3
# Sample script to perform OCSP queries with OpenSSL
4
# given a certificate serial number.
6
# If you run your own CA, you can set up a very simple
7
# OCSP server using the -port option to "openssl ocsp".
9
# Full documentation and examples:
10
# http://www.openssl.org/docs/apps/ocsp.html
13
# Edit the following values to suit your needs
15
# OCSP responder URL (mandatory)
16
# YOU MUST UNCOMMENT ONE OF THESE AND SET IT TO A VALID SERVER
17
#ocsp_url="http://ocsp.example.com/"
18
#ocsp_url="https://ocsp.secure.example.com/"
20
# Path to issuer certificate (mandatory)
21
# YOU MUST SET THIS TO THE PATH TO THE CA CERTIFICATE
22
issuer="/path/to/CAcert.crt"
24
# use a nonce in the query, set to "-no_nonce" to not use it
28
# YOU MUST SET THIS TO THE PATH TO THE RESPONSE VERIFICATION CERT
29
verify="/path/to/CAcert.crt"
31
# Depth in the certificate chain where the cert to verify is.
32
# Set to -1 to run the verification at every level (NOTE that
33
# in that case you need a more complex script as the various
34
# parameters for the query will likely be different at each level)
35
# "0" is the usual value here, where the client certificate is
38
cur_depth=$1 # this is the *CURRENT* depth
39
common_name=$2 # CN in case you need it
41
# minimal sanity checks
44
if [ -z "$issuer" ] || [ ! -e "$issuer" ]; then
45
echo "Error: issuer certificate undefined or not found!" >&2
49
if [ -z "$verify" ] || [ ! -e "$verify" ]; then
50
echo "Error: verification certificate undefined or not found!" >&2
54
if [ -z "$ocsp_url" ]; then
55
echo "Error: OCSP server URL not defined!" >&2
59
if [ $err -eq 1 ]; then
60
echo "Did you forget to customize the variables in the script?" >&2
65
if [ $check_depth -eq -1 ] || [ $cur_depth -eq $check_depth ]; then
67
eval serial="\$tls_serial_${cur_depth}"
69
# To successfully complete, the following must happen:
71
# - The serial number must not be empty
72
# - The exit status of "openssl ocsp" must be zero
73
# - The output of the above command must contain the line
76
# Everything else fails with exit status 1.
78
if [ -n "$serial" ]; then
80
# This is only an example; you are encouraged to run this command (without
81
# redirections) manually against your or your CA's OCSP server to see how
82
# it responds, and adapt accordingly.
83
# Sample output that is assumed here:
87
# This Update: Apr 24 19:38:49 2010 GMT
88
# Next Update: May 2 14:23:42 2010 GMT
90
# NOTE: It is needed to check the exit code of OpenSSL explicitly. OpenSSL
91
# can in some circumstances give a "good" result if it could not
92
# reach the the OSCP server. In this case, the exit code will indicate
93
# if OpenSSL itself failed or not. If OpenSSL's exit code is not 0,
94
# don't trust the OpenSSL status.
96
status=$(openssl ocsp -issuer "$issuer" \
100
-serial "0x${serial}" 2>/dev/null)
102
if [ $? -eq 0 ]; then
103
# check that it's good
104
if echo "$status" | grep -Fq "0x${serial}: good"; then
109
# if we get here, something was wrong
added
removed
contrib/OCSP_check/OCSP_check.sh
