are tolerated). | |
| fields | No | Dot-paths to keep after verbosity (arrays map over elements); unmatched paths land in _meta.unmatchedFields. | |
| issuer | Yes | The CA certificate that issued it: exactly one of pem / derBase64 / path. Its name and key hashes form the CertID to match, and it is the authority a responder must be (or be delegated by). | |
| limits | No | Raise pkinative's 22 named security bounds for this call (trusted input only; absent keys keep the engine defaults). A value above an operator ceiling (PKINATIVE_MCP_MAX_INPUT_BYTES, PKINATIVE_MCP_MAX_KDF_ITERATIONS, PKINATIVE_MCP_MAX_PATHS_EXPLORED) is LIMIT_CEILING_EXCEEDED; describe_engine lists the defaults and the ceilings. | |
| strict | No | Escalate the first engine warning to a PKI_STRICT_DIAGNOSTIC error instead of listing it in diagnostics[]. | |
| pemMode | No | 'strict' (RFC 7468 exactly, default) or 'lax' (tolerates whitespace, line length and RFC 1421 headers). | strict |
| response | Yes | The OCSP response (DER, as the responder returned it): exactly one of pem / derBase64 / path. | |
| allowSha1 | No | Accept or produce SHA-1 signatures (legacy material you already trust). Default false: refused with PKI_CRYPTO_ALGORITHM_REFUSED on read, VALIDATION_ERROR on write. | |
| responder | No | The responder certificate to verify the signature with: exactly one of pem / derBase64 / path. Omitted: the certificates embedded in the response are tried, then the issuer itself. | |
| verbosity | No | 'summary' keeps the scalar fields only (token-frugal). | full |
| certificate | Yes | The certificate whose status is asked: exactly one of pem / derBase64 / path. | |
| requireNonce | No | Refuse a response that carries no nonce (RFC 8954). | |
| encodingRules | No | 'der' (strict X.690 DER, default) or 'ber' (indefinite / non-minimal lengths and constructed strings, as legacy CMS producers write). | der |
| hashAlgorithm | No | The CertID hash to recompute with. Default: the one the response used for this serial, else SHA-1. | |
| staleTolerance | No | Milliseconds past nextUpdate the evidence is still accepted (default: the engine policy, none). | |
| futureTolerance | No | Milliseconds a thisUpdate / producedAt may lie after `at` (clock skew) and still be accepted (default: the engine policy). | |
| responderTrusted | No | State an out-of-band trust in the responder (RFC 6960 §4.2.2.2 third case): responderAuthorized is then true whatever its certificate says. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| valid | No | true = a fresh, correctly signed, authorised answer says good. false is a negative verdict (reasons[]: revoked, unknown, stale, unauthorised, unverified, nonce …), never an error. | |
| status | No | The status the response gives for this serial; null when the response holds no answer for it. | |
| reasons | No | Why the verdict is negative (empty when valid): the engine PKI_REASON_* codes, each with the standard it cites and the path of the offending element. A reason is returned, never thrown. | |
| certIdHex | No | The recomputed DER CertID (hex). | |
| responder | No | The subject of the certificate that verified the signature. | |
| diagnostics | No | Non-fatal concerns the engine raised (PKI_DIAG_*, de-duplicated, at most 200; explain_code explains one). | |
| evaluatedAt | No | The ISO instant used — re-pass it as `at` to reproduce the verdict. | |
| reasonCodes | No | ||
| hashAlgorithm | No | The hash the CertID was recomputed with. | |
| diagnosticCount | No | ||
| responderSource | No | Where the signer came from: the `responder` input, the certificates embedded in the response, or the issuer itself. | |
| diagnosticCounts | No | Occurrences per diagnostic code. | |
| evaluatedAtSource | No | ||
| signatureVerified | No | A responder candidate verified the response signature. | |
| responderAuthorized | No | The signer is the CA itself, a delegate the CA issued with id-kp-OCSPSigning, or responderTrusted was set. | |
| diagnosticsTruncated | No | true when distinct diagnostics beyond the 200 listed were dropped. |