MCL/sf/mw/securitysrv: comparison pkiutilities/ocsp/inc/ocsprequestandresponse.h

equal deleted inserted replaced

--1:000000000000
+:164170e6151a
+// Copyright (c) 2001-2009 Nokia Corporation and/or its subsidiary(-ies).
+// All rights reserved.
+// This component and the accompanying materials are made available
+// under the terms of "Eclipse Public License v1.0"
+// which accompanies this distribution, and is available
+// at the URL "http://www.eclipse.org/legal/epl-v10.html".
+//
+// Initial Contributors:
+// Nokia Corporation - initial contribution.
+//
+// Contributors:
+//
+// Description:
+// ocsp.h
+// Header specifying client interface to the OCSP module.
+//
+//
+#ifndef OCSPREQUESTANDRESPONSE_H
+#define OCSPREQUESTANDRESPONSE_H
+/**
+* @file
+* @internalTechnology
+*/
+#include <e32base.h>
+#include <signed.h>
+#include <f32file.h>
+#include <hash.h>
+#include <x500dn.h>
+#include <x509cert.h>
+#include <ct/rmpointerarray.h>
+#include <cctcertinfo.h>
+#include <asn1enc.h>
+#include <asn1dec.h>
+#ifdef SYMBIAN_ENABLE_SPLIT_HEADERS
+#include "ocsp.h"
+#endif
+#define KOCSPNonceBytes 16
+// Default values for transport parameters
+const TUint KTransportDefaultRequestRetryCount 	= 1;	// No retry
+const TInt KTransportDefaultRequestTimeout 		= -1;	// Timeout disabled
+class COCSPRequestCertInfo;
+class COCSPResponseCertInfo;
+class COCSPCertID;
+class MOCSPTransport;
+class COCSPResponse;
+class COCSPTransportHandler;
+class MOCSPAuthorisationScheme;
+class COCSPTransaction;
+class COCSPValidator;
+class COCSPRequestCertInfo;
+class COCSPResponseDecoder;
+class CASN1EncBase;
+class CASN1EncContainer;
+class TASN1DecGeneric;
+class CX509Certificate;
+class CX509CertChain;
+class CPKIXCertChainBase;
+class COCSPParameters;
+/**
+* Represents an OCSP protocol request.
+*/
+class COCSPRequest : public CBase
+	{
+public:
+	/**
+	 * Get the nonce used in the request.  Returns NULL if a nonce was not used.
+	 */
+	IMPORT_C const TDesC8* Nonce() const;
+	/**
+	 * Get the number of certificates used in a response
+	 */
+	IMPORT_C TInt CertCount() const;
+	/**
+	 * Get a COCSPRequestCertInfo object containing details about one of the
+	 * certificates present in the request.
+	 */
+	IMPORT_C const COCSPRequestCertInfo& CertInfo(TUint aIndex) const;
+public:
+	// Not exported
+	static COCSPRequest* NewLC(TBool aUseNonce);
+	static COCSPRequest* NewL(TBool aUseNonce);
+	~COCSPRequest();
+	void AddCertificateL(const CX509Certificate& aSubject,
+						 const CX509Certificate& aIssuer);
+private:
+	COCSPRequest();
+	void ConstructL(TBool aUseNonce);
+	HBufC8* iNonce;
+	RPointerArray<const COCSPRequestCertInfo> iCertInfos;
+	};
+/**
+* Information about a certificate sent as part of an OCSP request.
+*/
+class COCSPRequestCertInfo : public CBase
+	{
+public:
+	/**
+	 * Get the certificate present in the request.
+	 */
+	IMPORT_C const CX509Certificate& Subject() const;
+	/**
+	 * Get the issuer of the certificate present in the request.
