#!/bin/bash
# vagamente baseado nas fontes:
# - https://github.com/OpenVPN/openvpn/blob/master/contrib/OCSP_check/OCSP_check.sh

cur_depth=$1

if [ "$cur_depth" -eq 0 ]; then
    eval serial="\$tls_serial_${cur_depth}"

    if [ -n "$serial" ]; then
        hex_serial=$(printf '%x' "$serial")
        status=$(openssl ocsp -issuer /etc/openvpn/server/ca.crt -no_nonce -CAfile /etc/openvpn/server/ca.crt -url http://10.60.0.1:8888 -serial "0x${hex_serial}" 2>&1)

        if [ $? -eq 0 ]; then
            if echo "$status" | grep -Eq "(error|fail|revoked)"; then
                exit 1
            fi
            if echo "$status" | grep -Eq "good"; then
                exit 0
            fi
        fi
    fi
    # se chegou aqui, falhou
    exit 1
fi