74 lines
1.3 KiB
Plaintext
74 lines
1.3 KiB
Plaintext
|
#!/bin/sh
|
||
|
|
# SPDX-License-Identifier: Apache-2.0
|
||
|
|
# (c) 2024, Konstantin Demin
|
||
|
|
|
||
|
|
set -ef
|
||
|
|
|
||
|
|
usage() {
|
||
|
|
cat >&2 <<-EOF
|
||
|
|
# usage: ${0##*/} <in:issuer.pem> <in:cert.pem> <out:ocsp.der>
|
||
|
|
EOF
|
||
|
|
exit "${1:-0}"
|
||
|
|
}
|
||
|
|
[ $# != 0 ] || usage
|
||
|
|
|
||
|
|
arg_ok=
|
||
|
|
while : ; do
|
||
|
|
[ -n "$1" ] || break
|
||
|
|
[ -s "$1" ] || break
|
||
|
|
[ -n "$2" ] || break
|
||
|
|
[ -s "$2" ] || break
|
||
|
|
[ -n "$3" ] || break
|
||
|
|
arg_ok=1
|
||
|
|
break ; done
|
||
|
|
[ -n "${arg_ok}" ] || usage 1
|
||
|
|
unset arg_ok
|
||
|
|
|
||
|
|
chain="$1"
|
||
|
|
cert="$2"
|
||
|
|
ocsp="$3"
|
||
|
|
|
||
|
|
ocsp_uri=$(openssl x509 -in "${cert}" -noout -ocsp_uri | head -n 1)
|
||
|
|
[ -n "${ocsp_uri}" ] || exit 0
|
||
|
|
|
||
|
|
umask 0077
|
||
|
|
t=$(mktemp) ; : "${t:?}"
|
||
|
|
umask 0022
|
||
|
|
|
||
|
|
ossl_ocsp_fetch() {
|
||
|
|
openssl ocsp \
|
||
|
|
-timeout 5 -nonce \
|
||
|
|
-issuer "$1" -cert "$2" -url "$3" -respout "$4"
|
||
|
|
}
|
||
|
|
|
||
|
|
ossl_ocsp_read() {
|
||
|
|
openssl ocsp \
|
||
|
|
-issuer "$1" -cert "$2" -respin "$3" -resp_text
|
||
|
|
}
|
||
|
|
|
||
|
|
for i in $(seq 1 3) ; do
|
||
|
|
if ossl_ocsp_fetch "${chain}" "${cert}" "${ocsp_uri}" "$t" ; then
|
||
|
|
break
|
||
|
|
fi
|
||
|
|
: > "$t"
|
||
|
|
sleep 5
|
||
|
|
done ; unset i
|
||
|
|
|
||
|
|
if ! [ -s "$t" ] ; then
|
||
|
|
env printf '%s: unable to fetch OCSP response for %q via %q\n' "${0##*/}" "${cert}" "${ocsp_uri}" >&2
|
||
|
|
fi
|
||
|
|
|
||
|
|
resp_ok=
|
||
|
|
while : ; do
|
||
|
|
[ -s "$t" ] || break
|
||
|
|
ossl_ocsp_read "${chain}" "${cert}" "$t" >/dev/null || break
|
||
|
|
touch "${ocsp}" || break
|
||
|
|
tee "${ocsp}" < "$t" >/dev/null || break
|
||
|
|
chmod 0644 "${ocsp}" || :
|
||
|
|
resp_ok=1
|
||
|
|
break ; done
|
||
|
|
|
||
|
|
rm -rf "$t"
|
||
|
|
[ -n "${resp_ok}" ] || exit 1
|
||
|
|
exit 0
|