+	 */
+	IMPORT_C const CX509Certificate& Issuer() const;
+public:
+	// Not exported
+	static COCSPRequestCertInfo* NewLC(
+		const CX509Certificate& aSubject,
+		const CX509Certificate& aIssuer);
+	~COCSPRequestCertInfo();
+	const COCSPCertID& CertID() const;
+private:
+	COCSPRequestCertInfo(const CX509Certificate& aIssuer,
+						 const CX509Certificate& aSubject);
+	void ConstructL();
+private:
+	const CX509Certificate& iSubject;
+	const CX509Certificate& iIssuer;
+	COCSPCertID* iCertID;
+	};
+/**
+* Represents an OCSP protocol response.
+*/
+class COCSPResponse : public CSignedObject
+	{
+public:
+	/**
+	 * Get the number of certificates statuses present in the response.
+	 */
+	IMPORT_C TInt CertCount() const;
+	/**
+	 * Get a COCSPResponseCertInfo object containing details about one of the
+	 * certificate statuses present in the response.
+	 */
+	IMPORT_C const COCSPResponseCertInfo& CertInfo(TUint aIndex) const;
+	/**
+	 * Get the producedAt time for the response.
+	 */
+	IMPORT_C TTime ProducedAt() const;
+	/**
+	 * Get the archiveCutoff time for the response, or NULL if it was not present.
+	 */
+	IMPORT_C const TTime* ArchiveCutoff() const;
+public:
+	// This class is created and initialised by the response decoder
+	friend class COCSPResponseDecoder;
+	~COCSPResponse();
+	/**
+	 * Get the index for the given cert, or KErrNotFound.
+	 */
+	TInt Find(const COCSPCertID& aCertID) const;
+	// Enums to use in DataElementEncoding
+	enum
+		{
+		ECertificateChain,
+		ENonce,
+		EResponderIDName,    // Only one of the ResponderIDs won't be NULL
+		EResponderIDKeyHash
+		};
+	// From CSignedObject
+	const TPtrC8* DataElementEncoding(const TUint aIndex) const;
+private:
+	COCSPResponse();
+	// From CSignedObject
+	const TPtrC8 SignedDataL() const;
+	void InternalizeL(RReadStream& aStream);
+private:
+	// Time of response, and of archiveCutoff extension (if present)
+	TTime iProducedAt;
+	TTime* iArchiveCutoff;
+	// Value of nonce in response extension (if present)
+	TPtrC8 iNonce;
+	// Point to the signing certificates in the response
+	TPtrC8 iSigningCerts;
+	// Point to the signed portion of the data
+	TPtrC8 iSignedData;
+	// There are two ways the responder ID can be specified - only
+	// one of these will be used
+	TPtrC8 iResponderIDName;
+	TPtrC8 iResponderIDKeyHash;
+	RPointerArray<COCSPResponseCertInfo> iCertInfos;
+	};
+/**
+* Information about a certificate status, as given in OCSP response
+* singleResponse data item.
+*/
+class COCSPResponseCertInfo : public CBase
+	{
+public:
+	IMPORT_C OCSP::TResult Status() const;
+	IMPORT_C TTime ThisUpdate() const;
+	IMPORT_C const TTime* NextUpdate() const;     // NULL if nextUpdate not set
+	IMPORT_C const TTime* RevocationTime() const; // NULL if not revoked
+public:
+	static COCSPResponseCertInfo* NewLC(CArrayPtr<TASN1DecGeneric>& aItems);
+	~COCSPResponseCertInfo();
+	COCSPCertID& CertID() const;
+private:
+	void ConstructL(CArrayPtr<TASN1DecGeneric>& aItems);
+private:
+	OCSP::TResult iStatus;
+	TTime iThisUpdate;
+	TTime* iNextUpdate;
+	TTime* iRevocationTime;
+	COCSPCertID* iCertID;
+	};
+/**
+	Utility class contains functions common to all validation
+	schemes.
