wolfSSL · night1rider · Aug 25, 2026 · Aug 27, 2026
diff --git a/.github/examples-manifest.yml b/.github/examples-manifest.yml
@@ -204,6 +204,16 @@ profiles:
       --enable-ocsp-responder --enable-cert-setup-cb --enable-sessioncerts
       --enable-tls13 --enable-static --enable-shared
 
+  ocsp-nonblock:
+    # ocsp/ocsp_nonblock: two clients that fetch a live cert and check OCSP
+    # non-blocking. The plain one needs opensslextra+sni; the async one adds
+    # asynccrypt, alpn and stapling.
+    flags: >-
+      --enable-ocsp --enable-ocspstapling --enable-ocspstapling2
+      --enable-asynccrypt --enable-opensslextra --enable-sni --enable-alpn
+      --enable-curve25519 --enable-tls13 --enable-static --enable-shared
+    cflags: "-DWOLFSSL_NONBLOCK_OCSP -DHAVE_IO_TIMEOUT"
+
   pkcs11:
     flags: "--enable-pkcs11 --enable-cryptocb --enable-static --enable-shared"
 
@@ -635,9 +645,9 @@ examples:
 
   - id: ocsp-nonblock
     path: ocsp/ocsp_nonblock
-    profile: ocsp
+    profile: ocsp-nonblock
     mode: build-only
-    reason: "ocsp_nonblock_async connects to an external responder on :443"
+    reason: "both clients connect to a live OCSP responder on :443"
 
   - id: ocsp-responder
     path: ocsp/responder

diff --git a/ocsp/ocsp_nonblock/README.md b/ocsp/ocsp_nonblock/README.md
@@ -5,44 +5,47 @@ Online Certificate Status Protocol (OCSP) is used for obtaining the revocation s
 
 ## OCSP non-blocking example
 
-This uses a google.com certificate chain to demonstrate validating revocation status using an OCSP server.
+This connects to a public server, fetches its leaf certificate, and checks that
+certificate's revocation status with a non-blocking OCSP lookup. The certificate
+is fetched live so nothing static can expire.
 
-The Google.com certificate defines OCSP in the X509v3 extension "Authority Information Access" section.
+It uses `www.digicert.com` because that certificate still has an OCSP responder
+(many CAs, including Google, have dropped OCSP). The bundled `ca_certs` hold the
+DigiCert CAs used to verify it.
 
 Example usage:
 
 ```sh
-$ ./configure --enable-ocsp CFLAGS="-DHAVE_IO_TIMEOUT -DWOLFSSL_NONBLOCK_OCSP"
+$ ./configure --enable-ocsp --enable-opensslextra --enable-sni \
+      CFLAGS="-DHAVE_IO_TIMEOUT -DWOLFSSL_NONBLOCK_OCSP"
 $ make
 $ sudo make install
 
 % make
 gcc -o ocsp_nonblock ocsp_nonblock.c -Wall -I/usr/local/include -Os -L/usr/local/lib -lwolfssl
 
 % ./ocsp_nonblock
+Fetched www.digicert.com certificate (1777 bytes)
 Loaded Trusted CA dir ca_certs (ret 1)
-Convert Google.com PEM cert to DER (ret 1)
-Verify Google.com cert: 1
+Verify www.digicert.com cert: 1
 OCSP Lookup:
-	URL: http://ocsp.pki.goog/gts1c3
-	Domain: ocsp.pki.goog
-	Path: /gts1c3
+	URL: http://ocsp.digicert.com
+	Domain: ocsp.digicert.com
+	Path: /
 	Port: 80
-OCSP Response: ret 471, nonblock count 409421
-Check OCSP for Google.com (ret 1)
+OCSP Response: ret 471, nonblock count 1
+Resp ret: 471
+Check OCSP for www.digicert.com (ret 1)
 Ret = 1: success
 ```
 
 ## OCSP non-blocking Async example
 
-This uses your system certificate chain to demonstrate validating revocation status using an OCSP
-public server with wolfSSL's Asynchronous cryptography support.
+This demonstrates validating revocation status using an OCSP public server with wolfSSL's
+Asynchronous cryptography support.
 
