grpc 1.63.0 → 1.65.2

data/third_party/boringssl-with-bazel/src/ssl/s3_both.cc

@@ -721,7 +721,7 @@ bool ssl_tls13_cipher_meets_policy(uint16_t cipher_id,
 }
 
 const SSL_CIPHER *ssl_choose_tls13_cipher(CBS cipher_suites, bool has_aes_hw,
-                                          uint16_t version, uint16_t group_id,
+                                          uint16_t version,
                                           enum ssl_compliance_policy_t policy) {
   if (CBS_len(&cipher_suites) % 2 != 0) {
     return nullptr;

data/third_party/boringssl-with-bazel/src/ssl/s3_lib.cc

@@ -171,7 +171,6 @@ SSL3_STATE::SSL3_STATE()
       has_message(false),
       initial_handshake_complete(false),
       session_reused(false),
-      delegated_credential_used(false),
       send_connection_binding(false),
       channel_id_valid(false),
       key_update_pending(false),

data/third_party/boringssl-with-bazel/src/ssl/ssl_cert.cc

@@ -135,17 +135,10 @@
 BSSL_NAMESPACE_BEGIN
 
 CERT::CERT(const SSL_X509_METHOD *x509_method_arg)
-    : x509_method(x509_method_arg) {}
+    : default_credential(MakeUnique<SSL_CREDENTIAL>(SSLCredentialType::kX509)),
+      x509_method(x509_method_arg) {}
 
-CERT::~CERT() {
-  ssl_cert_clear_certs(this);
-  x509_method->cert_free(this);
-}
-
-static CRYPTO_BUFFER *buffer_up_ref(const CRYPTO_BUFFER *buffer) {
-  CRYPTO_BUFFER_up_ref(const_cast<CRYPTO_BUFFER *>(buffer));
-  return const_cast<CRYPTO_BUFFER *>(buffer);
-}
+CERT::~CERT() { x509_method->cert_free(this); }
 
 UniquePtr<CERT> ssl_cert_dup(CERT *cert) {
   UniquePtr<CERT> ret = MakeUnique<CERT>(cert->x509_method);
@@ -153,18 +146,17 @@ UniquePtr<CERT> ssl_cert_dup(CERT *cert) {
     return nullptr;
   }
 
-  if (cert->chain) {
-    ret->chain.reset(sk_CRYPTO_BUFFER_deep_copy(
-        cert->chain.get(), buffer_up_ref, CRYPTO_BUFFER_free));
-    if (!ret->chain) {
+  // TODO(crbug.com/boringssl/431): This should just be |CopyFrom|.
+  for (const auto &cred : cert->credentials) {
+    if (!ret->credentials.Push(UpRef(cred))) {
       return nullptr;
     }
   }
 
-  ret->privatekey = UpRef(cert->privatekey);
-  ret->key_method = cert->key_method;
-
-  if (!ret->sigalgs.CopyFrom(cert->sigalgs)) {
+  // |default_credential| is mutable, so it must be copied. We cannot simply
+  // bump the reference count.
+  ret->default_credential = cert->default_credential->Dup();
+  if (ret->default_credential == nullptr) {
     return nullptr;
   }
 
@@ -173,93 +165,18 @@ UniquePtr<CERT> ssl_cert_dup(CERT *cert) {
 
   ret->x509_method->cert_dup(ret.get(), cert);
 
-  ret->signed_cert_timestamp_list = UpRef(cert->signed_cert_timestamp_list);
-  ret->ocsp_response = UpRef(cert->ocsp_response);
-
   ret->sid_ctx_length = cert->sid_ctx_length;
   OPENSSL_memcpy(ret->sid_ctx, cert->sid_ctx, sizeof(ret->sid_ctx));
 
-  if (cert->dc) {
-    ret->dc = cert->dc->Dup();
-    if (!ret->dc) {
-       return nullptr;
-    }
-  }
-
-  ret->dc_privatekey = UpRef(cert->dc_privatekey);
-  ret->dc_key_method = cert->dc_key_method;
-
   return ret;
 }
 