+*/
+namespace OCSPUtils
+	{
+	TBool IsAIAForOCSPPresentL(const CX509Certificate& aCert);
+	TBool DoesResponderIdMatchCertL( const COCSPResponse& aResponse,
+											const CX509Certificate& aResponderCert);
+	TBool DoesDNNameMatchL( 	const COCSPResponse& aResponse, const CX509Certificate& aCert);
+	TBool DoesIssuerKeyMatchL(const COCSPResponse& aResponse, const CX509Certificate& aCert);
+	TBool IsResponseSignedByCertL( COCSPResponse* aResponse, const CX509Certificate& aCert);
+	TBool DoesCertHaveOCSPNoCheckExt( const CX509Certificate& aCert);
+	TDesC8* ServerUriL(	const CX509Certificate& aCert, const COCSPParameters* aParameters );
+	TBool IsUriAvailableL( const CX509Certificate& aCert, const COCSPParameters* aParameters );
+	TDesC8* GetAIAL(const CX509Certificate& aCert);
+	TBool DoesCertHaveOCSPSigningExtL(const CX509Certificate& aCert);
+	CX509Certificate* GetResponderCertLC(const TDesC8& aEncodedCerts);
+	}
+// Base class interface for authorisation schemes, for plugging into the validator object
+class MOCSPAuthorisationScheme
+	{
+public:
+	virtual ~MOCSPAuthorisationScheme() {};
+	virtual void ValidateL(
+		OCSP::TStatus& aOCSPStatus, COCSPResponse& aResponse,
+		const TTime aValidationTime, TRequestStatus& aStatus,
+		const COCSPRequest& aRequest) = 0;
+	virtual void CancelValidate() = 0;
+	// Returns the responder certificate. This method shall return valid responder
+	// certificate for delegate and direct schemes, for the cadirect scheme although
+	// the CA cert is the response cert but it returns NULL as the need for retrieving
+	// this certificate is to further send it for OCSP checking, this logic is only valid
+	// for delegate and direct schemes.
+	virtual const CX509Certificate* ResponderCert() const = 0;
+	};
+class CPKIXValidationResultBase;
+class CCertAttributeFilter;
+class MCertStore;
+class COCSPDelegateAuthorisationScheme : public CActive, public MOCSPAuthorisationScheme
+/**
+	Implement part of S2.2.2 of RFC 2560.
+	"a CA Designated Responder (Authorized Responder) who holds
+	a specially marked certificate issued directly by the CA,
+	indicating that the responder may issue OCSP responses for
+	that CA."
+*/
+	{
+public:
+	IMPORT_C static COCSPDelegateAuthorisationScheme* NewLC(MCertStore& aCertStore);
+	virtual ~COCSPDelegateAuthorisationScheme();
+	virtual void ValidateL(
+		OCSP::TStatus& aOCSPStatus, COCSPResponse& aResponse,
+		const TTime aValidationTime, TRequestStatus& aStatus,
+		const COCSPRequest& aRequest);
+	virtual void CancelValidate();
+	const CX509Certificate* ResponderCert() const;
+protected:
+	virtual void RunL();
+	virtual void DoCancel();
+	TInt RunError(TInt aError);
+private:
+	COCSPDelegateAuthorisationScheme(MCertStore& aCertStore);
+	void ConstructL();
+	void ValidateDelegateCertL(const TDesC8& aResponseCertChain, const TTime aValidationTime);
+	void OnChainValidationL();
+	// searches on the basis of the issuer's subject name
+	void ValidateFromRootsL();
+	void OnRetrieveNextL();
+	void OnRetrievingEntryL();
+private:
+	enum TDelegateAuthState
+	{
+	EOnChainValidation,
+	ERetrieveNext,
+	ERetrievingEntry,
+	};
+	/**
+		This is a required argument for CPKIXCertChainBase, even
+		though no certificates are used from the store.
+	 */
+	MCertStore& iCertStore;
+	/**
+		Pointer to client's OSCP status.  This object sets the
+		status according to the result of the validation.  If
+		the validation cannot be carried out, the default value
+		is OCSP::EResponseSignatureValidationFailure.
