Lua Requires Chilkat v11.0.0+

Validate Certificate using OCSP Protocol

See more Certificates Examples

Demonstrates how to validate a certificate (check the revoked status) using the OCSP protocol. Lua

    -- In the following call to loadlib, change the path (./chilkat.dll) to the relative or absolute directory where the chilkat.dll, chilkat.so, or chilkat.dylib is located.
    chilkat = assert(package.loadlib("./chilkat.dll", "luaopen_chilkat"))()
    print(chilkat._VERSION)

    local success = false

    --  This requires the Chilkat API to have been previously unlocked.
    --  See Global Unlock Sample for sample code.

    --  This example will check the revoked status of a certificate loaded from a file.
    local cert = chilkat.newCert{}
    success = cert:LoadFromFile("qa_data/certs/google.crt")
    if success == false then
        print(cert:LastErrorText())

    end

    --  Get the cert's OCSP URL.
    local ocspUrl = cert:OcspUrl()

    --  Build the JSON that will be the OCSP request.

    --  Possible hash algorithms are sha1, sha256, sha384, sha512.  
    local hashAlg = "sha256"
    local prng = chilkat.newPrng{}
    local json = chilkat.newJsonObject{}
    json:setEmitCompact(false)
    --  Read more about OCSP nonce lengths
    json:UpdateString("extensions.ocspNonce",prng:GenRandom(16,"base64"))
    json:setI(0)
    json:UpdateString("request[i].cert.hashAlg",hashAlg)
    json:UpdateString("request[i].cert.issuerNameHash",cert:HashOf("IssuerDN",hashAlg,"base64"))
    json:UpdateString("request[i].cert.issuerKeyHash",cert:HashOf("IssuerPublicKey",hashAlg,"base64"))
    json:UpdateString("request[i].cert.serialNumber",cert:SerialNumber())

    print(json:Emit())

    --  Our OCSP request looks something like this:
    --  {
    --    "extensions": {
    --      "ocspNonce": "qZDfbpO+nUxRzz6c/SPjE5QCAsPfpkQlRDxTnGl0gnxt7iXO"
    --    },
    --    "request": [
    --      {
    --        "cert": {
    --          "hashAlg": "sha1",
    --          "issuerNameHash": "9u2wY2IygZo19o11oJ0CShGqbK0=",
    --          "issuerKeyHash": "d8K4UJpndnaxLcKG0IOgfqZ+uks=",
    --          "serialNumber": "6175535D87BF94B6"
    --        }
    --      }
    --    ]
    --  }

    local ocspRequest = chilkat.newBinData{}
    local http = chilkat.newHttp{}

    --  Convert our JSON to a binary (ASN.1) OCSP request
    success = http:CreateOcspRequest(json,ocspRequest)
    if success == false then
        print(http:LastErrorText())

    end

    --  Send the OCSP request to the OCSP server
    local resp = chilkat.newHttpResponse{}
    success = http:HttpBd("POST",ocspUrl,ocspRequest,"application/ocsp-request",resp)
    if success == false then
        print(http:LastErrorText())

    end

    --  Get the binary (ASN.1) OCSP reply
    local ocspReply = chilkat.newBinData{}
    resp:GetBodyBd(ocspReply)

    --  Convert the binary reply to JSON.
    --  Also returns the overall OCSP response status.
    local jsonReply = chilkat.newJsonObject{}
    local ocspStatus = http:ParseOcspReply(ocspReply,jsonReply)

    --  The ocspStatus can have one of these values:
    --  -1:  The ARG1 does not contain a valid OCSP reply.
    --  0:  Successful - Response has valid confirmations..
    --  1: Malformed request - Illegal confirmation request.
    --  2: Internal error - Internal error in issuer.
    --  3: Try later -  Try again later.
    --  4: Not used - This value is never returned.
    --  5: Sig required - Must sign the request.
    --  6: Unauthorized - Request unauthorized.

    if ocspStatus < 0 then
        print("Invalid OCSP reply.")

    end

    print("Overall OCSP Response Status: ", ocspStatus)

    --  Let's examine the OCSP response (in JSON).
    jsonReply:setEmitCompact(false)
    print(jsonReply:Emit())

    --  The JSON reply looks like this:
    --  (Use the online tool at https://tools.chilkat.io/jsonParse.cshtml
    --  to generate JSON parsing code.)

    --  {
    --    "responseStatus": 0,
    --    "responseTypeOid": "1.3.6.1.5.5.7.48.1.1",
    --    "responseTypeName": "ocspBasic",
    --    "response": {
    --      "responderIdChoice": "KeyHash",
    --      "responderKeyHash": "d8K4UJpndnaxLcKG0IOgfqZ+uks=",
    --      "dateTime": "20180803193937Z",
    --      "cert": [
    --        {
    --          "hashOid": "1.3.14.3.2.26",
    --          "hashAlg": "SHA-1",
    --          "issuerNameHash": "9u2wY2IygZo19o11oJ0CShGqbK0=",
    --          "issuerKeyHash": "d8K4UJpndnaxLcKG0IOgfqZ+uks=",
    --          "serialNumber": "6175535D87BF94B6",
    --          "status": 0,
    --          "thisUpdate": "20180803193937Z",
    --          "nextUpdate": "20180810193937Z"
    --        }
    --      ]
    --    }
    --  }
    --  

    --  The certificate status:
    local certStatus = -1
    if jsonReply:HasMember("response.cert[0].status") == true then
        certStatus = jsonReply:IntOf("response.cert[0].status")
    end

    --  Possible certStatus values are:
    --  -1: No status returned.
    --  0: Good
    --  1: Revoked
    --  2: Unknown.
    print("Certificate Status: ", certStatus)