-// Free up and clear all certificates and chains
-void ssl_cert_clear_certs(CERT *cert) {
-  if (cert == NULL) {
-    return;
-  }
-
-  cert->x509_method->cert_clear(cert);
-
-  cert->chain.reset();
-  cert->privatekey.reset();
-  cert->key_method = nullptr;
-
-  cert->dc.reset();
-  cert->dc_privatekey.reset();
-  cert->dc_key_method = nullptr;
-}
-
 static void ssl_cert_set_cert_cb(CERT *cert, int (*cb)(SSL *ssl, void *arg),
                                  void *arg) {
   cert->cert_cb = cb;
   cert->cert_cb_arg = arg;
 }
 
-enum leaf_cert_and_privkey_result_t {
-  leaf_cert_and_privkey_error,
-  leaf_cert_and_privkey_ok,
-  leaf_cert_and_privkey_mismatch,
-};
-
-// check_leaf_cert_and_privkey checks whether the certificate in |leaf_buffer|
-// and the private key in |privkey| are suitable and coherent. It returns
-// |leaf_cert_and_privkey_error| and pushes to the error queue if a problem is
-// found. If the certificate and private key are valid, but incoherent, it
-// returns |leaf_cert_and_privkey_mismatch|. Otherwise it returns
-// |leaf_cert_and_privkey_ok|.
-static enum leaf_cert_and_privkey_result_t check_leaf_cert_and_privkey(
-    CRYPTO_BUFFER *leaf_buffer, EVP_PKEY *privkey) {
-  CBS cert_cbs;
-  CRYPTO_BUFFER_init_CBS(leaf_buffer, &cert_cbs);
-  UniquePtr<EVP_PKEY> pubkey = ssl_cert_parse_pubkey(&cert_cbs);
-  if (!pubkey) {
-    OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
-    return leaf_cert_and_privkey_error;
-  }
-
-  if (!ssl_is_key_type_supported(EVP_PKEY_id(pubkey.get()))) {
-    OPENSSL_PUT_ERROR(SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE);
-    return leaf_cert_and_privkey_error;
-  }
-
-  // An ECC certificate may be usable for ECDH or ECDSA. We only support ECDSA
-  // certificates, so sanity-check the key usage extension.
-  if (EVP_PKEY_id(pubkey.get()) == EVP_PKEY_EC &&
-      !ssl_cert_check_key_usage(&cert_cbs, key_usage_digital_signature)) {
-    OPENSSL_PUT_ERROR(SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE);
-    return leaf_cert_and_privkey_error;
-  }
-
-  if (privkey != NULL &&
-      // Sanity-check that the private key and the certificate match.
-      !ssl_compare_public_and_private_key(pubkey.get(), privkey)) {
-    ERR_clear_error();
-    return leaf_cert_and_privkey_mismatch;
-  }
-
-  return leaf_cert_and_privkey_ok;
-}
-
 static int cert_set_chain_and_key(
     CERT *cert, CRYPTO_BUFFER *const *certs, size_t num_certs,
     EVP_PKEY *privkey, const SSL_PRIVATE_KEY_METHOD *privkey_method) {
@@ -274,75 +191,35 @@ static int cert_set_chain_and_key(
     return 0;
   }
 
-  switch (check_leaf_cert_and_privkey(certs[0], privkey)) {
-    case leaf_cert_and_privkey_error:
-      return 0;
-    case leaf_cert_and_privkey_mismatch:
-      OPENSSL_PUT_ERROR(SSL, SSL_R_CERTIFICATE_AND_PRIVATE_KEY_MISMATCH);
-      return 0;
-    case leaf_cert_and_privkey_ok:
-      break;
-  }
-
-  UniquePtr<STACK_OF(CRYPTO_BUFFER)> certs_sk(sk_CRYPTO_BUFFER_new_null());
-  if (!certs_sk) {
+  cert->default_credential->ClearCertAndKey();
+  if (!SSL_CREDENTIAL_set1_cert_chain(cert->default_credential.get(), certs,
+                                      num_certs)) {
     return 0;
   }
 
-  for (size_t i = 0; i < num_certs; i++) {
-    if (!PushToStack(certs_sk.get(), UpRef(certs[i]))) {
-      return 0;
-    }
-  }
-
-  cert->privatekey = UpRef(privkey);
-  cert->key_method = privkey_method;
+  cert->x509_method->cert_flush_cached_leaf(cert);
+  cert->x509_method->cert_flush_cached_chain(cert);
 
