openssl-1_1/openssl-s_client-check-ocsp-status.patch

commit c43f598838acaf3b98df4fce4b6babb663d2f902
Author: Otto Hollmann <otto.hollmann@suse.com>
Date:   Fri Jun 30 11:15:30 2023 +0200

    Add OCSP_RESPONSE_check_status(), a function to check OCSP response for revoked certificate in s_client.

---
 apps/s_client.c                                        |   10 +
 crypto/ocsp/ocsp_vfy.c                                 |   31 +++++
 doc/man3/OCSP_response_status.pod                      |   15 ++
 include/openssl/ocsp.h                                 |    1 
 test/recipes/80-test_ocsp_check.t                      |   90 +++++++++++++++++
 test/recipes/80-test_ocsp_check_data/ca.pem            |   19 +++
 test/recipes/80-test_ocsp_check_data/index-revoked.txt |    2 
 test/recipes/80-test_ocsp_check_data/index-valid.txt   |    2 
 test/recipes/80-test_ocsp_check_data/ocsp.key          |   28 +++++
 test/recipes/80-test_ocsp_check_data/ocsp.pem          |   75 ++++++++++++++
 test/recipes/80-test_ocsp_check_data/server.key        |   28 +++++
 test/recipes/80-test_ocsp_check_data/server.pem        |   75 ++++++++++++++
 util/libcrypto.num                                     |    1 
 13 files changed, 372 insertions(+), 5 deletions(-)

--- a/apps/s_client.c
+++ b/apps/s_client.c
@@ -3390,7 +3390,7 @@ static void print_stuff(BIO *bio, SSL *s
 static int ocsp_resp_cb(SSL *s, void *arg)
 {
     const unsigned char *p;
-    int len;
+    int len, ret;
     OCSP_RESPONSE *rsp;
     len = SSL_get_tlsext_status_ocsp_resp(s, &p);
     BIO_puts(arg, "OCSP response: ");
@@ -3407,8 +3407,14 @@ static int ocsp_resp_cb(SSL *s, void *ar
     BIO_puts(arg, "\n======================================\n");
     OCSP_RESPONSE_print(arg, rsp, 0);
     BIO_puts(arg, "======================================\n");
+    ret = OCSP_RESPONSE_check_status(rsp);
     OCSP_RESPONSE_free(rsp);
-    return 1;
+    if (ret <= -1) {
+        BIO_puts(arg, "unable to verify OCSP response\n");
+    } else if (ret == 0) {
+        BIO_puts(arg, "revoked certificate found in OCSP response\n");
+    }
+    return ret;
 }
 # endif
 
--- a/crypto/ocsp/ocsp_vfy.c
+++ b/crypto/ocsp/ocsp_vfy.c
@@ -433,3 +433,34 @@ static int ocsp_req_find_signer(X509 **p
     }
     return 0;
 }
+
+/*
+ * Check an OCSP response for revoked certificate. Return a negative value on
+ * error; 0 if the response is not acceptable (in which case the handshake
+ * will fail) or a positive value if it is acceptable (no revoked certificate
+ * is found).
+ */
+
+int OCSP_RESPONSE_check_status(OCSP_RESPONSE *o)
+{
+    int i;
+    OCSP_BASICRESP *br = NULL;
+    OCSP_RESPDATA *rd = NULL;
+    OCSP_SINGLERESP *single = NULL;
+    OCSP_RESPBYTES *rb = o->responseBytes;
+    if (rb == NULL)
+        return -1;
+    if (OBJ_obj2nid(rb->responseType) != NID_id_pkix_OCSP_basic)
+        return -1;
+    if ((br = OCSP_response_get1_basic(o)) == NULL)
+        return -1;
+    rd = &br->tbsResponseData;
+    for (i = 0; i < sk_OCSP_SINGLERESP_num(rd->responses); i++) {
+        if (!sk_OCSP_SINGLERESP_value(rd->responses, i))
+            continue;
+        single = sk_OCSP_SINGLERESP_value(rd->responses, i);
+        if (single->certStatus->type == V_OCSP_CERTSTATUS_REVOKED)
+            return 0;
+    }
+    return 1;
+}
--- a/doc/man3/OCSP_response_status.pod
+++ b/doc/man3/OCSP_response_status.pod
@@ -2,8 +2,8 @@
 
 =head1 NAME
 
-OCSP_response_status, OCSP_response_get1_basic, OCSP_response_create,
-OCSP_RESPONSE_free, OCSP_RESPID_set_by_name,
+OCSP_response_status, OCSP_RESPONSE_check_status, OCSP_response_get1_basic,
+OCSP_response_create, OCSP_RESPONSE_free, OCSP_RESPID_set_by_name,
 OCSP_RESPID_set_by_key, OCSP_RESPID_match,
 OCSP_basic_sign, OCSP_basic_sign_ctx - OCSP response functions
 
