An OpenSSL::OCSP::Request contains the certificate information for determining if a certificate has been revoked or not. A Request can be created for a certificate or from a DER-encoded request created elsewhere.

Class Methods

Creates a new OpenSSL::OCSP::Request. The request may be created empty or from a request_der string.

Instance Methods

Adds certificate_id to the request.

Adds a nonce to the OCSP request. If no nonce is given a random one will be generated.

The nonce is used to prevent replay attacks but some servers do not support it.

Returns all certificate IDs in this request.

Checks the nonce validity for this request and response.

The return value is one of the following:


nonce in request only.


nonces both present and not equal.


nonces present and equal.


nonces both absent.


nonce present in response only.

For most responses, clients can check result > 0. If a responder doesn’t handle nonces result.nonzero? may be necessary. A result of 0 is always an error.

No documentation available

Signs this OCSP request using cert, key and optional digest. If digest is not specified, SHA-1 is used. certs is an optional Array of additional certificates which are included in the request in addition to the signer certificate. Note that if certs is nil or not given, flag OpenSSL::OCSP::NOCERTS is enabled. Pass an empty array to include only the signer certificate.

flags is a bitwise OR of the following constants:


Don’t include any certificates in the request. certs will be ignored.

Returns true if the request is signed, false otherwise. Note that the validity of the signature is not checked. Use verify to verify that.

Returns this request as a DER-encoded string

Verifies this request using the given certificates and store. certificates is an array of OpenSSL::X509::Certificate, store is an OpenSSL::X509::Store.

Note that false is returned if the request does not have a signature. Use signed? to check whether the request is signed or not.