-  cert->chain = std::move(certs_sk);
-  return 1;
+  return privkey != nullptr
+             ? SSL_CREDENTIAL_set1_private_key(cert->default_credential.get(),
+                                               privkey)
+             : SSL_CREDENTIAL_set_private_key_method(
+                   cert->default_credential.get(), privkey_method);
 }
 
 bool ssl_set_cert(CERT *cert, UniquePtr<CRYPTO_BUFFER> buffer) {
-  switch (check_leaf_cert_and_privkey(buffer.get(), cert->privatekey.get())) {
-    case leaf_cert_and_privkey_error:
-      return false;
-    case leaf_cert_and_privkey_mismatch:
-      // don't fail for a cert/key mismatch, just free current private key
-      // (when switching to a different cert & key, first this function should
-      // be used, then |ssl_set_pkey|.
-      cert->privatekey.reset();
-      break;
-    case leaf_cert_and_privkey_ok:
-      break;
-  }
-
-  cert->x509_method->cert_flush_cached_leaf(cert);
-
-  if (cert->chain != nullptr) {
-    CRYPTO_BUFFER_free(sk_CRYPTO_BUFFER_value(cert->chain.get(), 0));
-    sk_CRYPTO_BUFFER_set(cert->chain.get(), 0, buffer.release());
-    return true;
-  }
-
-  cert->chain.reset(sk_CRYPTO_BUFFER_new_null());
-  if (cert->chain == nullptr) {
-    return false;
-  }
-
-  if (!PushToStack(cert->chain.get(), std::move(buffer))) {
-    cert->chain.reset();
+  // Don't fail for a cert/key mismatch, just free the current private key.
+  // (When switching to a different keypair, the caller should switch the
+  // certificate, then the key.)
+  if (!cert->default_credential->SetLeafCert(
+          std::move(buffer), /*discard_key_on_mismatch=*/true)) {
     return false;
   }
 
+  cert->x509_method->cert_flush_cached_leaf(cert);
   return true;
 }
 
-bool ssl_has_certificate(const SSL_HANDSHAKE *hs) {
-  return hs->config->cert->chain != nullptr &&
-         sk_CRYPTO_BUFFER_value(hs->config->cert->chain.get(), 0) != nullptr &&
-         ssl_has_private_key(hs);
-}
-
 bool ssl_parse_cert_chain(uint8_t *out_alert,
                           UniquePtr<STACK_OF(CRYPTO_BUFFER)> *out_chain,
                           UniquePtr<EVP_PKEY> *out_pubkey,
@@ -405,33 +282,6 @@ bool ssl_parse_cert_chain(uint8_t *out_alert,
   return true;
 }
 
-bool ssl_add_cert_chain(SSL_HANDSHAKE *hs, CBB *cbb) {
-  if (!ssl_has_certificate(hs)) {
-    return CBB_add_u24(cbb, 0);
-  }
-
-  CBB certs;
-  if (!CBB_add_u24_length_prefixed(cbb, &certs)) {
-    OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
-    return false;
-  }
-
-  STACK_OF(CRYPTO_BUFFER) *chain = hs->config->cert->chain.get();
-  for (size_t i = 0; i < sk_CRYPTO_BUFFER_num(chain); i++) {
-    CRYPTO_BUFFER *buffer = sk_CRYPTO_BUFFER_value(chain, i);
-    CBB child;
-    if (!CBB_add_u24_length_prefixed(&certs, &child) ||
-        !CBB_add_bytes(&child, CRYPTO_BUFFER_data(buffer),
-                       CRYPTO_BUFFER_len(buffer)) ||
-        !CBB_flush(&certs)) {
-      OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
-      return false;
-    }
-  }
-
-  return CBB_flush(cbb);
-}
-
 // ssl_cert_skip_to_spki parses a DER-encoded, X.509 certificate from |in| and
 // positions |*out_tbs_cert| to cover the TBSCertificate, starting at the
 // subjectPublicKeyInfo.
@@ -513,30 +363,6 @@ bool ssl_compare_public_and_private_key(const EVP_PKEY *pubkey,
   return false;
 }
 