+	 */
+	OCSP::TStatus* iOCSPStatus;
+	/**
+		Pointer to client's request status.  This is recorded
+		on the call to Validate() and used to notify the client
+		of completion later.
+	 */
+	TRequestStatus* iClientStatus;
+	/**
+		Array used to hold pointer to issuer cert.  This contains
+		the pointer to the CA.
+	 */
+	RPointerArray<CX509Certificate> iRespSignIntCert;
+	/**
+		This object is used to chain the response signer back
+		to the CA.
+	 */
+	CPKIXCertChainBase* iRespSignCertChainBase;
+	/**
+		The cert chain stores the validation result in
+		this object.
+		@see iRespSignCertChain;
+	 */
+	CPKIXValidationResultBase* iPKIXResultBase;
+	/**
+		Response from OCSP server.  Once it has been established
+		that the certificate sent with the response is an authorised
+		responder for the CA, the response is checked to ensure
+		that it really is signed by that certificate.
+		This is not const because, if DSA is used, then
+		SetParametersL() will be called on the response before
+		the signature is verified.
+	 */
+	COCSPResponse* iResponse;
+	const COCSPRequest* iRequest;
+	CCertAttributeFilter* iCertFilter;
+	RMPointerArray<CCTCertInfo> iCertStoreEntries;
+	TDelegateAuthState	iState;
+	HBufC8* iEncodedCert;
+	const CX509Certificate* iResponseCert;
+	TInt iCertCount;
+	TTime iValidationTime;
+	TBool iValidateFromResponse;
+	};
+class COCSPCaDirectAuthorisationScheme : public CBase, public MOCSPAuthorisationScheme
+/**
+	Implement part of S2.2 of RFC 2560.
+	"The key used to sign the response MUST belong to one of the following...
+	-- the CA who issued the certificate in question"
+*/
+	{
+public:
+	IMPORT_C static COCSPCaDirectAuthorisationScheme* NewLC();
+	const CX509Certificate* ResponderCert() const;
+private:
+	virtual void ValidateL(
+		OCSP::TStatus& aOCSPStatus, COCSPResponse& aResponse,
+		const TTime aValidationTime, TRequestStatus& aStatus,
+		const COCSPRequest& aRequest);
+	virtual void CancelValidate();
+	TBool DoValidateL(
+		const COCSPRequest& aRequest, COCSPResponse& aResponse);
+	TBool CertChainMatchesCertL(
+		const TDesC8& aCertChainData, const CX509Certificate& aCert);
+	};
+// Authorisation scheme taking a cert store UID, and allowing those cert chains
+// with a root cert in the cert store valid for that UID
+	/**
+	Implement part of S2.2 of RFC 2560.
+	"The key used to sign the response MUST belong to one of the following...
