End of Life Ruby 3.2 has reached end of life and gets no more fixes. Switch to Ruby 4.0 →
instance method
OpenSSL::OCSP::SingleResponse#check_validity
single_response.check_validity(nsec = 0, maxsec = -1) → true | false
ext/openssl/ossl_ocsp.c
View on GitHub ↗
static VALUE
ossl_ocspsres_check_validity(int argc, VALUE *argv, VALUE self)
{
OCSP_SINGLERESP *sres;
ASN1_GENERALIZEDTIME *this_update, *next_update;
VALUE nsec_v, maxsec_v;
int nsec, maxsec, status, ret;
rb_scan_args(argc, argv, "02", &nsec_v, &maxsec_v);
nsec = NIL_P(nsec_v) ? 0 : NUM2INT(nsec_v);
maxsec = NIL_P(maxsec_v) ? -1 : NUM2INT(maxsec_v);
GetOCSPSingleRes(self, sres);
status = OCSP_single_get0_status(sres, NULL, NULL, &this_update, &next_update);
if (status < 0)
ossl_raise(eOCSPError, "OCSP_single_get0_status");
ret = OCSP_check_validity(this_update, next_update, nsec, maxsec);
if (ret)
return Qtrue;
else {
ossl_clear_error();
return Qfalse;
}
}
Checks the validity of thisUpdate and nextUpdate fields of this SingleResponse. This checks the current time is within the range thisUpdate to nextUpdate.
It is possible that the OCSP request takes a few seconds or the time is not accurate. To avoid rejecting a valid response, this method allows the times to be within nsec seconds of the current time.
Some responders don’t set the nextUpdate field. This may cause a very old response to be considered valid. The maxsec parameter can be used to limit the age of responses.
See also
#cert_status
#extensions
#certid
#initialize_copy
also in
4.1 · 4.0 · 3.4 · 3.3 · 3.1 · 3.0