-bool ssl_cert_check_private_key(const CERT *cert, const EVP_PKEY *privkey) {
-  if (privkey == nullptr) {
-    OPENSSL_PUT_ERROR(SSL, SSL_R_NO_PRIVATE_KEY_ASSIGNED);
-    return false;
-  }
-
-  if (cert->chain == nullptr ||
-      sk_CRYPTO_BUFFER_value(cert->chain.get(), 0) == nullptr) {
-    OPENSSL_PUT_ERROR(SSL, SSL_R_NO_CERTIFICATE_ASSIGNED);
-    return false;
-  }
-
-  CBS cert_cbs;
-  CRYPTO_BUFFER_init_CBS(sk_CRYPTO_BUFFER_value(cert->chain.get(), 0),
-                         &cert_cbs);
-  UniquePtr<EVP_PKEY> pubkey = ssl_cert_parse_pubkey(&cert_cbs);
-  if (!pubkey) {
-    OPENSSL_PUT_ERROR(X509, X509_R_UNKNOWN_KEY_TYPE);
-    return false;
-  }
-
-  return ssl_compare_public_and_private_key(pubkey.get(), privkey);
-}
-
 bool ssl_cert_check_key_usage(const CBS *in, enum ssl_key_usage_t bit) {
   CBS buf = *in;
 
@@ -697,8 +523,12 @@ bool ssl_check_leaf_certificate(SSL_HANDSHAKE *hs, EVP_PKEY *pkey,
                                 const CRYPTO_BUFFER *leaf) {
   assert(ssl_protocol_version(hs->ssl) < TLS1_3_VERSION);
 
-  // Check the certificate's type matches the cipher.
-  if (!(hs->new_cipher->algorithm_auth & ssl_cipher_auth_mask_for_key(pkey))) {
+  // Check the certificate's type matches the cipher. This does not check key
+  // usage restrictions, which are handled separately.
+  //
+  // TODO(davidben): Put the key type and key usage checks in one place.
+  if (!(hs->new_cipher->algorithm_auth &
+        ssl_cipher_auth_mask_for_key(pkey, /*sign_ok=*/true))) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_CERTIFICATE_TYPE);
     return false;
   }
@@ -719,153 +549,6 @@ bool ssl_check_leaf_certificate(SSL_HANDSHAKE *hs, EVP_PKEY *pkey,
   return true;
 }
 