-**NOTE:** Before building this example the asynchronous support must be obtained from
-(https://github.com/wolfSSL/wolfAsyncCrypt) and installed into wolfSSL by following the
-instructions in the *README* file contained in the wolfAsyncCrypt repository.
-
-The example uses youtube.com as the public server.
+The example uses `www.digicert.com`, whose certificate still has an OCSP
+responder (many CAs, including Google, have dropped OCSP).
 
 Example usage:
 
@@ -59,70 +62,48 @@ gcc -o ocsp_nonblock_async ocsp_nonblock_async.c -Wall -I/usr/local/include -Os
 WolfSSL AsyncCrypt Enabled
 WolfSSL AsyncCrypt with Simulation Mode
 Connecting...
-wolfSSL_connect() returned -1 (error code -108)
-wolfSSL_connect() returned -1 (error code -108)
-wolfSSL_connect() returned -1 (error code -108)
-ocsp_cb(): http://ocsp.pki.goog/gsr1
-  simulate 'want read'
-wolfSSL_connect() returned -1 (error code -408)
-ocsp_cb(): http://ocsp.pki.goog/gsr1
-Running command:
-curl -s --data-binary '@ocsp.req' -o 'ocsp.resp' -X POST -H 'Cache-Control: no-cache' -H 'Content-Type: application/ocsp-request' 'http://ocsp.pki.goog/gsr1'
-Reading OCSP response from file...
-Read 1447 bytes.
-*response is (nil)
-Allocating 1447 bytes...
-*response is now 0x55ef7fdcb4e0
-Copying bytes...
-Bytes copied.
-verify_cb()
-  preverify_ok = 1
-wolfSSL_connect() returned -1 (error code -108)
-ocsp_cb(): http://ocsp.pki.goog/gtsr1
-  simulate 'want read'
-wolfSSL_connect() returned -1 (error code -408)
-ocsp_cb(): http://ocsp.pki.goog/gtsr1
-Running command:
-curl -s --data-binary '@ocsp.req' -o 'ocsp.resp' -X POST -H 'Cache-Control: no-cache' -H 'Content-Type: application/ocsp-request' 'http://ocsp.pki.goog/gtsr1'
-Reading OCSP response from file...
-Read 724 bytes.
-*response is (nil)
-Allocating 724 bytes...
-*response is now 0x55ef7fdaf030
-Copying bytes...
-Bytes copied.
 verify_cb()
   preverify_ok = 1
-wolfSSL_connect() returned -1 (error code -108)
-ocsp_cb(): http://ocsp.pki.goog/gts1c3
+ocsp_cb(): http://ocsp.digicert.com
   simulate 'want read'
-wolfSSL_connect() returned -1 (error code -408)
-ocsp_cb(): http://ocsp.pki.goog/gts1c3
-Running command:
-curl -s --data-binary '@ocsp.req' -o 'ocsp.resp' -X POST -H 'Cache-Control: no-cache' -H 'Content-Type: application/ocsp-request' 'http://ocsp.pki.goog/gts1c3'
-Reading OCSP response from file...
-Read 472 bytes.
-*response is (nil)
-Allocating 472 bytes...
-*response is now 0x55ef7fdac4b0
-Copying bytes...
-Bytes copied.
+ocsp_cb(): http://ocsp.digicert.com
 verify_cb()
   preverify_ok = 1
-wolfSSL_connect() returned -1 (error code -108)
 CONNECTED
   Closing connection...
-wolfSSL_shutdown() failed with code 2 (error 0)
   CLOSED
-test_connect() failed
-CONNECT FAILED
+CONNECT PASSED
 
