OCSPServer Class
Properties Methods Events Configuration Settings Errors
The OCSPServer class provides the functionality of an HTTP-based OCSP server.
Class Name
SecureBlackbox_OCSPServer
Procedural Interface
secureblackbox_ocspserver_open(); secureblackbox_ocspserver_close($res); secureblackbox_ocspserver_register_callback($res, $id, $function); secureblackbox_ocspserver_get_last_error($res); secureblackbox_ocspserver_get_last_error_code($res); secureblackbox_ocspserver_set($res, $id, $index, $value); secureblackbox_ocspserver_get($res, $id, $index); secureblackbox_ocspserver_do_config($res, $configurationstring); secureblackbox_ocspserver_do_dropclient($res, $connectionid, $forced); secureblackbox_ocspserver_do_getrequestbytes($res, $connectionid); secureblackbox_ocspserver_do_getrequestheader($res, $connectionid, $headername); secureblackbox_ocspserver_do_getrequestusername($res, $connectionid); secureblackbox_ocspserver_do_importbadcertificates($res); secureblackbox_ocspserver_do_importgoodcertificates($res); secureblackbox_ocspserver_do_listclients($res); secureblackbox_ocspserver_do_pinclient($res, $connectionid); secureblackbox_ocspserver_do_processgenericrequest($res, $requestbytes, $basiconly); secureblackbox_ocspserver_do_start($res); secureblackbox_ocspserver_do_stop($res);
Remarks
Use this class to quickly set up a working HTTP-based OCSP server.
Property List
The following is the full list of the properties of the class with short descriptions. Click on the links for further details.
Active | Indicates whether the server is active and is listening to new connections. |
AuthBasic | Enables or disables basic authentication. |
AuthDigest | Enables or disables digest authentication. |
AuthDigestExpire | Specifies digest expiration time for digest authentication. |
AuthRealm | Specifies authentication realm for digest and NTLM authentication. |
BadEntryCount | The number of records in the BadEntry arrays. |
BadEntryHandle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
BoundPort | Indicates the bound listening port. |
CACertBytes | Returns raw certificate data in DER format. |
CACertHandle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
Endpoint | The virtual path that the server recognizes as the OCSP serving endpoint. |
ErrorOrigin | Indicates the endpoint where the error originates from. |
ErrorSeverity | The severity of the error that happened. |
ExternalCryptoCustomParams | Custom parameters to be passed to the signing service (uninterpreted). |
ExternalCryptoData | Additional data to be included in the async state and mirrored back by the requestor. |
ExternalCryptoExternalHashCalculation | Specifies whether the message hash is to be calculated at the external endpoint. |
ExternalCryptoHashAlgorithm | Specifies the request's signature hash algorithm. |
ExternalCryptoKeyID | The ID of the pre-shared key used for DC request authentication. |
ExternalCryptoKeySecret | The pre-shared key used for DC request authentication. |
ExternalCryptoMethod | Specifies the asynchronous signing method. |
ExternalCryptoMode | Specifies the external cryptography mode. |
ExternalCryptoPublicKeyAlgorithm | Provide public key algorithm here if the certificate is not available on the pre-signing stage. |
GoodEntryCount | The number of records in the GoodEntry arrays. |
GoodEntryHandle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
Host | The host to bind the listening port to. |
PinnedCertCount | The number of records in the PinnedCert arrays. |
PinnedCertBytes | Returns raw certificate data in DER format. |
PinnedCertHandle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
PinnedClientAddress | The client's IP address. |
PinnedClientChainValidationDetails | The details of a certificate chain validation outcome. |
PinnedClientChainValidationResult | The outcome of a certificate chain validation routine. |
PinnedClientCiphersuite | The cipher suite employed by this connection. |
PinnedClientClientAuthenticated | Specifies whether client authentication was performed during this connection. |
PinnedClientDigestAlgorithm | The digest algorithm used in a TLS-enabled connection. |
PinnedClientEncryptionAlgorithm | The symmetric encryption algorithm used in a TLS-enabled connection. |
PinnedClientID | The client connection's unique identifier. |
PinnedClientKeyExchangeAlgorithm | The key exchange algorithm used in a TLS-enabled connection. |
PinnedClientKeyExchangeKeyBits | The length of the key exchange key of a TLS-enabled connection. |
PinnedClientNamedECCurve | The elliptic curve used in this connection. |
PinnedClientPFSCipher | Indicates whether the chosen ciphersuite provides perfect forward secrecy (PFS). |
PinnedClientPort | The remote port of the client connection. |
PinnedClientPublicKeyBits | The length of the public key. |
PinnedClientResumedSession | Indicates whether a TLS-enabled connection was spawned from another TLS connection. |
PinnedClientSecureConnection | Indicates whether TLS or SSL is enabled for this connection. |
PinnedClientSignatureAlgorithm | The signature algorithm used in a TLS handshake. |
PinnedClientSymmetricBlockSize | The block size of the symmetric algorithm used. |
PinnedClientSymmetricKeyBits | The key length of the symmetric algorithm used. |
PinnedClientTotalBytesReceived | The total number of bytes received over this connection. |
PinnedClientTotalBytesSent | The total number of bytes sent over this connection. |
PinnedClientValidationLog | Contains the server certificate's chain validation log. |
PinnedClientVersion | Indicates the version of SSL/TLS protocol negotiated during this connection. |
PinnedClientCertCount | The number of records in the PinnedClientCert arrays. |
PinnedClientCertBytes | Returns raw certificate data in DER format. |
PinnedClientCertCAKeyID | A unique identifier (fingerprint) of the CA certificate's private key. |
