35 lines
924 B
Bash
Executable File
35 lines
924 B
Bash
Executable File
#!/bin/bash
|
|
# fonte: https://github.com/OpenVPN/openvpn/blob/master/contrib/OCSP_check/OCSP_check.sh
|
|
|
|
ocsp_url="http://10.60.0.1:8888"
|
|
issuer="/etc/openvpn/server/ca.crt"
|
|
nonce="-no_nonce"
|
|
verify="/etc/openvpn/server/ca.crt"
|
|
check_depth=0
|
|
|
|
cur_depth=$1
|
|
common_name=$2
|
|
|
|
if [ -z "$issuer" ] || [ ! -e "$issuer" ] || [ -z "$verify" ] || [ ! -e "$verify" ] || [ -z "$ocsp_url" ]; then
|
|
exit 1
|
|
fi
|
|
|
|
if [ $check_depth -eq -1 ] || [ $cur_depth -eq $check_depth ]; then
|
|
eval serial="\$tls_serial_${cur_depth}"
|
|
|
|
if [ -n "$serial" ]; then
|
|
status=$(openssl ocsp -issuer "$issuer" "$nonce" -CAfile "$verify" -url "$ocsp_url" -serial "${serial}" 2>&1)
|
|
|
|
if [ $? -eq 0 ]; then
|
|
if echo "$status" | grep -Eq "(error|fail)"; then
|
|
exit 1
|
|
fi
|
|
|
|
if echo "$status" | grep -Eq "^${serial}: good" && echo "$status" | grep -Eq "^Response verify OK"; then
|
|
exit 0
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
exit 1
|
|
fi |