+	-- a Trusted Responder whose public key is trusted by the requester"
+*/
+class COCSPDirectAuthorisationScheme : public CActive, public MOCSPAuthorisationScheme
+	{
+public:
+	IMPORT_C static COCSPDirectAuthorisationScheme* NewLC(const TUid& aCertStoreUid, MCertStore& aCertStore);
+	~COCSPDirectAuthorisationScheme();
+	// From MOCSPAuthorisationScheme
+	void ValidateL(OCSP::TStatus& aOCSPStatus, COCSPResponse& aResponse,
+		const TTime aValidationTime, TRequestStatus& aStatus,
+		const COCSPRequest& aRequest);
+	void CancelValidate();
+	const CX509Certificate* ResponderCert() const;
+protected:
+	virtual void DoCancel();
+	virtual void RunL();
+	virtual TInt RunError(TInt aError);
+private:
+	void ConstructL();
+	COCSPDirectAuthorisationScheme(const TUid& aCertStoreUid, MCertStore& aCertStore);
+	TBool ValidateSignatureL();
+	void ValidateFromRoots();
+	void ValidateCertChainL();
+	void StartValidateL();
+	void OnValidateCertChainL();
+	void OnListCertEntries();
+	void OnRetrieveNextL();
+	void OnRetrievingEntryL();
+private:
+	TUid iCertStoreUid;
+	COCSPResponse* iResponse;
+	CPKIXCertChainBase* iCertChain;
+	TRequestStatus* iClientStatus;
+	CPKIXValidationResultBase* iPKIXResult;
+	OCSP::TStatus* iOCSPStatus;
+	enum TStatus
+		{
+		EValidateCertChain, // waiting for cert chain validation to complete
+		EListCertEntries,   // waiting listing to complete
+		ERetrieveNext,      // get next cert entry
+		ERetrievingEntry,   // waiting for entry retrieval to complete
+		};
+	TStatus iState;
+	MCertStore& iCertStore;
+	CCertAttributeFilter* iCertFilter;
+	RMPointerArray<CCTCertInfo> iCertStoreEntries;
+	HBufC8* iEncodedCertBuf;
+	TPtr8* iEncodedCertPtr;
+	RFs iFs;
+	TInt iCurEntry; // while async processing 509 certs, points to the current one
+	TTime iValidationTime;
+	const COCSPRequest* iRequest;
+	const CX509Certificate* iResponseCert;
+	};
+/**
+* Interface through which the OCSP module sends requests to the outside world.
+* Normally, the appropriate concrete objects are made automatically, depending
+* on the URI, and so clients don't have to deal with this.  However, clients
+* can override the automatically created object by specifying their own
+* transport object instead.
+*/
+class MOCSPTransport
+	{
+public:
+	virtual ~MOCSPTransport() {};
+	/**
+	 * Send request data to a URI. This is an asynchronous method.
+	 * @param aURI			Target URI for sending the request
+	 * @param aRequest		Request packet
+	 * @param aTimeout		Request timeout in milliseconds (ignored if feature not supported)
+	 * @param aStatus		The request status object. On request completion, indicates the status
+	 */
+	virtual void SendRequest(const TDesC8& aURI,
+							 const TDesC8& aRequest,
+							 const TInt aTimeout,
+							 TRequestStatus& aStatus) = 0;
+	/**
+	 * Cancel the request.
+	 */
+	virtual void CancelRequest() = 0;
+	// The following methods will only be called after the aStatus above is completed
+	/**
+	 * Get the response data.  Panic if completion gave an error.
+	 */
+	virtual TPtrC8 GetResponse() const = 0;
+	};
+/**
+* Specifies paremeters needed to perform revocation checking.  The important
+* things to set are the certificates to be checked all - all the other
+* parameters have defaults.
+*/
+class COCSPParameters : public CBase
+	{
+public:
+	/**
+	 * Create a new parameters object.
+	 */
+	IMPORT_C static COCSPParameters* NewL();
+	IMPORT_C static COCSPParameters* NewLC();
+	/**
+	 * Add a certificate chain to be checked.  Does not take ownership -
+	 * certificates must not be destroyed until the OCSP check complete.
+	 */
+	IMPORT_C void AddCertificatesL(const CX509CertChain& aChain);
+	/**
+	 * Add a certificate to be checked.  Does not take ownership - certificates
+	 * must not be destroyed until the OCSP check complete.
+	 */
+	IMPORT_C void AddCertificateL(const CX509Certificate& aSubject, const CX509Certificate& aIssuer);
+	/**
+	 * Set whether or not to use a nonce.  By default this is turned on.
+	 */
+	IMPORT_C void SetUseNonce(TBool aUseNonce);
+	/**
+	 * Set the URI of the OCSP responder to use.  The descriptor is copied.
+	 *
+	 * @param aURI The URI of the responder to use.
+	 * @param aUseAIA Indicates whether to use the responder specified in
+	 * certifcate AuthorityInfoAccess extensions in preference to the one given
+	 * here.
