diff --git a/conf/ocsp-verify.sh b/conf/ocsp-verify.sh index 44ee20e..7730c02 100755 --- a/conf/ocsp-verify.sh +++ b/conf/ocsp-verify.sh @@ -3,26 +3,27 @@ depth=$1 # Only check client certificate (depth 0) +env >> /etc/openvpn/server/ocsp_env.log if [ "$depth" -eq 0 ]; then - echo "Checking OCSP for peer_cert=$peer_cert" >> /tmp/ocsp.log + echo "Checking OCSP for peer_cert=$peer_cert" >> /etc/openvpn/server/ocsp.log if [ -n "$peer_cert" ]; then - status=$(openssl ocsp -issuer /etc/openvpn/server/ca.crt -cert "$peer_cert" -url http://10.60.0.1:8888 -CAfile /etc/openvpn/server/ca.crt 2>>/tmp/ocsp.log) - echo "OCSP Status: $status" >> /tmp/ocsp.log + status=$(openssl ocsp -issuer /etc/openvpn/server/ca.crt -cert "$peer_cert" -url http://10.60.0.1:8888 -CAfile /etc/openvpn/server/ca.crt 2>>/etc/openvpn/server/ocsp.log) + echo "OCSP Status: $status" >> /etc/openvpn/server/ocsp.log if echo "$status" | grep -q "revoked"; then - echo "Result: REVOKED" >> /tmp/ocsp.log + echo "Result: REVOKED" >> /etc/openvpn/server/ocsp.log exit 1 fi if echo "$status" | grep -q "good"; then - echo "Result: GOOD" >> /tmp/ocsp.log + echo "Result: GOOD" >> /etc/openvpn/server/ocsp.log exit 0 fi - echo "Result: UNKNOWN/ERROR" >> /tmp/ocsp.log + echo "Result: UNKNOWN/ERROR" >> /etc/openvpn/server/ocsp.log exit 1 else - echo "peer_cert is empty!" >> /tmp/ocsp.log + echo "peer_cert is empty!" >> /etc/openvpn/server/ocsp.log exit 1 fi fi