OCSPManager Class
Properties Methods Events Configuration Settings Errors
The OCSPManager class enables the import, export, and management of OCSP responses.
Syntax
class secureblackboxlite.OCSPManager
Remarks
OCSP is a protocol that allows you to verify a certificate's status in real-time, without using Certificate Revocation Lists (CRL).
An OCSP response is a response of the OCSP server to the client's request. As a minimum, it indicates the processing status of the prior request.
Property List
The following is the full list of the properties of the class with short descriptions. Click on the links for further details.
| blocked_cert_count | The number of records in the BlockedCert arrays. |
| blocked_cert_bytes | Returns raw certificate data in DER format. |
| blocked_cert_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
| ca_cert_bytes | Returns raw certificate data in DER format. |
| ca_cert_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
| cert_bytes | Returns raw certificate data in DER format. |
| cert_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
| client_cert_count | The number of records in the ClientCert arrays. |
| client_cert_bytes | Returns raw certificate data in DER format. |
| client_cert_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
| conn_info_aead_cipher | Indicates whether the encryption algorithm used is an AEAD cipher. |
| conn_info_chain_validation_details | The details of a certificate chain validation outcome. |
| conn_info_chain_validation_result | The outcome of a certificate chain validation routine. |
| conn_info_ciphersuite | The cipher suite employed by this connection. |
| conn_info_client_authenticated | Specifies whether client authentication was performed during this connection. |
| conn_info_client_auth_requested | Specifies whether client authentication was requested during this connection. |
| conn_info_connection_established | Indicates whether the connection has been established fully. |
| conn_info_connection_id | The unique identifier assigned to this connection. |
| conn_info_digest_algorithm | The digest algorithm used in a TLS-enabled connection. |
| conn_info_encryption_algorithm | The symmetric encryption algorithm used in a TLS-enabled connection. |
| conn_info_exportable | Indicates whether a TLS connection uses a reduced-strength exportable cipher. |
| conn_info_key_exchange_algorithm | The key exchange algorithm used in a TLS-enabled connection. |
| conn_info_key_exchange_key_bits | The length of the key exchange key of a TLS-enabled connection. |
| conn_info_named_ec_curve | The elliptic curve used in this connection. |
| conn_info_pfs_cipher | Indicates whether the chosen ciphersuite provides perfect forward secrecy (PFS). |
| conn_info_pre_shared_identity_hint | A hint professed by the server to help the client select the PSK identity to use. |
| conn_info_public_key_bits | The length of the public key. |
| conn_info_resumed_session | Indicates whether a TLS-enabled connection was spawned from another TLS connection. |
| conn_info_secure_connection | Indicates whether TLS or SSL is enabled for this connection. |
| conn_info_server_authenticated | Indicates whether server authentication was performed during a TLS-enabled connection. |
| conn_info_signature_algorithm | The signature algorithm used in a TLS handshake. |
| conn_info_symmetric_block_size | The block size of the symmetric algorithm used. |
| conn_info_symmetric_key_bits | The key length of the symmetric algorithm used. |
| conn_info_total_bytes_received | The total number of bytes received over this connection. |
| conn_info_total_bytes_sent | The total number of bytes sent over this connection. |
| conn_info_validation_log | Contains the server certificate's chain validation log. |
| conn_info_version | Indicates the version of SSL/TLS protocol negotiated during this connection. |
| entry_count | The number of records in the Entry arrays. |
| entry_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
| known_cert_count | The number of records in the KnownCert arrays. |
| known_cert_bytes | Returns raw certificate data in DER format. |
| known_cert_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
| known_crl_count | The number of records in the KnownCRL arrays. |
| known_crl_bytes | Returns raw CRL data in DER format. |
| known_crl_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
| known_ocsp_count | The number of records in the KnownOCSP arrays. |
| known_ocsp_bytes | Buffer containing raw OCSP response data. |
| known_ocsp_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
| ocsp_response_bytes | Buffer containing raw OCSP response data. |
| ocsp_response_entry_count | The number of SingleResponse elements contained in this OCSP response. |
| ocsp_response_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
| ocsp_response_issuer | Indicates the issuer of this response (a CA or its authorized representative). |
| ocsp_response_issuer_rdn | Indicates the RDN of the issuer of this response (a CA or its authorized representative). |
| ocsp_response_location | Location of the OCSP responder. |
| ocsp_response_produced_at | Specifies the time when the response was produced, in UTC. |
| proxy_address | The IP address of the proxy server. |
| proxy_authentication | The authentication type used by the proxy server. |
| proxy_password | The password to authenticate to the proxy server. |
| proxy_port | The port on the proxy server to connect to. |
| proxy_proxy_type | The type of the proxy server. |
| proxy_request_headers | Contains HTTP request headers for WebTunnel and HTTP proxy. |
| proxy_response_body | Contains the HTTP or HTTPS (WebTunnel) proxy response body. |
| proxy_response_headers | Contains response headers received from an HTTP or HTTPS (WebTunnel) proxy server. |
| proxy_use_i_pv6 | Specifies whether IPv6 should be used when connecting through the proxy. |
| proxy_use_proxy | Enables or disables proxy-driven connection. |
| proxy_username | Specifies the username credential for proxy authentication. |
| server_cert_count | The number of records in the ServerCert arrays. |
| server_cert_bytes | Returns raw certificate data in DER format. |
| server_cert_ca_key_id | A unique identifier (fingerprint) of the CA certificate's private key. |