@@ -12,6 +12,7 @@ OCSP_basic_sign, OCSP_basic_sign_ctx - O
  #include <openssl/ocsp.h>
 
  int OCSP_response_status(OCSP_RESPONSE *resp);
+ int OCSP_RESPONSE_check_status(OCSP_RESPONSE *resp);
  OCSP_BASICRESP *OCSP_response_get1_basic(OCSP_RESPONSE *resp);
  OCSP_RESPONSE *OCSP_response_create(int status, OCSP_BASICRESP *bs);
  void OCSP_RESPONSE_free(OCSP_RESPONSE *resp);
@@ -34,6 +35,10 @@ B<OCSP_RESPONSE_STATUS_MALFORMEDREQUEST>
 B<OCSP_RESPONSE_STATUS_INTERNALERROR>, B<OCSP_RESPONSE_STATUS_TRYLATER>
 B<OCSP_RESPONSE_STATUS_SIGREQUIRED>, or B<OCSP_RESPONSE_STATUS_UNAUTHORIZED>.
 
+OCSP_RESPONSE_check_status() check status of the OCSP response I<resp>. It
+returns a negative value on error; 0 if the response is not acceptable
+(e.g. contains revoked certificate) or a positive value if it is acceptable.
+
 OCSP_response_get1_basic() decodes and returns the B<OCSP_BASICRESP> structure
 contained in B<resp>.
 
@@ -65,7 +70,11 @@ uses the parameters contained in digest
 
 =head1 RETURN VALUES
 
-OCSP_RESPONSE_status() returns a status value.
+OCSP_response_status() returns a status value.
+
+OCSP_RESPONSE_check_status() returns a result of check - negative value on
+error; 0 if the response is not acceptable; positive value if response is
+acceptable.
 
 OCSP_response_get1_basic() returns an B<OCSP_BASICRESP> structure pointer or
 B<NULL> if an error occurred.
--- a/include/openssl/ocsp.h
+++ b/include/openssl/ocsp.h
@@ -340,6 +340,7 @@ const char *OCSP_crl_reason_str(long s);
 
 int OCSP_REQUEST_print(BIO *bp, OCSP_REQUEST *a, unsigned long flags);
 int OCSP_RESPONSE_print(BIO *bp, OCSP_RESPONSE *o, unsigned long flags);
+int OCSP_RESPONSE_check_status(OCSP_RESPONSE *o);
 
