Add OCSP responder examples by julek-wolfssl · Pull Request #570 · wolfSSL/wolfssl-examples

julek-wolfssl · 2026-04-07T12:13:27Z

Three examples demonstrating the new OCSP Responder API:

ocsp-request-response.c - Pure API usage: encode DER OCSP requests
from certificates, generate signed responses, and verify them
in memory without networking.
ocsp-responder-http.c - Minimal HTTP server that accepts POST
requests with DER OCSP payloads and returns signed responses.
nginx-scgi/ - Production-style deployment using nginx as HTTP
frontend with wolfclu running as an SCGI backend for OCSP
processing.

Three examples demonstrating the new OCSP Responder API: 1. ocsp-request-response.c - Pure API usage: encode DER OCSP requests from certificates, generate signed responses, and verify them in memory without networking. 2. ocsp-responder-http.c - Minimal HTTP server that accepts POST requests with DER OCSP payloads and returns signed responses. 3. nginx-scgi/ - Production-style deployment using nginx as HTTP frontend with wolfclu running as an SCGI backend for OCSP processing.

Copilot

Pull request overview

Adds a new ocsp/responder/ set of examples showcasing the wolfSSL OCSP Responder API, including in-memory request/response generation, a minimal HTTP responder, and an nginx+SCGI deployment pattern using wolfCLU.

Changes:

Added two C examples: raw DER OCSP request/response and a minimal HTTP POST responder.
Added shared PEM->DER file loading helpers and a local Makefile to build the examples.
Added nginx+SCGI deployment example (config + run script) and documented how to run all examples.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
ocsp/responder/README.md	Documents the new responder examples and how to build/run them.
ocsp/responder/ocsp-request-response.c	In-memory OCSP request encode + response sign + verification flow example.
ocsp/responder/ocsp-responder-http.c	Minimal socket-based HTTP responder that returns signed OCSP responses.
ocsp/responder/ocsp-load-certs.h	Shared file/cert/key loading helpers for the C examples.
ocsp/responder/nginx-scgi/run.sh	Script to stand up wolfCLU SCGI backend + nginx frontend for OCSP.
ocsp/responder/nginx-scgi/nginx-ocsp.conf	Example nginx config to SCGI-pass OCSP requests to wolfCLU.
ocsp/responder/Makefile	Builds the responder examples against an installed wolfSSL.
.gitignore	Ignores the newly built responder example binaries.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

ocsp/responder/ocsp-request-response.c

ocsp/responder/ocsp-responder-http.c

- Add missing <time.h> include for time(NULL) usage - Replace atoi() with strtol() and validate Content-Length in RecvHttp and ParsePost to reject negative/overflowing values - Add SendAll() helper to handle partial send() writes - Check return values of socket(), setsockopt(), and listen()

ocsp/responder/ocsp-responder-http.c

ocsp/responder/ocsp-request-response.c

ocsp/responder/Makefile

- Add SO_RCVTIMEO (5s) on accepted client sockets to prevent indefinite blocking from incomplete requests - Move 64KB httpBuf/respBuf from stack to static globals - Fix SendAll infinite loop when send() returns 0 (check n <= 0) - Ignore SIGPIPE to prevent crash on client disconnect during writes - Use case-insensitive Content-Length header matching per RFC 7230 - Track error state and return nonzero from main on fatal errors - Reset ret after wolfSSL_CertManagerLoadCABuffer to avoid leaking WOLFSSL_SUCCESS (1) into error paths in ocsp-request-response.c - Add -Wextra to Makefile CFLAGS

Copilot

Pull request overview

Copilot reviewed 7 out of 8 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

ocsp/responder/ocsp-responder-http.c

ocsp/responder/ocsp-load-certs.h

ocsp/responder/nginx-scgi/run.sh

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 7 out of 8 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

ocsp/responder/ocsp-responder-http.c

ocsp/responder/ocsp-request-response.c

ocsp/responder/ocsp-load-certs.h

ocsp/responder/ocsp-responder-http.c

ocsp/responder/nginx-scgi/run.sh

dgarske

🐺 Skoll Code Review

Overall recommendation: APPROVE
Findings: 3 total — 2 posted, 1 skipped

Posted findings

[Medium] LoadFile does not validate fread return value — ocsp/responder/ocsp-load-certs.h:47
[Medium] wolfSSL_Init() return value not checked in HTTP responder — ocsp/responder/ocsp-responder-http.c:255

