Interface OcspResponseBuilder

public interface OcspResponseBuilder
A fluent builder for unsigned OCSP ResponseData or a successful, signed OCSP response (RFC 6960) carrying a BasicOCSPResponse.

The tbsResponseData is signed by a caller supplied ContentSigner; the result is the DER of the whole OCSPResponse with responseStatus = successful.

Instances are single-use and not thread-safe.

  • Method Details

    • responderId

      OcspResponseBuilder responderId(ResponderId responderId)
      Sets the responder identity (required).
      Parameters:
      responderId - the responder id
      Returns:
      this builder

    • producedAt

      OcspResponseBuilder producedAt(Instant producedAt)
      Sets producedAt (required).
      Parameters:
      producedAt - the response production time
      Returns:
      this builder

    • addResponse

      OcspResponseBuilder addResponse(CertId certId, CertStatus status, Instant thisUpdate, Instant nextUpdate)
      Adds a single certificate-status response.
      Parameters:
      certId - the requested certificate id
      status - the certificate status
      thisUpdate - the time the status is known to be correct
      nextUpdate - the time newer information will be available (nullable)
      Returns:
      this builder

    • nonce

      OcspResponseBuilder nonce(byte[] nonce)
      Adds a response nonce (echoing the request nonce).
      Parameters:
      nonce - the nonce bytes
      Returns:
      this builder

    • buildTbs

      byte[] buildTbs()
      Encodes the exact unsigned ResponseData that a signer must sign. Preserves response insertion order, responder identity, status/time fields and the optional response nonce. The returned DER contains no signature, signature algorithm, outer response envelope or certificate chain. This method neither invokes a signer nor mutates the configured fields.

      The returned array is independently owned by the caller. Time and auxiliary memory are linear in the encoded response-data size. Response count and total response size retain the builder's existing caller-managed limits; this method adds no live-response size policy.

      Returns:
      freshly encoded unsigned ResponseData DER
      Throws:
      NullPointerException - if required responder, production time or response fields are missing
      IllegalStateException - if response data cannot be encoded

    • build

      byte[] build(ContentSigner signer, List<X509Certificate> chain)
      Signs the assembled tbsResponseData and returns the DER of the whole successful OCSPResponse.
      Parameters:
      signer - the content signer supplying the signature and algorithm
      chain - nonnull responder certificate chain in embedding order; empty omits the optional certificates field
      Returns:
      the DER-encoded OCSP response
      Throws:
      NullPointerException - if a required field, signer, chain or certificate is null
      IllegalStateException - if encoding or signing fails