 int OCSP_basic_verify(OCSP_BASICRESP *bs, STACK_OF(X509) *certs,
                       X509_STORE *st, unsigned long flags);
--- /dev/null
+++ b/test/recipes/80-test_ocsp_check.t
@@ -0,0 +1,90 @@
+#! /usr/bin/env perl
+# Copyright 2023 The OpenSSL Project Authors. All Rights Reserved.
+#
+# Licensed under the Apache License 2.0 (the "License").  You may not use
+# this file except in compliance with the License.  You can obtain a copy
+# in the file LICENSE in the source distribution or at
+# https://www.openssl.org/source/license.html
+
+use strict;
+use warnings;
+
+use IPC::Open2;
+use OpenSSL::Test qw/:DEFAULT srctop_file bldtop_file/;
+use OpenSSL::Test::Utils;
+
+setup("test_ocsp_check");
+
+plan tests => 2;
+
+my $shlib_wrap = bldtop_file("util", "shlib_wrap.sh");
+my $apps_openssl = bldtop_file("apps", "openssl");
+my $ca = srctop_file("test", "recipes", "80-test_ocsp_check_data", "ca.pem");
+my $ca_key = srctop_file("test", "recipes", "80-test_ocsp_check_data", "ca.key");
+my $ocsp = srctop_file("test", "recipes", "80-test_ocsp_check_data", "ocsp.pem");
+my $ocsp_key = srctop_file("test", "recipes", "80-test_ocsp_check_data", "ocsp.key");
+my $server = srctop_file("test", "recipes", "80-test_ocsp_check_data", "server.pem");
+my $server_key = srctop_file("test", "recipes", "80-test_ocsp_check_data", "server.key");
+my $index;
+my $ocsp_port = 9999;
+my $https_port = 8443;
+# 20 July 2023 so we don't get certificate expiry errors.
+my @check_time=("-attime", "1689811200");
+
+sub run_test {
+  my $id = shift;
+  my $connect_good = 0;
+
+  if ($id == 0) {
+    $index = srctop_file("test", "recipes", "80-test_ocsp_check_data", "index-valid.txt");
+  }
+  if ($id == 1) {
+    $index = srctop_file("test", "recipes", "80-test_ocsp_check_data", "index-revoked.txt");
+  }
+  # OCSP responder
+  my @o_cmd = ("ocsp", "-index", $index, "-port", "$ocsp_port", "-rsigner", $ocsp, "-rkey", $ocsp_key, "-CA", $ca, "-nrequest", "1", @check_time);
+  # server
+  my @s_cmd = ("s_server", "-www", "-status_url", "http://127.0.0.1:$ocsp_port", "-accept", "$https_port", "-cert", $server, "-key", $server_key, "-state", "-CAfile", $ca, "-naccept", "1", @check_time);
+  # client
+  my @c_cmd = ("s_client", "-connect", ":$https_port", "-CAfile", $ca, "-status", "-verify_return_error", "-strict", @check_time);
+
+  # Run the OCSP responder
+  my $o_pid = open2(my $o_out, my $o_in, $shlib_wrap, $apps_openssl, @o_cmd);
+
+  # Start up the server
+  my $s_pid = open2(my $s_out, my $s_in, $shlib_wrap, $apps_openssl, @s_cmd);
+  while (<$s_out>) {
+    chomp;
+    if (/^ACCEPT$/) {
+      print "Server ready\n";
+      last;
+    }
+  }
+
+  # Start up the client
+  my $c_pid = open2(my $c_out, my $c_in, $shlib_wrap, $apps_openssl, @c_cmd);
+  if ($id == 0) {
