1-- From rfc2560 2-- $Id$ 3OCSP DEFINITIONS EXPLICIT TAGS::= 4 5BEGIN 6 7IMPORTS 8 Certificate, AlgorithmIdentifier, CRLReason, 9 Name, GeneralName, CertificateSerialNumber, Extensions 10 FROM rfc2459; 11 12OCSPVersion ::= INTEGER { ocsp-v1(0) } 13 14OCSPCertStatus ::= CHOICE { 15 good [0] IMPLICIT NULL, 16 revoked [1] IMPLICIT -- OCSPRevokedInfo -- SEQUENCE { 17 revocationTime GeneralizedTime, 18 revocationReason[0] EXPLICIT CRLReason OPTIONAL 19 }, 20 unknown [2] IMPLICIT NULL } 21 22OCSPCertID ::= SEQUENCE { 23 hashAlgorithm AlgorithmIdentifier, 24 issuerNameHash OCTET STRING, -- Hash of Issuer's DN 25 issuerKeyHash OCTET STRING, -- Hash of Issuers public key 26 serialNumber CertificateSerialNumber } 27 28OCSPSingleResponse ::= SEQUENCE { 29 certID OCSPCertID, 30 certStatus OCSPCertStatus, 31 thisUpdate GeneralizedTime, 32 nextUpdate [0] EXPLICIT GeneralizedTime OPTIONAL, 33 singleExtensions [1] EXPLICIT Extensions OPTIONAL } 34 35OCSPInnerRequest ::= SEQUENCE { 36 reqCert OCSPCertID, 37 singleRequestExtensions [0] EXPLICIT Extensions OPTIONAL } 38 39OCSPTBSRequest ::= SEQUENCE { 40 version [0] EXPLICIT OCSPVersion -- DEFAULT v1 -- OPTIONAL, 41 requestorName [1] EXPLICIT GeneralName OPTIONAL, 42 requestList SEQUENCE OF OCSPInnerRequest, 43 requestExtensions [2] EXPLICIT Extensions OPTIONAL } 44 45OCSPSignature ::= SEQUENCE { 46 signatureAlgorithm AlgorithmIdentifier, 47 signature BIT STRING, 48 certs [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL } 49 50OCSPRequest ::= SEQUENCE { 51 tbsRequest OCSPTBSRequest, 52 optionalSignature [0] EXPLICIT OCSPSignature OPTIONAL } 53 54OCSPResponseBytes ::= SEQUENCE { 55 responseType OBJECT IDENTIFIER, 56 response OCTET STRING } 57 58OCSPResponseStatus ::= ENUMERATED { 59 successful (0), --Response has valid confirmations 60 malformedRequest (1), --Illegal confirmation request 61 internalError (2), --Internal error in issuer 62 tryLater (3), --Try again later 63 --(4) is not used 64 sigRequired (5), --Must sign the request 65 unauthorized (6) --Request unauthorized 66} 67 68OCSPResponse ::= SEQUENCE { 69 responseStatus OCSPResponseStatus, 70 responseBytes [0] EXPLICIT OCSPResponseBytes OPTIONAL } 71 72OCSPKeyHash ::= OCTET STRING --SHA-1 hash of responder's public key 73 --(excluding the tag and length fields) 74 75OCSPResponderID ::= CHOICE { 76 byName [1] Name, 77 byKey [2] OCSPKeyHash } 78 79OCSPResponseData ::= SEQUENCE { 80 version [0] EXPLICIT OCSPVersion -- DEFAULT v1 -- OPTIONAL, 81 responderID OCSPResponderID, 82 producedAt GeneralizedTime, 83 responses SEQUENCE OF OCSPSingleResponse, 84 responseExtensions [1] EXPLICIT Extensions OPTIONAL } 85 86OCSPBasicOCSPResponse ::= SEQUENCE { 87 tbsResponseData OCSPResponseData, 88 signatureAlgorithm AlgorithmIdentifier, 89 signature BIT STRING, 90 certs [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL } 91 92-- ArchiveCutoff ::= GeneralizedTime 93 94-- AcceptableResponses ::= SEQUENCE OF OBJECT IDENTIFIER 95 96-- Object Identifiers 97 98id-pkix-ocsp OBJECT IDENTIFIER ::= { 99 iso(1) identified-organization(3) dod(6) internet(1) 100 security(5) mechanisms(5) pkix(7) pkix-ad(48) 1 101} 102 103id-pkix-ocsp-basic OBJECT IDENTIFIER ::= { id-pkix-ocsp 1 } 104id-pkix-ocsp-nonce OBJECT IDENTIFIER ::= { id-pkix-ocsp 2 } 105-- id-pkix-ocsp-crl OBJECT IDENTIFIER ::= { id-pkix-ocsp 3 } 106-- id-pkix-ocsp-response OBJECT IDENTIFIER ::= { id-pkix-ocsp 4 } 107-- id-pkix-ocsp-nocheck OBJECT IDENTIFIER ::= { id-pkix-ocsp 5 } 108-- id-pkix-ocsp-archive-cutoff OBJECT IDENTIFIER ::= { id-pkix-ocsp 6 } 109-- id-pkix-ocsp-service-locator OBJECT IDENTIFIER ::= { id-pkix-ocsp 7 } 110 111 112END 113 114