+	 */
+	IMPORT_C void SetURIL(const TDesC8& aURI, TBool aUseAIA);
+	/**
+	 * Set the transport to use.  This method must be called - if no transport
+	 * is set COCSPClient::NewL will leave with KErrArgument.  This object takes
+	 * ownership.
+	 */
+	IMPORT_C void SetTransport(MOCSPTransport* aTransport);
+	/**
+	 * Set the retry count for failed send request attempts.
+	 * A default value of 1 (no retry) is used.
+	 *
+	 * @param aRetryCount		Retry count
+	 */
+	IMPORT_C void SetRetryCount(const TUint aRetryCount);
+	/**
+	 * Set the request timeout.
+	 * A default value of -1 (default transport timeout) is used.
+	 *
+	 * @param aTimeout			Request timeout in milliseconds
+	 */
+	IMPORT_C void SetTimeout(const TInt aTimeout);
+	/**
+	 * Add an authorisation scheme - takes ownership if it doesn't leave.
+	 * Clients must specify at least one such scheme, used to validate the signature
+	 * on the response.
+	 */
+	IMPORT_C void AddAuthorisationSchemeL(MOCSPAuthorisationScheme* aScheme);
+	IMPORT_C void AddAllAuthorisationSchemesL(const TUid& aCertStoreUid, MCertStore& aCertStore);
+	/**
+	 * Specify the authorisation time (optional - uses producedAt time from response otherwise).
+	 */
+	IMPORT_C void SetValidationTimeL(const TTime& aValidationTime);
+	/**
+	 * Specify the maximum age of the thisUpdate field in seconds (zero => don't check).
+	 */
+	IMPORT_C void SetMaxStatusAgeL(TUint aMaxAge);
+	/**
+	 * Specify how much leeway we allow when comparing times.
+	 */
+	IMPORT_C void SetTimeLeewayL(TUint aLeewaySeconds);
+	IMPORT_C void SetOCSPCheckForResponderCert(const TBool aResponderCertCheck);
+	IMPORT_C void SetCheckCertsWithAiaOnly(const TBool aCheckCertsWithAiaOnly);
+	IMPORT_C void SetUseAIA(const TBool aUseAIA);
+public:
+	// Not exported
+	~COCSPParameters();
+	TUint CertCount() const;
+	const CX509Certificate& SubjectCert(TUint aIndex) const;
+	const CX509Certificate& IssuerCert(TUint aIndex) const;
+	TBool UseNonce() const;
+	const TDesC8& DefaultURI() const;
+	TBool UseAIA() const;
+	MOCSPTransport* Transport() const;
+	TUint AuthSchemeCount() const;
+	MOCSPAuthorisationScheme& AuthScheme(TUint aIndex) const;
+	const TTime* ValidationTime() const;
+	const TUint* MaxStatusAge() const;
+	const TUint* TimeLeeway() const;
+	TBool GenerateResponseForMissingUri() const;
+	TUint RetryCount() const;
+	TInt Timeout() const;
+	TBool ReponderCertCheck() const;
+	const CX509Certificate& CACert(TUint aIndex) const;
+	TBool CheckCertsWithAiaOnly() const;
+private:
+	void ConstructL();
+	COCSPParameters();
+#ifdef _DEBUG
+	/** Panic codes used by this functions in this class. */
+	enum TPanic
+	{
+		/** AddAllAuthorisationSchemesL() called when already added at least one. */
+		EAAASAlreadyHaveSchemes = 0x10
+	};
+	static void Panic(TPanic aPanic);
+#endif
+private:
+	RPointerArray<CX509Certificate>			iSubjectCerts;
+	RPointerArray<CX509Certificate>			iIssuerCerts;
+	TBool									iUseNonce;
+	HBufC8*									iDefaultURI;
+	MOCSPTransport*							iTransport;
+	TBool									iUseAIA;
+	RPointerArray<MOCSPAuthorisationScheme> iAuthSchemes;
+	TTime*									iValidationTime;
+	TUint*									iMaxStatusAge;
+	TUint*									iTimeLeeway;
+	TBool									iGenerateResponseForMissingUri;
+	TBool									iResponderCertCheck;
+	TUint									iRetryCount;
+	TInt									iTimeout;
+	TBool									iCheckCertsWithAiaOnly;
+	};
+/**
+* Checks the revocation state of one or more certificates.