+      # Do the "GET", which will cause the client to finish
+      print $c_in "GET /\r\n";
+  }
+
+  waitpid($c_pid, 0);
+  waitpid($s_pid, 0);
+  waitpid($o_pid, 0);
+
+  # Check the client output
+  while (<$c_out>) {
+    chomp;
+    if ($id == 0) {
+      $connect_good = 1 if /^Content-type: text/;
+    }
+    if ($id == 1) {
+      $connect_good = 1 if /^revoked certificate found in OCSP response/;
+    }
+  }
+  print STDERR "Connection failed\n" if ! ok($connect_good);
+}
+
+for my $index (0..1) {
+  run_test($index)
+}
\ No newline at end of file
--- /dev/null
+++ b/test/recipes/80-test_ocsp_check_data/ca.pem
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDBTCCAe2gAwIBAgIUZot4eag1ZaofYsMIB7HIzq8+zGEwDQYJKoZIhvcNAQEL
+BQAwEjEQMA4GA1UEAwwHUm9vdCBDQTAeFw0yMzA3MTIwOTI5NDdaFw0zMzA3MDkw
+OTI5NDdaMBIxEDAOBgNVBAMMB1Jvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+DwAwggEKAoIBAQDRRSlP0gUVVlzMkEtVzX95n5lM+P36lyNgevKqY1Dl3ygPAzaq
+HRUBsgcxdDwWwMPO2u5UJOWaQ80nwFGROwX8WrRoBTvsUZ+URyXx98tHrhnD6wI9
+v30xYGN0RU2Ef2XnMvThhKRQVZJJWAHFPWZdPes0/g3H4FGJudOQJUHpiDD1UEF+
+cWxyujhVbvBFCX+mBS+r/tn75axjsUqmbxwCE7TK3CD0JdvlLUYxtybvozYoONot
+/mFleCMmPaTzPHan+iXNHp4Tn+3Ssndo3uiTr0pEbGgSOy2PppbZmv0ml0+CSLN4
+G8VaBBf7VTMayowEmmDgTpsOTi9tJqW2CcGzAgMBAAGjUzBRMB0GA1UdDgQWBBRj
+L87V9mqTdWYMCNNBb6Hay7OwPjAfBgNVHSMEGDAWgBRjL87V9mqTdWYMCNNBb6Ha
+y7OwPjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQC09qzufLI/
+AoBscY8e9Q4pRhzeVVAKQ6yAZiO2O0o3trI5xKqD3iD0pOC7Mbfg0e0lneK6ovpd
+J178HwF4PMdiwvPH0KkAf0DaB96nC6U6oGQmItq8668jeVBjat0UCP3xiLmLhhAl
+mnnsgFC1eALmpWQPVlixUaXF4ri3R0QBUcc2kIV5zr1P3LJVboMSgCZULvrlfQLC
+kA0GdCCf6h08AFHRaIW8EE3I1IHNZc7eQcmnCLewHU5cPAYJ69GjhblSLS8kbpXK
+k7BllPLkk99zc/94okTasTjUkmha3RhRqMNL8jrYVc1m7H4U+4XUyh1y4C4Nmz18
+fBbrMxN2SCXM
+-----END CERTIFICATE-----
--- /dev/null
+++ b/test/recipes/80-test_ocsp_check_data/index-revoked.txt
@@ -0,0 +1,2 @@
+V	240711093229Z		1000	unknown	/CN=OCSP
+R	240711093313Z	230621000000Z	1001	unknown	/CN=Server
--- /dev/null
+++ b/test/recipes/80-test_ocsp_check_data/index-valid.txt
@@ -0,0 +1,2 @@
+V	240711093229Z		1000	unknown	/CN=OCSP
+V	240711093313Z		1001	unknown	/CN=Server
--- /dev/null
+++ b/test/recipes/80-test_ocsp_check_data/ocsp.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDZ2OLi8cpvoinQ
+bs4YEmk9GdQNcg9+zBRHy/YRJF+bbdreINweLYigHg2D3rcJnrjXkNAmd08aD0x+
+4iq58Tvy5P48VZ+c1R3XUs1YQR20sKgnM8w+uF2SXxX18Idy31pNErYh3J8jVpBi
+moMP9dC22iNB4kTKf1ORM6HaKnHM8wg3JzXv9lVoIQgAgyAmJOoQXhQ8Kn1AOj3j
+vp1Jgm2hI4e2MTjgjraT9sKxPXIZkKnTwnZX88MpE9HvsQ7XV2CdYmMry+L69X68
+bl3S1eisDjeIvHPtz6TenZs7wxbupy7OtdOKRxa/mDh9C76XHiNPoukUF1NVZ93S
+647ud7enAgMBAAECggEAFy+JbQxn9nwExZ2Cy4wWGFM0lF5vPhhmu4IpRTIhB4Vo
+gIYbIg5y6/vBhidWRYICUVXP2ZrkLTVd97kxlqBmuCzdeZAcEKXxavacoAfaK142
+n2mDaP+CsgPzGJMfj2nXOLxvlxNd+qBey1J/oDC8+eEl/yqfwLT5hiA/2dz08hI6