 DONE
 ```
 
-The example uses `/etc/ssl/certs/ca-certificates.crt` as the system certs file by default. If your
-system doesn't have this file, just run the executable with the path to your own cert file.
+If you already have wolfSSL installed and do not want to change it, build a
+local wolfSSL copy but skip `make install`, then compile the example straight
+against that build (this leaves your existing install untouched):
+
+```sh
+# In your local wolfSSL source directory, build only (no install):
+$ ./configure --enable-ocsp --enable-asynccrypt --enable-sni --enable-alpn \
+      --enable-ocspstapling --enable-ocspstapling2 --enable-opensslextra \
+      --enable-curve25519 CFLAGS="-DWOLFSSL_NONBLOCK_OCSP"
+$ make
+
+# Back in this example directory, point the compiler at that build:
+$ WOLFSSL=/path/to/wolfssl
+$ gcc -o ocsp_nonblock_async ocsp_nonblock_async.c -Wall -Os \
+      -I$WOLFSSL -L$WOLFSSL/src/.libs -lwolfssl
+$ LD_LIBRARY_PATH=$WOLFSSL/src/.libs ./ocsp_nonblock_async
+```
+
+By default it loads the bundled `ca_certs/DigiCert_Global_Root_G2.pem` to check
+digicert.com's certificate, so it runs on its own. digicert.com is a real server,
+so its certificate can change. If the check fails, pass another cert file, such as
+your system CA bundle:
 