+*
+* The current implementation makes one OCSP request for every certificate
+* checked - future impelementations may check multiple certificates with a
+* single request.
+*/
+class COCSPClient : public CActive
+	{
+public:
+	/**
+	 * Create a new OCSP client.
+	 *
+	 * @param aParams An object describing the parameters for the check.  This
+	 * method takes ownership if it does not leave.
+	 */
+	IMPORT_C static COCSPClient* NewL(const COCSPParameters* aParams);
+	~COCSPClient();
+	/**
+	 * Start the checker - this is an asynchronous method.
+	 */
+	IMPORT_C void Check(TRequestStatus& aStatus);
+	/**
+	 * Cancel checking.
+	 */
+	IMPORT_C void CancelCheck(void);
+	/**
+	 * Get the summary result of the check.  If any certificates were revoked,
+	 * this returns ERevoked.  If no certificates were revoked, but if there
+	 * were any errors communicating with ocsp servers or any certs had unknown
+	 * status, this returns EUnknown.  Otherwise it returns EGood.
+	 * Panics if the check has not been run, or is not complete.
+	 */
+	IMPORT_C OCSP::TResult SummaryResult(void) const;
+	/**
+	 * Get the number of transactions made.
+	 * Panics if the check has not been run, or is not complete.
+	 */
+	IMPORT_C TInt TransactionCount(void) const;
+	/**
+	 * Get the request object for a specified transaction.
+	 * Panics if the check has not been run, is not complete, or the index is invalid.
+	 */
+	IMPORT_C const COCSPRequest& Request(TInt aIndex) const;
+	/**
+	 * Get the outcome for an individual transaction.
+	 */
+	IMPORT_C const TOCSPOutcome& Outcome(TInt aIndex) const;
+	/**
+	 * Get the response object for a specified transaction.  If there was an
+	 * error sending the request, this may return NULL for the corresponding
+	 * response.
+	 * Panics if the check has not been run, is not complete, or the index is invalid.
+	 */
+	IMPORT_C const COCSPResponse* Response(TInt aIndex) const;
+	IMPORT_C TBool CertsAvailableForOCSPCheck();
+protected:
+	virtual void RunL();
+	virtual TInt RunError(TInt aErr);
+	virtual void DoCancel();
+private:
+	enum TState
+		{
+		EInitial,
+		ESendingRequest,		// Request is being sent to server
+		EValidatingResponse,	// Request is being validated
+		EHaveResult,			// Validation complete
+		EError,					// We got an error
+		};
+	COCSPClient();
+	void ConstructL(const COCSPParameters* aParams);
+	void Destroy();
+	void DoCheck();
+	void SendRequest();
+	void DoSendRequestL();
+	void ValidateResponseL();
+	void HandleResponseReceivedL();
+	void HandleResponseValidatedL();
+	void HandleTransactionErrorL(OCSP::TStatus aStatus);
+	TState							iState;
+	TRequestStatus*					iClientStatus;
+	const COCSPParameters*			iParams;
+	const TDesC8*					iURI;
+	MOCSPTransport*					iTransport;
+	COCSPTransaction*				iTransaction;
+	RPointerArray<COCSPRequest>		iRequests;
+	RPointerArray<COCSPResponse>	iResponses;
+	COCSPValidator*					iValidator;
+	RArray<TOCSPOutcome>			iOutcomes;
+	OCSP::TResult					iSummaryResult;
+	};
+#endif // OCSPREQUESTANDRESPONSE_H