+IU0BudOB6H5iBK74MJsubdm0tsY4iqTykXeiR+n5dvVGDXLUX74BDHlD9O7AAo10
+h74Vw22luigsV0spCVLoOYy6z9KMkOaHZRruPmF3UCsfJZFY2y6uMapvbdgUavr9
+5fpsx40ep/mjRkYainHfJK1YkV/AoTxKjPQu2owJIQKBgQD0akN75lGXaAMQ0oEA
+1UrvZg75BQxPN+3qVtyynoQGVh58uRIaeG4DQdtc4nNPYI6o6NGbJk4T4wXU7W/3
+XUr+U/LdSGpHfM9gXGCUNgoJeUKY3NLUGdE4DIGDiJrmJfd5NDj37+PAQUTLBO49
+A0+BPnictZPffXuXCGL7lt7hYQKBgQDkLD9jV6HNtv8pAxFdQM+89NhWZCvpuTAs
+rihG3ebblBotMuGsrZDJ75UKq5wPEGCZWDc5q2h8L6CiyQF7Vht4/pi4NEhsA9My
+5hOGUJJVvvFmEIYz0GoCGqoDqag1XpKx8MYMvcc52bhzsYCy+dpnqraISeyiFPLM
+hdy+3jROBwKBgAqKEoLjOZ13xLoS+bEZgXO1SOwABbncxYuXV0j0gOjtCb+DE37E
+tqm5S0ZEFYjUtxIdh/xSuIcvAO9flbZq9XLmF9Dm8H5IqYCUOy3o7qHd8rs4unae
+7mCmWWdcmqFV/cfiMpquY3nE1rySZ9uFqwX9taG8SrYWaR/oIqyKou3BAoGBAJgX
+2oT4s/UxJzKKRffYLOEygEZN7WuVMsSFrnlWjv0M4soAIaf95gaFOd7r91GfRBTT
+VbSOSk6FXNlFjUROaG+lnd0jlKbTgeNqs9cTPAgGCFlVaG9/XDpc1bktTN+OU9Bi
+w1FY60TnmOkdh8FFhM0XYSbFyANeXV3xWOytp0XfAoGBAO2FkR3oGd3DSJmeljwJ
+HciEmlYCk38z93mZXiDTh4axS+mxAMYVRXt0dDUveyImlpcGi9coYmQPEzgk6spQ
+DOeRzRQcWQWfny9/UoGFU/Kv6QmpteAWaSjinBWKONx9d5AGzAkzms79tS8JMeL5
++wlkyD8NclbRA+ILu+V8HLed
+-----END PRIVATE KEY-----
--- /dev/null
+++ b/test/recipes/80-test_ocsp_check_data/ocsp.pem
@@ -0,0 +1,75 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 4096 (0x1000)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Root CA
+        Validity
+            Not Before: Jul 12 09:32:29 2023 GMT
+            Not After : Jul 11 09:32:29 2024 GMT
+        Subject: CN=OCSP
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:d9:d8:e2:e2:f1:ca:6f:a2:29:d0:6e:ce:18:12:
+                    69:3d:19:d4:0d:72:0f:7e:cc:14:47:cb:f6:11:24:
+                    5f:9b:6d:da:de:20:dc:1e:2d:88:a0:1e:0d:83:de:
+                    b7:09:9e:b8:d7:90:d0:26:77:4f:1a:0f:4c:7e:e2:
+                    2a:b9:f1:3b:f2:e4:fe:3c:55:9f:9c:d5:1d:d7:52:
+                    cd:58:41:1d:b4:b0:a8:27:33:cc:3e:b8:5d:92:5f:
+                    15:f5:f0:87:72:df:5a:4d:12:b6:21:dc:9f:23:56:
+                    90:62:9a:83:0f:f5:d0:b6:da:23:41:e2:44:ca:7f:
+                    53:91:33:a1:da:2a:71:cc:f3:08:37:27:35:ef:f6:
+                    55:68:21:08:00:83:20:26:24:ea:10:5e:14:3c:2a:
+                    7d:40:3a:3d:e3:be:9d:49:82:6d:a1:23:87:b6:31:
+                    38:e0:8e:b6:93:f6:c2:b1:3d:72:19:90:a9:d3:c2:
+                    76:57:f3:c3:29:13:d1:ef:b1:0e:d7:57:60:9d:62:
+                    63:2b:cb:e2:fa:f5:7e:bc:6e:5d:d2:d5:e8:ac:0e:
+                    37:88:bc:73:ed:cf:a4:de:9d:9b:3b:c3:16:ee:a7:
+                    2e:ce:b5:d3:8a:47:16:bf:98:38:7d:0b:be:97:1e:
+                    23:4f:a2:e9:14:17:53:55:67:dd:d2:eb:8e:ee:77:
+                    b7:a7
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            X509v3 Subject Key Identifier: 