PinnedClientCertFingerprint | Contains the fingerprint (a hash imprint) of this certificate. |
PinnedClientCertHandle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
PinnedClientCertIssuer | The common name of the certificate issuer (CA), typically a company name. |
PinnedClientCertIssuerRDN | A collection of information, in the form of [OID, Value] pairs, uniquely identifying the certificate issuer. |
PinnedClientCertKeyAlgorithm | Specifies the public key algorithm of this certificate. |
PinnedClientCertKeyBits | Returns the length of the public key. |
PinnedClientCertKeyFingerprint | Returns a fingerprint of the public key contained in the certificate. |
PinnedClientCertKeyUsage | Indicates the purposes of the key contained in the certificate, in the form of an OR'ed flag set. |
PinnedClientCertPublicKeyBytes | Contains the certificate's public key in DER format. |
PinnedClientCertSelfSigned | Indicates whether the certificate is self-signed (root) or signed by an external CA. |
PinnedClientCertSerialNumber | Returns the certificate's serial number. |
PinnedClientCertSigAlgorithm | Indicates the algorithm that was used by the CA to sign this certificate. |
PinnedClientCertSubject | The common name of the certificate holder, typically an individual's name, a URL, an e-mail address, or a company name. |
PinnedClientCertSubjectKeyID | Contains a unique identifier (fingerprint) of the certificate's private key. |
PinnedClientCertSubjectRDN | A collection of information, in the form of [OID, Value] pairs, uniquely identifying the certificate holder (subject). |
PinnedClientCertValidFrom | The time point at which the certificate becomes valid, in UTC. |
PinnedClientCertValidTo | The time point at which the certificate expires, in UTC. |
Port | Specifies the port number to listen for connections on. |
PortRangeFrom | Specifies the lower limit of the listening port range for incoming connections. |
PortRangeTo | Specifies the upper limit of the listening port range for incoming connections. |
ServerCertCount | The number of records in the ServerCert arrays. |
ServerCertBytes | Returns raw certificate data in DER format. |
ServerCertHandle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
SigningCertBytes | Returns raw certificate data in DER format. |
SigningCertHandle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
SocketIncomingSpeedLimit | The maximum number of bytes to read from the socket, per second. |
SocketLocalAddress | The local network interface to bind the socket to. |
SocketLocalPort | The local port number to bind the socket to. |
SocketOutgoingSpeedLimit | The maximum number of bytes to write to the socket, per second. |
SocketTimeout | The maximum period of waiting, in milliseconds, after which the socket operation is considered unsuccessful. |
SocketUseIPv6 | Enables or disables IP protocol version 6. |
TLSAutoValidateCertificates | Specifies whether server-side TLS certificates should be validated automatically using internal validation rules. |
TLSBaseConfiguration | Selects the base configuration for the TLS settings. |
TLSCiphersuites | A list of ciphersuites separated with commas or semicolons. |
TLSECCurves | Defines the elliptic curves to enable. |
TLSForceResumeIfDestinationChanges | Whether to force TLS session resumption when the destination address changes. |
TLSPreSharedIdentity | Defines the identity used when the PSK (Pre-Shared Key) key-exchange mechanism is negotiated. |
TLSPreSharedKey | Contains the pre-shared for the PSK (Pre-Shared Key) key-exchange mechanism, encoded with base16. |
TLSPreSharedKeyCiphersuite | Defines the ciphersuite used for PSK (Pre-Shared Key) negotiation. |
TLSRenegotiationAttackPreventionMode | Selects renegotiation attack prevention mechanism. |
TLSRevocationCheck | Specifies the kind(s) of revocation check to perform. |
TLSSSLOptions | Various SSL (TLS) protocol options, set of cssloExpectShutdownMessage 0x001 Wait for the close-notify message when shutting down the connection cssloOpenSSLDTLSWorkaround 0x002 (DEPRECATED) Use a DTLS version workaround when talking to very old OpenSSL versions cssloDisableKexLengthAlignment 0x004 Do not align the client-side PMS by the RSA modulus size. |
TLSTLSMode | Specifies the TLS mode to use. |
TLSUseExtendedMasterSecret | Enables Extended Master Secret Extension, as defined in RFC 7627. |
TLSUseSessionResumption | Enables or disables TLS session resumption capability. |
TLSVersions | Th SSL/TLS versions to enable by default. |
UpdatePeriod | The server's information update period. |
UserCount | The number of records in the User arrays. |
UserAssociatedData | Contains the user's Associated Data when SSH AEAD (Authenticated Encryption with Associated Data) algorithm is used. |
UserBasePath | Base path for this user in the server's file system. |
UserCert | Contains the user's certificate. |
UserData | Contains uninterpreted user-defined data that should be associated with the user account, such as comments or custom settings. |
UserHandle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
UserHashAlgorithm | Specifies the hash algorithm used to generate TOTP (Time-based One-Time Passwords) passwords for this user. |
UserIncomingSpeedLimit | Specifies the incoming speed limit for this user. |
UserOutgoingSpeedLimit | Specifies the outgoing speed limit for this user. |
UserPassword | The user's authentication password. |
UserSharedSecret | Contains the user's secret key, which is essentially a shared secret between the client and server. |
UserUsername | The registered name (login) of the user. |
UseTLS | Enables or disables the TLS requirement. |
WebsiteName | Specifies the web site name to use in the certificate. |
Method List
The following is the full list of the methods of the class with short descriptions. Click on the links for further details.
