#!/bin/sh
# SPDX-License-Identifier: Apache-2.0
# (c) 2024, Konstantin Demin

set -ef

usage() {
	cat >&2 <<-EOF
	# usage: ${0##*/} <in:issuer.pem> <in:cert.pem> <out:ocsp.der>
	EOF
	exit "${1:-0}"
}
[ $# != 0 ] || usage

arg_ok=
while : ; do
	[ -n "$1" ] || break
	[ -s "$1" ] || break
	[ -n "$2" ] || break
	[ -s "$2" ] || break
	[ -n "$3" ] || break
	arg_ok=1
break ; done
[ -n "${arg_ok}" ] || usage 1
unset arg_ok

chain="$1"
cert="$2"
ocsp="$3"

ocsp_uri=$(openssl x509 -in "${cert}" -noout -ocsp_uri | head -n 1)
[ -n "${ocsp_uri}" ] || exit 0

umask 0077
t=$(mktemp) ; : "${t:?}"
umask 0022

ossl_ocsp_fetch() {
	openssl ocsp \
	  -timeout 5 -nonce \
	  -issuer "$1" -cert "$2" -url "$3" -respout "$4"
}

ossl_ocsp_read() {
	openssl ocsp \
	  -issuer "$1" -cert "$2" -respin "$3" -resp_text
}

for i in $(seq 1 3) ; do
	if ossl_ocsp_fetch "${chain}" "${cert}" "${ocsp_uri}" "$t" ; then
		break
	fi
	: > "$t"
	sleep 5
done ; unset i

if ! [ -s "$t" ] ; then
	env printf '%s: unable to fetch OCSP response for %q via %q\n' "${0##*/}" "${cert}" "${ocsp_uri}" >&2
fi

resp_ok=
while : ; do
	[ -s "$t" ] || break
	ossl_ocsp_read "${chain}" "${cert}" "$t" >/dev/null || break
	touch "${ocsp}" || break
	tee "${ocsp}" < "$t" >/dev/null || break
	chmod 0644 "${ocsp}" || :
	resp_ok=1
break ; done

rm -rf "$t"
[ -n "${resp_ok}" ] || exit 1
exit 0