+                2B:C9:AC:45:83:BB:96:5B:73:77:1A:F8:DB:F9:98:44:C6:E8:55:95
+            X509v3 Authority Key Identifier: 
+                63:2F:CE:D5:F6:6A:93:75:66:0C:08:D3:41:6F:A1:DA:CB:B3:B0:3E
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        02:87:49:a3:6f:c4:59:38:94:f9:f7:1a:ff:6f:4c:b4:6b:bd:
+        d2:79:98:5c:90:a8:49:45:ec:91:4e:ac:45:ec:8d:81:7f:ce:
+        ea:2f:93:c1:40:49:d4:c7:f2:ae:c0:60:1d:7d:65:91:83:63:
+        51:4c:f0:ce:ef:81:dc:43:a6:b3:01:39:66:52:2d:1d:08:16:
+        a7:a7:54:78:e6:7a:06:49:5f:86:37:12:48:42:ab:37:a9:c0:
+        04:98:70:45:50:9e:6d:30:6d:6d:81:05:79:1b:5c:2b:75:b9:
+        a8:46:22:4a:80:c9:ab:7c:f7:b2:63:69:ed:08:31:32:bd:8e:
+        f8:d7:8e:8e:29:8e:f6:b0:52:c2:a3:19:c1:e0:88:de:de:94:
+        4f:f1:a5:9b:1c:1c:c0:11:79:7f:df:38:1b:97:a9:6c:26:fc:
+        7e:31:f5:78:ba:c1:1d:e6:7c:e1:8e:b3:c5:91:fc:f6:5f:44:
+        18:44:0b:15:c8:94:a5:a7:02:58:2f:be:f4:e4:80:0a:ce:8e:
+        33:36:dd:0f:39:d3:b6:ae:57:d2:46:b4:a2:d1:49:c9:29:a7:
+        a0:a7:62:a7:2e:2d:7d:91:94:12:f7:55:13:54:d5:4e:4d:eb:
+        1f:78:a7:9e:a9:93:f9:6c:a9:ec:97:2e:c6:04:67:fa:95:47:
+        1e:2c:d2:74
+-----BEGIN CERTIFICATE-----
+MIIC6jCCAdKgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwEjEQMA4GA1UEAwwHUm9v
+dCBDQTAeFw0yMzA3MTIwOTMyMjlaFw0yNDA3MTEwOTMyMjlaMA8xDTALBgNVBAMM
+BE9DU1AwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDZ2OLi8cpvoinQ
+bs4YEmk9GdQNcg9+zBRHy/YRJF+bbdreINweLYigHg2D3rcJnrjXkNAmd08aD0x+
+4iq58Tvy5P48VZ+c1R3XUs1YQR20sKgnM8w+uF2SXxX18Idy31pNErYh3J8jVpBi
+moMP9dC22iNB4kTKf1ORM6HaKnHM8wg3JzXv9lVoIQgAgyAmJOoQXhQ8Kn1AOj3j
+vp1Jgm2hI4e2MTjgjraT9sKxPXIZkKnTwnZX88MpE9HvsQ7XV2CdYmMry+L69X68
+bl3S1eisDjeIvHPtz6TenZs7wxbupy7OtdOKRxa/mDh9C76XHiNPoukUF1NVZ93S
+647ud7enAgMBAAGjTTBLMAkGA1UdEwQCMAAwHQYDVR0OBBYEFCvJrEWDu5Zbc3ca
++Nv5mETG6FWVMB8GA1UdIwQYMBaAFGMvztX2apN1ZgwI00FvodrLs7A+MA0GCSqG
+SIb3DQEBCwUAA4IBAQACh0mjb8RZOJT59xr/b0y0a73SeZhckKhJReyRTqxF7I2B
+f87qL5PBQEnUx/KuwGAdfWWRg2NRTPDO74HcQ6azATlmUi0dCBanp1R45noGSV+G
+NxJIQqs3qcAEmHBFUJ5tMG1tgQV5G1wrdbmoRiJKgMmrfPeyY2ntCDEyvY74146O
+KY72sFLCoxnB4Ije3pRP8aWbHBzAEXl/3zgbl6lsJvx+MfV4usEd5nzhjrPFkfz2
+X0QYRAsVyJSlpwJYL7705IAKzo4zNt0POdO2rlfSRrSi0UnJKaegp2KnLi19kZQS
+91UTVNVOTesfeKeeqZP5bKnsly7GBGf6lUceLNJ0
+-----END CERTIFICATE-----
--- /dev/null
+++ b/test/recipes/80-test_ocsp_check_data/server.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDb4qMIdALYSZd7
+/RBJ5PTRZS23d4SkIxZuOGXiSdYNyDNqg+jZZ5HPJu1ZcZFZ7AYINCAnk/yv1rPd
+Aoz50sZKTjHacQZLhaSds0PlN5/TrkwU0WUbalFWm5D6LB+VlDdkOSWSO3UNo23n
+X3wBMCWL9tTqNCwzNx8o3P6L8gjEOyOU3lIB3DU0FgGZN0Fkk7ZrbZxoln78Hcgf
+wBxWC2SafOwU9zofjdcEQr4Q6kAKDK1M7EYbq8U67BUS7SRRoj2Ub6KNhTGCuH5f
+0M4umykvong4bvqYqmrpAM0qV/F0ngus8qJgAH21AeHAvG9iuP/AphbslKFl+Me5
+3J3/2A/lAgMBAAECggEAAsC9Ist1B6kwNNSvwgUUTZTTNDNSXU21J68cE2+yNtz1
