c - OpenSSL certificate revocation check in client program using OCSP stapling -

i have embedded c client program securely connects server using openssl. server provides certificate during handshake , client has check revocation status of certificate. using ocsp.

all of works, need re-implement client's revocation check using ocsp stapling (assuming server start providing this).

currently server certificate using x509 *cert = ssl_get_peer_certificate(ssl) check subjectaltname against server's domain , authorityinfoaccess (for ocsp uri).

assuming have ssl * ssl; , set , connected via ssl_connect(ssl);, do @ point @ ocsp stapling information , verify certificate received? can't find sample code how implement using openssl library.

there couple steps:

1. have client send status_request extension via ssl_set_tlsext_status_type(ssl, tlsext_statustype_ocsp).

2. register callback (and argument) examine ocsp response via ssl_ctx_set_tlsext_status_cb(ctx, ocsp_resp_cb) , ssl_ctx_set_tlsext_status_arg(ctx, arg)

3. write callback function. 1 used s_client demonstrates how @ response information:

   static int ocsp_resp_cb(ssl *s, void *arg) { const unsigned char *p; int len; ocsp_response *rsp; len = ssl_get_tlsext_status_ocsp_resp(s, &p); bio_puts(arg, "ocsp response: "); if (!p)     {     bio_puts(arg, "no response sent\n");     return 1;     } rsp = d2i_ocsp_response(null, &p, len); if (!rsp)     {     bio_puts(arg, "response parse error\n");     bio_dump_indent(arg, (char *)p, len, 4); return 0; } bio_puts(arg, "\n======================================\n"); ocsp_response_print(arg, rsp, 0); bio_puts(arg, "======================================\n"); ocsp_response_free(rsp); return 1; }