-bool ssl_on_certificate_selected(SSL_HANDSHAKE *hs) {
-  SSL *const ssl = hs->ssl;
-  if (!ssl_has_certificate(hs)) {
-    // Nothing to do.
-    return true;
-  }
-
-  if (!ssl->ctx->x509_method->ssl_auto_chain_if_needed(hs)) {
-    return false;
-  }
-
-  CBS leaf;
-  CRYPTO_BUFFER_init_CBS(
-      sk_CRYPTO_BUFFER_value(hs->config->cert->chain.get(), 0), &leaf);
-
-  if (ssl_signing_with_dc(hs)) {
-    hs->local_pubkey = UpRef(hs->config->cert->dc->pkey);
-  } else {
-    hs->local_pubkey = ssl_cert_parse_pubkey(&leaf);
-  }
-  return hs->local_pubkey != NULL;
-}
-
-
-// Delegated credentials.
-
-DC::DC() = default;
-DC::~DC() = default;
-
-UniquePtr<DC> DC::Dup() {
-  bssl::UniquePtr<DC> ret = MakeUnique<DC>();
-  if (!ret) {
-    return nullptr;
-  }
-
-  ret->raw = UpRef(raw);
-  ret->expected_cert_verify_algorithm = expected_cert_verify_algorithm;
-  ret->pkey = UpRef(pkey);
-  return ret;
-}
-
-// static
-UniquePtr<DC> DC::Parse(CRYPTO_BUFFER *in, uint8_t *out_alert) {
-  UniquePtr<DC> dc = MakeUnique<DC>();
-  if (!dc) {
-    *out_alert = SSL_AD_INTERNAL_ERROR;
-    return nullptr;
-  }
-
-  dc->raw = UpRef(in);
-
-  CBS pubkey, deleg, sig;
-  uint32_t valid_time;
-  uint16_t algorithm;
-  CRYPTO_BUFFER_init_CBS(dc->raw.get(), &deleg);
-  if (!CBS_get_u32(&deleg, &valid_time) ||
-      !CBS_get_u16(&deleg, &dc->expected_cert_verify_algorithm) ||
-      !CBS_get_u24_length_prefixed(&deleg, &pubkey) ||
-      !CBS_get_u16(&deleg, &algorithm) ||
-      !CBS_get_u16_length_prefixed(&deleg, &sig) ||
-      CBS_len(&deleg) != 0) {
-    OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
-    *out_alert = SSL_AD_DECODE_ERROR;
-    return nullptr;
-  }
-
-  dc->pkey.reset(EVP_parse_public_key(&pubkey));
-  if (dc->pkey == nullptr) {
-    OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
-    *out_alert = SSL_AD_DECODE_ERROR;
-    return nullptr;
-  }
-
-  return dc;
-}
-
-// ssl_can_serve_dc returns true if the host has configured a DC that it can
-// serve in the handshake. Specifically, it checks that a DC has been
-// configured and that the DC signature algorithm is supported by the peer.
-static bool ssl_can_serve_dc(const SSL_HANDSHAKE *hs) {
-  // Check that a DC has been configured.
-  const CERT *cert = hs->config->cert.get();
-  if (cert->dc == nullptr ||
-      cert->dc->raw == nullptr ||
-      (cert->dc_privatekey == nullptr && cert->dc_key_method == nullptr)) {
-    return false;
-  }
-
-  // Check that 1.3 or higher has been negotiated.
-  const DC *dc = cert->dc.get();
-  assert(hs->ssl->s3->have_version);
-  if (ssl_protocol_version(hs->ssl) < TLS1_3_VERSION) {
-    return false;
-  }
-
-  // Check that the DC signature algorithm is supported by the peer.
-  Span<const uint16_t> peer_sigalgs = hs->peer_delegated_credential_sigalgs;
-  for (uint16_t peer_sigalg : peer_sigalgs) {
-    if (dc->expected_cert_verify_algorithm == peer_sigalg) {
-      return true;
-    }
-  }
-  return false;
-}
-
-bool ssl_signing_with_dc(const SSL_HANDSHAKE *hs) {
-  // As of draft-ietf-tls-subcert-03, only the server may use delegated
-  // credentials to authenticate itself.
-  return hs->ssl->server &&
-         hs->delegated_credential_requested &&
-         ssl_can_serve_dc(hs);
-}
-
-static int cert_set_dc(CERT *cert, CRYPTO_BUFFER *const raw, EVP_PKEY *privkey,
-                       const SSL_PRIVATE_KEY_METHOD *key_method) {
-  if (privkey == nullptr && key_method == nullptr) {
-    OPENSSL_PUT_ERROR(SSL, ERR_R_PASSED_NULL_PARAMETER);
-    return 0;
-  }
-
-  if (privkey != nullptr && key_method != nullptr) {
-    OPENSSL_PUT_ERROR(SSL, SSL_R_CANNOT_HAVE_BOTH_PRIVKEY_AND_METHOD);
-    return 0;
-  }
-
-  uint8_t alert;
-  UniquePtr<DC> dc = DC::Parse(raw, &alert);
-  if (dc == nullptr) {
-    OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_DELEGATED_CREDENTIAL);
-    return 0;
-  }
-
-  if (privkey) {
-    // Check that the public and private keys match.
-    if (!ssl_compare_public_and_private_key(dc->pkey.get(), privkey)) {
-      OPENSSL_PUT_ERROR(SSL, SSL_R_CERTIFICATE_AND_PRIVATE_KEY_MISMATCH);
-      return 0;
-    }
-  }
-
-  cert->dc = std::move(dc);
-  cert->dc_privatekey = UpRef(privkey);
-  cert->dc_key_method = key_method;
-
-  return 1;
-}
-
 BSSL_NAMESPACE_END
 
 using namespace bssl;
@@ -887,15 +570,26 @@ int SSL_CTX_set_chain_and_key(SSL_CTX *ctx, CRYPTO_BUFFER *const *certs,
                                 privkey_method);
 }
 
+void SSL_certs_clear(SSL *ssl) {
+  if (!ssl->config) {
+    return;
+  }
+
+  CERT *cert = ssl->config->cert.get();
+  cert->x509_method->cert_clear(cert);
+  cert->credentials.clear();
+  cert->default_credential->ClearCertAndKey();
+}
+
 const STACK_OF(CRYPTO_BUFFER) *SSL_CTX_get0_chain(const SSL_CTX *ctx) {
-  return ctx->cert->chain.get();
+  return ctx->cert->default_credential->chain.get();
 }
 
 const STACK_OF(CRYPTO_BUFFER) *SSL_get0_chain(const SSL *ssl) {
   if (!ssl->config) {
     return nullptr;
   }
-  return ssl->config->cert->chain.get();
+  return ssl->config->cert->default_credential->chain.get();
 }
 
 int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, size_t der_len,
@@ -945,23 +639,11 @@ const STACK_OF(CRYPTO_BUFFER) *SSL_get0_server_requested_CAs(const SSL *ssl) {
   return ssl->s3->hs->ca_names.get();
 }
 