+S9WX8jTaPfoySYbi93m9f5fLeUNgjAEHonI4Op55bg+5jw8QMZzcOT83z+RY42kQ
+ucf/WI8Fsqxi7cbkpFZFNUOD5WdKKWAM7bMj1c35Al4WP1Jk5UVA5h2SMEVY97/x
+2TeQIzxBVX7w8d3jSHQXizWLB06IRs0F1Kpp0qIXJ558GcWEYVLk7ORIcJACWJSh
+UmhmtUVXI5OoWTTk4Ac7wus5GlCaLkwZ1RxV8iSwlQ5dhEBdDPRofrH9QgeULJrq
+l+G+Cv32FizTzC3QuiPrXrbfPVxffYZuJ5g2RORh9wKBgQD4IqS3WzXYOoKwkA5d
+8rVAL55tTE8I7/GZCoMrmRsXKV/30gJjhDlf5TyKWpFB7gcxBBZhd+lK/daH8d+S
+EAeBdN45VM/xbQkVKyfOQMQ5JuKmLJUyUP7yevMDZ0TYWQGDWmnVMzhfICIKWQvM
+lnPqCHFeYx+zWFBTDukr+aitywKBgQDi2sY1KAJiC24M7DILvjF0vFQGIPCyoOfQ
+VKemT3O5BKXbEK/WgBmTHMZzGPUGCZ7dxjEeTpE1d6YIadSa3FMyA34PWi8+3jdn
+lGSnK5MBlfKnk8Qo5vYOKPMgVmRPzqyJ8gUorNvAUEKZeFjV+wZeX/0yxSunumCj
+dfOk2TWDDwKBgEQE0xxED32HhH2774RHXPIMW6Rgb6XmiFbIb+6KmMd/mwQG+Iqp
+G0UzRKY0b28gPa5tDWmIglYBQUagwgV7CWOuUqBqpFns5rl7y/yY+nEkPKsKu5dA
+ZrK3i1gafd/EfkqwhSRhVwmUeGBXyok5kOrNh641A+KYyeQKyVY5qMiDAoGALJgb
+DIn/5ewfRxULRXmu2SbIUagaCNNOnop1pmDJ+93pCKZAGqd135BxhmCqkfREMY5r
+S2zgaKVLky3SqFqVVCiRmEz/KpmeRJNMMfyD2nTyjXSjw/Ka/e+Y04uIDpQvILLd
+xsAsNqLQZMDenbnJ57Vw3ZEa4s7lflyKd6ZnOYsCgYEA5jRpE1+lw1mAieDNovqH
+Mp2VwrmuFWhkeC7RW0G8ngNRzP9K6p77cDZGuR8GO5OHhpC3JG14OhOGL5rmDcwc
+ufXRlGMeAfWSY6EOY2hPWltML4EiX0zRESipQty8ns/HekIVlmOh4sv+3N3EqLlE
+edJcYLfcg1FGwnVQLHuVhy4=
+-----END PRIVATE KEY-----
--- /dev/null
+++ b/test/recipes/80-test_ocsp_check_data/server.pem
@@ -0,0 +1,75 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 4097 (0x1001)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Root CA
+        Validity
+            Not Before: Jul 12 09:33:13 2023 GMT
+            Not After : Jul 11 09:33:13 2024 GMT
+        Subject: CN=Server
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:db:e2:a3:08:74:02:d8:49:97:7b:fd:10:49:e4:
+                    f4:d1:65:2d:b7:77:84:a4:23:16:6e:38:65:e2:49:
+                    d6:0d:c8:33:6a:83:e8:d9:67:91:cf:26:ed:59:71:
+                    91:59:ec:06:08:34:20:27:93:fc:af:d6:b3:dd:02:
+                    8c:f9:d2:c6:4a:4e:31:da:71:06:4b:85:a4:9d:b3:
+                    43:e5:37:9f:d3:ae:4c:14:d1:65:1b:6a:51:56:9b:
+                    90:fa:2c:1f:95:94:37:64:39:25:92:3b:75:0d:a3:
+                    6d:e7:5f:7c:01:30:25:8b:f6:d4:ea:34:2c:33:37:
+                    1f:28:dc:fe:8b:f2:08:c4:3b:23:94:de:52:01:dc:
+                    35:34:16:01:99:37:41:64:93:b6:6b:6d:9c:68:96:
+                    7e:fc:1d:c8:1f:c0:1c:56:0b:64:9a:7c:ec:14:f7:
+                    3a:1f:8d:d7:04:42:be:10:ea:40:0a:0c:ad:4c:ec:
+                    46:1b:ab:c5:3a:ec:15:12:ed:24:51:a2:3d:94:6f:
+                    a2:8d:85:31:82:b8:7e:5f:d0:ce:2e:9b:29:2f:a2:
+                    78:38:6e:fa:98:aa:6a:e9:00:cd:2a:57:f1:74:9e:
+                    0b:ac:f2:a2:60:00:7d:b5:01:e1:c0:bc:6f:62:b8:
+                    ff:c0:a6:16:ec:94:a1:65:f8:c7:b9:dc:9d:ff:d8:
