fix

conf/ocsp-verify.sh

@@ -1,35 +1,25 @@
 #!/bin/bash
-# fonte: https://github.com/OpenVPN/openvpn/blob/master/contrib/OCSP_check/OCSP_check.sh
-
-ocsp_url="http://10.60.0.1:8888"
-issuer="/etc/openvpn/server/ca.crt"
-nonce="-no_nonce"
-verify="/etc/openvpn/server/ca.crt"
-check_depth=0
+# vagamente baseado nas fontes:
+# - https://github.com/OpenVPN/openvpn/blob/master/contrib/OCSP_check/OCSP_check.sh
 
 cur_depth=$1
-common_name=$2
 
-if [ -z "$issuer" ] || [ ! -e "$issuer" ] || [ -z "$verify" ] || [ ! -e "$verify" ] || [ -z "$ocsp_url" ]; then
-  exit 1
-fi
+if [ "$cur_depth" -eq 0 ]; then
+    eval serial="\$tls_serial_${cur_depth}"
 
-if [ $check_depth -eq -1 ] || [ $cur_depth -eq $check_depth ]; then
-  eval serial="\$tls_serial_${cur_depth}"
+    if [ -n "$serial" ]; then
+        hex_serial=$(printf '%x' "$serial")
+        status=$(openssl ocsp -issuer /etc/openvpn/server/ca.crt -no_nonce -CAfile /etc/openvpn/server/ca.crt -url http://10.60.0.1:8888 -serial "0x${hex_serial}" 2>&1)
 
-  if [ -n "$serial" ]; then
-    status=$(openssl ocsp -issuer "$issuer" "$nonce" -CAfile "$verify" -url "$ocsp_url" -serial "${serial}" 2>&1)
-
-    if [ $? -eq 0 ]; then
-      if echo "$status" | grep -Eq "(error|fail)"; then
-          exit 1
-      fi
-      
-      if echo "$status" | grep -Eq "^${serial}: good" && echo "$status" | grep -Eq "^Response verify OK"; then
-        exit 0
-      fi
+        if [ $? -eq 0 ]; then
+            if echo "$status" | grep -Eq "(error|fail|revoked)"; then
+                exit 1
+            fi
+            if echo "$status" | grep -Eq "good"; then
+                exit 0
+            fi
+        fi
     fi
-  fi
-  
-  exit 1
+    # se chegou aqui, falhou
+    exit 1
 fi