Config | Sets or retrieves a configuration setting. |
DropClient | Terminates a client connection. |
GetRequestBytes | Returns the contents of the client's HTTP request. |
GetRequestHeader | Returns a request header value. |
GetRequestUsername | Returns the username for a connection. |
ImportBadCertificates | Imports revoked certificates. |
ImportGoodCertificates | Imports good certificates. |
ListClients | Enumerates the connected clients. |
PinClient | Takes a snapshot of the connection's properties. |
ProcessGenericRequest | Processes a generic OCSP status request. |
Start | Starts the server. |
Stop | Stops the server. |
Event List
The following is the full list of the events fired by the class with short descriptions. Click on the links for further details.
Accept | Reports an incoming connection. |
AuthAttempt | Fires when a connected client makes an authentication attempt. |
CertificateValidate | Fires when a client certificate needs to be validated. |
Connect | Reports an accepted connection. |
Disconnect | Fires to report a disconnected client. |
Error | Information about errors during data delivery. |
ExternalSign | Handles remote or external signing initiated by the server protocol. |
Notification | This event notifies the application about an underlying control flow event. |
StatusRequest | Requests a certificate status from the application. |
TLSEstablished | Reports the setup of a TLS session. |
TLSPSK | Requests a pre-shared key for TLS-PSK. |
TLSShutdown | Reports closure of a TLS session. |
Configuration Settings
The following is a list of configuration settings for the class with short descriptions. Click on the links for further details.
AllowOptionsResponseWithoutAuth | Enables unauthenticated responses to OPTIONS requests. |
ClientAuth | Enables or disables certificate-based client authentication. |
DualStack | Allows the use of ip4 and ip6 simultaneously. |
HomePage | Specifies the home page resource name. |
Host | The host to bind to. |
RequestFilter | The request string modifier. |
ServerSSLDHKeyLength | Sets the size of the TLS DHE key exchange group. |
TLSExtensions | Provides access to TLS extensions. |
WebsiteName | The website name for the TLS certificate. |
CheckKeyIntegrityBeforeUse | Enables or disable private key integrity check before use. |
CookieCaching | Specifies whether a cookie cache should be used for HTTP(S) transports. |
Cookies | Gets or sets local cookies for the class (supported for HTTPClient, RESTClient and SOAPClient only). |
DefDeriveKeyIterations | Specifies the default key derivation algorithm iteration count. |
EnableClientSideSSLFFDHE | Enables or disables finite field DHE key exchange support in TLS clients. |
GlobalCookies | Gets or sets global cookies for all the HTTP transports. |
HttpUserAgent | Specifies the user agent name to be used by all HTTP clients. |
LogDestination | Specifies the debug log destination. |
LogDetails | Specifies the debug log details to dump. |
LogFile | Specifies the debug log filename. |
LogFilters | Specifies the debug log filters. |
LogFlushMode | Specifies the log flush mode. |
LogLevel | Specifies the debug log level. |
LogMaxEventCount | Specifies the maximum number of events to cache before further action is taken. |
LogRotationMode | Specifies the log rotation mode. |
MaxASN1BufferLength | Specifies the maximal allowed length for ASN.1 primitive tag data. |
MaxASN1TreeDepth | Specifies the maximal depth for processed ASN.1 trees. |
OCSPHashAlgorithm | Specifies the hash algorithm to be used to identify certificates in OCSP requests. |
UseOwnDNSResolver | Specifies whether the client classes should use own DNS resolver. |
UseSharedSystemStorages | Specifies whether the validation engine should use a global per-process copy of the system certificate stores. |
UseSystemOAEPAndPSS | Enforces or disables the use of system-driven RSA OAEP and PSS computations. |
UseSystemRandom | Enables or disables the use of the OS PRNG. |