Initializes the CActive base class object and adds this object to the active scheduler.

Cancels any outstanding validation and frees all resources owned by this object.

Implement MOCSPAuthorisationScheme . This is an active object, and this function just calls Cancel() . See DoCancel() for information about the cancellation process.

DoCancel

Strictly, none of the resources owned by this object are required for all of its lifetime need to be preserved between validations.

Some of the resources, such as the CPKIXCertChain instance have to be reallocated for every validation.

The resources which can be allocated for the lifetime of this object are allocated here. This improves performance and simplifies the validation process, at a RAM cost.

If a validation request is outstanding, then it is cancelled. This objects client, i.e. the owner of the TRequestStatus which was passed to Validate(), is completed with KErrCancel.

Factory function allocates new instance of COCSPDelegateAuthorisationScheme .

For list of certificate entries in the store retrieve each certificate.

Once the certificate has been retrieved from the store, it should be sent for chain validation. This intermediate state is required so that we can retrieve the certificate from the store.

Returns the responder certificate.

Handles an active object's request completion event.

A derived class must provide an implementation to handle the completed request. If appropriate, it may issue another request.

The function is called by the active scheduler when a request completion event occurs, i.e. after the active scheduler's WaitForAnyRequest() function completes.

Before calling this active object's RunL() function, the active scheduler has:

1. decided that this is the highest priority active object with a completed request

2. marked this active object's request as complete (i.e. the request is no longer outstanding)

RunL() runs under a trap harness in the active scheduler. If it leaves, then the active scheduler calls RunError() to handle the leave.

Note that once the active scheduler's Start() function has been called, all user code is run under one of the program's active object's RunL() or RunError() functions.

CActiveScheduler::Start CActiveScheduler::Error CActiveScheduler::WaitForAnyRequest TRAPD

Initialize this object to validate the certificate which was sent with the response against the CA which was used to sign the certificate in question.

Initiates request to retrieve the responder certificate from store.

Implement MOCSPAuthorisationScheme .

Validate the response if it is signed by an immediate delegate of the intermediate entity. I.e. if the request has the form (T->I) (I->E)

where T is trusted (at least for the purposes of this validation) and I is an intermediate, the response can be signed by R if (I->R).

I is the CA, and can be equal to T, i.e. the certificate which is being tested for revocation can be signed by a root certificate.

R must be immediately signed by I, and must have id-kp-OCSPSigning in its extended key usage. (RFC 2560 S4.2.2.2)

This is a required argument for CPKIXCertChainBase , even though no certificates are used from the store.

Pointer to client's request status. This is recorded on the call to Validate() and used to notify the client of completion later.

Pointer to client's OSCP status. This object sets the status according to the result of the validation. If the validation cannot be carried out, the default value is OCSP::EResponseSignatureValidationFailure.

The cert chain stores the validation result in this object.

iRespSignCertChain;

This object is used to chain the response signer back to the CA.

Array used to hold pointer to issuer cert. This contains the pointer to the CA.

Response from OCSP server. Once it has been established that the certificate sent with the response is an authorised responder for the CA, the response is checked to ensure that it really is signed by that certificate.

This is not const because, if DSA is used, then SetParametersL() will be called on the response before the signature is verified.