-static int set_signed_cert_timestamp_list(CERT *cert, const uint8_t *list,
-                                          size_t list_len) {
-  CBS sct_list;
-  CBS_init(&sct_list, list, list_len);
-  if (!ssl_is_sct_list_valid(&sct_list)) {
-    OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SCT_LIST);
-    return 0;
-  }
-
-  cert->signed_cert_timestamp_list.reset(
-      CRYPTO_BUFFER_new(CBS_data(&sct_list), CBS_len(&sct_list), nullptr));
-  return cert->signed_cert_timestamp_list != nullptr;
-}
-
 int SSL_CTX_set_signed_cert_timestamp_list(SSL_CTX *ctx, const uint8_t *list,
                                            size_t list_len) {
-  return set_signed_cert_timestamp_list(ctx->cert.get(), list, list_len);
+  UniquePtr<CRYPTO_BUFFER> buf(CRYPTO_BUFFER_new(list, list_len, nullptr));
+  return buf != nullptr && SSL_CREDENTIAL_set1_signed_cert_timestamp_list(
+                               ctx->cert->default_credential.get(), buf.get());
 }
 
 int SSL_set_signed_cert_timestamp_list(SSL *ssl, const uint8_t *list,
@@ -969,15 +651,18 @@ int SSL_set_signed_cert_timestamp_list(SSL *ssl, const uint8_t *list,
   if (!ssl->config) {
     return 0;
   }
-  return set_signed_cert_timestamp_list(ssl->config->cert.get(), list,
-                                        list_len);
+  UniquePtr<CRYPTO_BUFFER> buf(CRYPTO_BUFFER_new(list, list_len, nullptr));
+  return buf != nullptr &&
+         SSL_CREDENTIAL_set1_signed_cert_timestamp_list(
+             ssl->config->cert->default_credential.get(), buf.get());
 }
 
 int SSL_CTX_set_ocsp_response(SSL_CTX *ctx, const uint8_t *response,
                               size_t response_len) {
-  ctx->cert->ocsp_response.reset(
+  UniquePtr<CRYPTO_BUFFER> buf(
       CRYPTO_BUFFER_new(response, response_len, nullptr));
-  return ctx->cert->ocsp_response != nullptr;
+  return buf != nullptr && SSL_CREDENTIAL_set1_ocsp_response(
+                               ctx->cert->default_credential.get(), buf.get());
 }
 
 int SSL_set_ocsp_response(SSL *ssl, const uint8_t *response,
@@ -985,9 +670,11 @@ int SSL_set_ocsp_response(SSL *ssl, const uint8_t *response,
   if (!ssl->config) {
     return 0;
   }
-  ssl->config->cert->ocsp_response.reset(
+  UniquePtr<CRYPTO_BUFFER> buf(
       CRYPTO_BUFFER_new(response, response_len, nullptr));
-  return ssl->config->cert->ocsp_response != nullptr;
+  return buf != nullptr &&
+         SSL_CREDENTIAL_set1_ocsp_response(
+             ssl->config->cert->default_credential.get(), buf.get());
 }
 
 void SSL_CTX_set0_client_CAs(SSL_CTX *ctx, STACK_OF(CRYPTO_BUFFER) *name_list) {
@@ -1002,16 +689,3 @@ void SSL_set0_client_CAs(SSL *ssl, STACK_OF(CRYPTO_BUFFER) *name_list) {
   ssl->ctx->x509_method->ssl_flush_cached_client_CA(ssl->config.get());
   ssl->config->client_CA.reset(name_list);
 }
-
-int SSL_set1_delegated_credential(SSL *ssl, CRYPTO_BUFFER *dc, EVP_PKEY *pkey,
-                                  const SSL_PRIVATE_KEY_METHOD *key_method) {
-  if (!ssl->config) {
-    return 0;
-  }
-
-  return cert_set_dc(ssl->config->cert.get(), dc, pkey, key_method);
-}
-
-int SSL_delegated_credential_used(const SSL *ssl) {
-  return ssl->s3->delegated_credential_used;
-}