| server_cert_fingerprint | Contains the fingerprint (a hash imprint) of this certificate. |
| server_cert_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
| server_cert_issuer | The common name of the certificate issuer (CA), typically a company name. |
| server_cert_issuer_rdn | A collection of information, in the form of [OID, Value] pairs, uniquely identifying the certificate issuer. |
| server_cert_key_algorithm | Specifies the public key algorithm of this certificate. |
| server_cert_key_bits | Returns the length of the public key. |
| server_cert_key_fingerprint | Returns a fingerprint of the public key contained in the certificate. |
| server_cert_key_usage | Indicates the purposes of the key contained in the certificate, in the form of an OR'ed flag set. |
| server_cert_public_key_bytes | Contains the certificate's public key in DER format. |
| server_cert_self_signed | Indicates whether the certificate is self-signed (root) or signed by an external CA. |
| server_cert_serial_number | Returns the certificate's serial number. |
| server_cert_sig_algorithm | Indicates the algorithm that was used by the CA to sign this certificate. |
| server_cert_subject | The common name of the certificate holder, typically an individual's name, a URL, an e-mail address, or a company name. |
| server_cert_subject_key_id | Contains a unique identifier (fingerprint) of the certificate's private key. |
| server_cert_subject_rdn | A collection of information, in the form of [OID, Value] pairs, uniquely identifying the certificate holder (subject). |
| server_cert_valid_from | The time point at which the certificate becomes valid, in UTC. |
| server_cert_valid_to | The time point at which the certificate expires, in UTC. |
| socket_dns_mode | Selects the DNS resolver to use: the class's (secure) built-in one, or the one provided by the system. |
| socket_dns_port | Specifies the port number to be used for sending queries to the DNS server. |
| socket_dns_query_timeout | The timeout (in milliseconds) for each DNS query. |
| socket_dns_servers | The addresses of DNS servers to use for address resolution, separated by commas or semicolons. |
| socket_dns_total_timeout | The timeout (in milliseconds) for the whole resolution process. |
| socket_incoming_speed_limit | The maximum number of bytes to read from the socket, per second. |
| socket_local_address | The local network interface to bind the socket to. |
| socket_local_port | The local port number to bind the socket to. |
| socket_outgoing_speed_limit | The maximum number of bytes to write to the socket, per second. |
| socket_timeout | The maximum period of waiting, in milliseconds, after which the socket operation is considered unsuccessful. |
| socket_use_i_pv6 | Enables or disables IP protocol version 6. |
| tls_auto_validate_certificates | Specifies whether server-side TLS certificates should be validated automatically using internal validation rules. |
| tls_base_configuration | Selects the base configuration for the TLS settings. |
| tls_ciphersuites | A list of ciphersuites separated with commas or semicolons. |
| tlsec_curves | Defines the elliptic curves to enable. |
| tls_force_resume_if_destination_changes | Whether to force TLS session resumption when the destination address changes. |
| tls_pre_shared_identity | Defines the identity used when the PSK (Pre-Shared Key) key-exchange mechanism is negotiated. |
| tls_pre_shared_key | Contains the pre-shared for the PSK (Pre-Shared Key) key-exchange mechanism, encoded with base16. |
| tls_pre_shared_key_ciphersuite | Defines the ciphersuite used for PSK (Pre-Shared Key) negotiation. |
| tls_renegotiation_attack_prevention_mode | Selects renegotiation attack prevention mechanism. |
| tls_revocation_check | Specifies the kind(s) of revocation check to perform. |
| tlsssl_options | Various SSL (TLS) protocol options, set of cssloExpectShutdownMessage 0x001 Wait for the close-notify message when shutting down the connection cssloOpenSSLDTLSWorkaround 0x002 (DEPRECATED) Use a DTLS version workaround when talking to very old OpenSSL versions cssloDisableKexLengthAlignment 0x004 Do not align the client-side PMS by the RSA modulus size. |
| tlstls_mode | Specifies the TLS mode to use. |
| tls_use_extended_master_secret | Enables Extended Master Secret Extension, as defined in RFC 7627. |
| tls_use_session_resumption | Enables or disables TLS session resumption capability. |
| tls_versions | Th SSL/TLS versions to enable by default. |
| trusted_cert_count | The number of records in the TrustedCert arrays. |
| trusted_cert_bytes | Returns raw certificate data in DER format. |
| trusted_cert_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
Method List
The following is the full list of the methods of the class with short descriptions. Click on the links for further details.
| config | Sets or retrieves a configuration setting. |
| get_cert_entry_index | Returns the index of the list item for the given certificate. |
| load_from_bytes | Loads an OCSP response from a byte array. |
| request | Requests an OCSP response. |
| save_to_bytes | Saves a copy of the OCSP response to a byte array. |
| save_to_file | Saves a copy of the OCSP response to a file. |
| validate | Validates the responder's signature over the OCSP response. |
Event List
The following is the full list of the events fired by the class with short descriptions. Click on the links for further details.
| on_certificate_validate | Fires when the server's TLS certificate has to be validated. |
| on_error | Information about errors during OCSP (Online Certificate Status Protocol) response management. |
| on_notification | This event notifies the application about an underlying control flow event. |
Configuration Settings
The following is a list of configuration settings for the class with short descriptions. Click on the links for further details.
| IgnoreSystemTrust | Whether trusted Windows Certificate Stores should be treated as trusted. |
| TolerateMinorChainIssues | Whether to tolerate minor chain issues. |
| UseMicrosoftCTL | Enables or disables automatic use of Microsoft online certificate trust list. |
| UseSystemCertificates | Enables or disables the use of the system certificates. |