 ```
-./ocsp_nonblock_asynccrypt ../../mycerts/ca.crt
+./ocsp_nonblock_async /etc/ssl/certs/ca-certificates.crt
 ```
+
+On success it prints `CONNECTED` and, at the end, `CONNECT PASSED`. The
+`verify_cb` and `ocsp_cb` lines show the certificate check and OCSP lookup
+running.
diff --git a/ocsp/ocsp_nonblock/ca_certs/DigiCert_EV_RSA_CA_G2.pem b/ocsp/ocsp_nonblock/ca_certs/DigiCert_EV_RSA_CA_G2.pem
@@ -0,0 +1,30 @@
+-----BEGIN CERTIFICATE-----
+MIIFPDCCBCSgAwIBAgIQAWePH++IIlXYsKcOa3uyIDANBgkqhkiG9w0BAQsFADBh
+MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBH
+MjAeFw0yMDA3MDIxMjQyNTBaFw0zMDA3MDIxMjQyNTBaMEQxCzAJBgNVBAYTAlVT
+MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxHjAcBgNVBAMTFURpZ2lDZXJ0IEVWIFJT
+QSBDQSBHMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK0eZsx/neTr
+f4MXJz0R2fJTIDfN8AwUAu7hy4gI0vp7O8LAAHx2h3bbf8wl+pGMSxaJK9ffDDCD
+63FqqFBqE9eTmo3RkgQhlu55a04LsXRLcK6crkBOO0djdonybmhrfGrtBqYvbRat
+xenkv0Sg4frhRl4wYh4dnW0LOVRGhbt1G5Q19zm9CqMlq7LlUdAE+6d3a5++ppfG
+cnWLmbEVEcLHPAnbl+/iKauQpQlU1Mi+wEBnjE5tK8Q778naXnF+DsedQJ7NEi+b
+QoonTHEz9ryeEcUHuQTv7nApa/zCqes5lXn1pMs4LZJ3SVgbkTLj+RbBov/uiwTX
+tkBEWawvZH8CAwEAAaOCAgswggIHMB0GA1UdDgQWBBRqTlC/mGidW3sgddRZAXlI
+ZpIyBjAfBgNVHSMEGDAWgBROIlQgGJXm427mD/r6uRLtBhePOTAOBgNVHQ8BAf8E
+BAMCAYYwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBIGA1UdEwEB/wQI
+MAYBAf8CAQAwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2Nz
+cC5kaWdpY2VydC5jb20wewYDVR0fBHQwcjA3oDWgM4YxaHR0cDovL2NybDMuZGln
+aWNlcnQuY29tL0RpZ2lDZXJ0R2xvYmFsUm9vdEcyLmNybDA3oDWgM4YxaHR0cDov
+L2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0R2xvYmFsUm9vdEcyLmNybDCBzgYD
+VR0gBIHGMIHDMIHABgRVHSAAMIG3MCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5k
+aWdpY2VydC5jb20vQ1BTMIGKBggrBgEFBQcCAjB+DHxBbnkgdXNlIG9mIHRoaXMg
+Q2VydGlmaWNhdGUgY29uc3RpdHV0ZXMgYWNjZXB0YW5jZSBvZiB0aGUgUmVseWlu
+ZyBQYXJ0eSBBZ3JlZW1lbnQgbG9jYXRlZCBhdCBodHRwczovL3d3dy5kaWdpY2Vy
+dC5jb20vcnBhLXVhMA0GCSqGSIb3DQEBCwUAA4IBAQBSMgrCdY2+O9spnYNvwHiG
++9lCJbyELR0UsoLwpzGpSdkHD7pVDDFJm3//B8Es+17T1o5Hat+HRDsvRr7d3MEy
+o9iXkkxLhKEgApA2Ft2eZfPrTolc95PwSWnn3FZ8BhdGO4brTA4+zkPSKoMXi/X+
+WLBNN29Z/nbCS7H/qLGt7gViEvTIdU8x+H4l/XigZMUDaVmJ+B5d7cwSK7yOoQdf
+oIBGmA5Mp4LhMzo52rf//kXPfE3wYIZVHqVuxxlnTkFYmffCX9/Lon7SWaGdg6Rc
+k4RHhHLWtmz2lTZ5CEo2ljDsGzCFGJP7oT4q6Q8oFC38irvdKIJ95cUxYzj4tnOI
+-----END CERTIFICATE-----
diff --git a/ocsp/ocsp_nonblock/ca_certs/DigiCert_Global_Root_G2.pem b/ocsp/ocsp_nonblock/ca_certs/DigiCert_Global_Root_G2.pem
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDjjCCAnagAwIBAgIQAzrx5qcRqaC7KGSxHQn65TANBgkqhkiG9w0BAQsFADBh
+MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBH
+MjAeFw0xMzA4MDExMjAwMDBaFw0zODAxMTUxMjAwMDBaMGExCzAJBgNVBAYTAlVT
+MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j
+b20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IEcyMIIBIjANBgkqhkiG
+9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuzfNNNx7a8myaJCtSnX/RrohCgiN9RlUyfuI
+2/Ou8jqJkTx65qsGGmvPrC3oXgkkRLpimn7Wo6h+4FR1IAWsULecYxpsMNzaHxmx
+1x7e/dfgy5SDN67sH0NO3Xss0r0upS/kqbitOtSZpLYl6ZtrAGCSYP9PIUkY92eQ
+q2EGnI/yuum06ZIya7XzV+hdG82MHauVBJVJ8zUtluNJbd134/tJS7SsVQepj5Wz
+tCO7TG1F8PapspUwtP1MVYwnSlcUfIKdzXOS0xZKBgyMUNGPHgm+F6HmIcr9g+UQ
+vIOlCsRnKPZzFBQ9RnbDhxSJITRNrw9FDKZJobq7nMWxM4MphQIDAQABo0IwQDAP
+BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHQ4EFgQUTiJUIBiV
+5uNu5g/6+rkS7QYXjzkwDQYJKoZIhvcNAQELBQADggEBAGBnKJRvDkhj6zHd6mcY
+1Yl9PMWLSn/pvtsrF9+wX3N3KjITOYFnQoQj8kVnNeyIv/iPsGEMNKSuIEyExtv4
+NeF22d+mQrvHRAiGfzZ0JFrabA0UWTW98kndth/Jsw1HKj2ZL7tcu7XUIOGZX1NG
+Fdtom/DzMNU+MeKNhJ7jitralj41E6Vf8PlwUHBHQRFXGU7Aj64GxJUTFy8bJZ91
+8rGOmaFvE7FBcf6IKshPECBV1/MUReXgRPTqh5Uykw7+U0b6LJ3/iyK5S9kJRaTe
+pLiaWN0bfVKfjllDiIGknibVb63dDcY3fe0Dkhvld1927jyNxF1WW6LZZm6zNTfl
+MrY=
+-----END CERTIFICATE-----
diff --git a/ocsp/ocsp_nonblock/ca_certs/GTS_CA_1C3.pem b/ocsp/ocsp_nonblock/ca_certs/GTS_CA_1C3.pem
diff --git a/ocsp/ocsp_nonblock/ca_certs/GTS_Root_R1.pem b/ocsp/ocsp_nonblock/ca_certs/GTS_Root_R1.pem
diff --git a/ocsp/ocsp_nonblock/google.pem b/ocsp/ocsp_nonblock/google.pem