+                    0f:e5
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            X509v3 Subject Key Identifier: 
+                3E:48:4E:C9:24:FA:DE:27:EA:A4:98:81:2A:06:12:9A:F6:FA:17:4E
+            X509v3 Authority Key Identifier: 
+                63:2F:CE:D5:F6:6A:93:75:66:0C:08:D3:41:6F:A1:DA:CB:B3:B0:3E
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        22:fe:de:97:6e:e8:5d:65:91:f0:70:af:97:85:53:5e:8e:c8:
+        88:9b:e5:b3:33:d4:21:b9:3b:09:b7:72:70:16:8c:a8:0e:80:
+        0f:1b:03:cb:95:94:ae:40:e2:3b:54:06:ec:1e:f5:bc:58:8a:
+        22:57:cf:fe:14:b0:15:8c:18:5d:9d:fe:0e:70:55:26:c5:cc:
+        92:f3:bf:03:19:e6:bd:41:b5:c3:cf:15:d3:e9:10:df:65:2a:
+        68:c0:a3:df:93:a4:b1:66:20:94:1d:df:0a:9c:05:e7:74:a1:
+        1a:39:db:c2:5b:78:8c:0c:f6:5e:30:80:cc:39:04:8a:8c:db:
+        81:c1:5b:b4:3e:c2:ba:ae:06:ec:19:91:b4:a5:46:05:e7:8c:
+        ef:88:3f:d1:38:d3:37:42:88:25:c2:43:9b:df:7f:7c:15:c3:
+        7b:72:d2:b6:49:45:ce:c8:ce:f1:2d:be:7b:86:1c:31:8d:c9:
+        de:51:d4:06:9f:1d:f2:86:ac:bf:5f:4d:da:31:26:70:ce:e1:
+        0a:87:1f:a9:73:24:78:a2:4a:c2:73:ea:4c:6b:2c:a7:b6:1c:
+        d7:c3:5e:3a:8a:f9:02:54:62:73:a2:a6:3e:e5:d6:2d:6f:6e:
+        ba:57:11:20:d1:41:2e:c7:6b:d8:7d:70:5e:1d:17:03:5e:a7:
+        16:c9:4b:fb
+-----BEGIN CERTIFICATE-----
+MIIC7DCCAdSgAwIBAgICEAEwDQYJKoZIhvcNAQELBQAwEjEQMA4GA1UEAwwHUm9v
+dCBDQTAeFw0yMzA3MTIwOTMzMTNaFw0yNDA3MTEwOTMzMTNaMBExDzANBgNVBAMM
+BlNlcnZlcjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANviowh0AthJ
+l3v9EEnk9NFlLbd3hKQjFm44ZeJJ1g3IM2qD6Nlnkc8m7VlxkVnsBgg0ICeT/K/W
+s90CjPnSxkpOMdpxBkuFpJ2zQ+U3n9OuTBTRZRtqUVabkPosH5WUN2Q5JZI7dQ2j
+bedffAEwJYv21Oo0LDM3Hyjc/ovyCMQ7I5TeUgHcNTQWAZk3QWSTtmttnGiWfvwd
+yB/AHFYLZJp87BT3Oh+N1wRCvhDqQAoMrUzsRhurxTrsFRLtJFGiPZRvoo2FMYK4
+fl/Qzi6bKS+ieDhu+piqaukAzSpX8XSeC6zyomAAfbUB4cC8b2K4/8CmFuyUoWX4
+x7ncnf/YD+UCAwEAAaNNMEswCQYDVR0TBAIwADAdBgNVHQ4EFgQUPkhOyST63ifq
+pJiBKgYSmvb6F04wHwYDVR0jBBgwFoAUYy/O1fZqk3VmDAjTQW+h2suzsD4wDQYJ
+KoZIhvcNAQELBQADggEBACL+3pdu6F1lkfBwr5eFU16OyIib5bMz1CG5Owm3cnAW
+jKgOgA8bA8uVlK5A4jtUBuwe9bxYiiJXz/4UsBWMGF2d/g5wVSbFzJLzvwMZ5r1B
+tcPPFdPpEN9lKmjAo9+TpLFmIJQd3wqcBed0oRo528JbeIwM9l4wgMw5BIqM24HB
+W7Q+wrquBuwZkbSlRgXnjO+IP9E40zdCiCXCQ5vff3wVw3ty0rZJRc7IzvEtvnuG
+HDGNyd5R1AafHfKGrL9fTdoxJnDO4QqHH6lzJHiiSsJz6kxrLKe2HNfDXjqK+QJU
+YnOipj7l1i1vbrpXESDRQS7Ha9h9cF4dFwNepxbJS/s=
+-----END CERTIFICATE-----
--- a/util/libcrypto.num
+++ b/util/libcrypto.num
@@ -4649,3 +4649,4 @@ fips_sli_RAND_bytes_is_approved
 fips_sli_RAND_priv_bytes_is_approved    6610	1_1_1l	EXIST::FUNCTION:
 FIPS_entropy_init                       6611	1_1_1l	EXIST::FUNCTION:
 FIPS_entropy_cleanup                    6612	1_1_1l	EXIST::FUNCTION:
+OCSP_RESPONSE_check_status              6613	1_1_1l	EXIST::FUNCTION:OCSP