Skipped findings

[Low] Makefile uses -Wextra unlike other OCSP Makefiles

Review generated by Skoll via openclaw

dgarske · 2026-04-10T17:38:10Z

ocsp/responder/ocsp-load-certs.h

+    if (sz <= 0) { fclose(f); return NULL; }
+    buf = (byte*)malloc((size_t)sz);
+    if (!buf) { fclose(f); return NULL; }
+    *outSz = (int)fread(buf, 1, (size_t)sz, f);


🟡 [Medium] LoadFile does not validate fread return value
💡 SUGGEST bug

The LoadFile function does not check whether fread actually read the expected number of bytes. If fread encounters an I/O error or partial read, *outSz could be 0 or less than sz, and a buffer with incorrect/incomplete data is returned to the caller. The downstream callers (LoadCertDer, LoadKeyDer) would then pass a size-0 or short buffer to wc_CertPemToDer/wc_KeyPemToDer, which would return an error — so in practice this is safe — but the existing ocsp/stapling/ocsp-server.c:134 shows the project convention is to validate fread return against the expected size (if (fread(...) != (size_t)certPemSz)). For a shared utility header included by multiple files, adding this check improves robustness.

Suggestion:

Suggested change

*outSz = (int)fread(buf, 1, (size_t)sz, f);

*outSz = (int)fread(buf, 1, (size_t)sz, f);

fclose(f);

if (*outSz != (int)sz) { free(buf); return NULL; }

return buf;

dgarske · 2026-04-10T17:38:11Z

ocsp/responder/ocsp-responder-http.c

+    certFile = argv[2];
+    keyFile  = argv[3];
+
+    wolfSSL_Init();


🟡 [Medium] wolfSSL_Init() return value not checked in HTTP responder
💡 SUGGEST convention

In ocsp-responder-http.c, wolfSSL_Init() is called without checking the return value (line 255: wolfSSL_Init();). In contrast, ocsp-request-response.c in the same PR properly checks the return (lines 122-126). The ocsp_nonblock_async.c example also checks it. Since these two files are being introduced together as example code, they should demonstrate consistent best practices. If wolfSSL_Init() fails silently, all subsequent wolfSSL/wolfCrypt calls will produce undefined behavior.

Suggestion:

Suggested change

wolfSSL_Init();

if (wolfSSL_Init() != WOLFSSL_SUCCESS) {

fprintf(stderr, "wolfSSL_Init failed\n");

return 1;

}

dgarske · 2026-04-10T17:40:42Z

ocsp/responder/ocsp-responder-http.c

+    keyFile  = argv[3];
+
+    wolfSSL_Init();
+    {


Please avoid empty braces

julek-wolfssl self-assigned this Apr 7, 2026

Copilot AI review requested due to automatic review settings April 7, 2026 12:13

Copilot started reviewing on behalf of julek-wolfssl April 7, 2026 12:14 View session

Copilot AI reviewed Apr 7, 2026

View reviewed changes

julek-wolfssl assigned wolfSSL-Bot and unassigned julek-wolfssl Apr 8, 2026

dgarske requested changes Apr 8, 2026

View reviewed changes

dgarske assigned julek-wolfssl Apr 8, 2026

julek-wolfssl requested review from Copilot and dgarske April 9, 2026 17:06

Copilot AI reviewed Apr 9, 2026

View reviewed changes

Copilot started reviewing on behalf of julek-wolfssl April 9, 2026 19:36 View session

Update ocsp/responder/nginx-scgi/run.sh

b79c987

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings April 10, 2026 12:17

Copilot started reviewing on behalf of julek-wolfssl April 10, 2026 12:17 View session

Copilot AI reviewed Apr 10, 2026

View reviewed changes

julek-wolfssl removed their assignment Apr 10, 2026

dgarske reviewed Apr 10, 2026

View reviewed changes

dgarske requested changes Apr 10, 2026

View reviewed changes

ocsp/responder/ocsp-responder-http.c

keyFile = argv[3];

wolfSSL_Init();

{

Copy link
Copy Markdown

Contributor

dgarske Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please avoid empty braces

dgarske assigned julek-wolfssl Apr 10, 2026

-    wolfSSL_Init();
+if (wolfSSL_Init() != WOLFSSL_SUCCESS) {
+        fprintf(stderr, "wolfSSL_Init failed\n");
+        return 1;
+    }

Conversation

julek-wolfssl commented Apr 7, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dgarske left a comment

Choose a reason for hiding this comment

🐺 Skoll Code Review

Posted findings

Uh oh!

dgarske Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

dgarske Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

dgarske Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants