vasco/FSI
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix

Browse Source
This commit is contained in:
Vasco
2026-04-28 00:45:26 +01:00
parent 79d62754a3
commit 37bb4821e3
1 changed files with 17 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
conf/ocsp-verify.sh
View File

@@ -1,35 +1,25 @@
#!/bin/bash
# fonte: https://github.com/OpenVPN/openvpn/blob/master/contrib/OCSP_check/OCSP_check.sh
ocsp_url="http://10.60.0.1:8888"
issuer="/etc/openvpn/server/ca.crt"
nonce="-no_nonce"
verify="/etc/openvpn/server/ca.crt"
check_depth=0
# vagamente baseado nas fontes:
# - https://github.com/OpenVPN/openvpn/blob/master/contrib/OCSP_check/OCSP_check.sh
cur_depth=$1
common_name=$2
if [ -z "$issuer" ] || [ ! -e "$issuer" ] || [ -z "$verify" ] || [ ! -e "$verify" ] || [ -z "$ocsp_url" ]; then
exit 1
fi
if [ $check_depth -eq -1 ] || [ $cur_depth -eq $check_depth ]; then
if [ "$cur_depth" -eq 0 ]; then
eval serial="\$tls_serial_${cur_depth}"
if [ -n "$serial" ]; then
status=$(openssl ocsp -issuer "$issuer" "$nonce" -CAfile "$verify" -url "$ocsp_url" -serial "${serial}" 2>&1)
hex_serial=$(printf '%x' "$serial")
status=$(openssl ocsp -issuer /etc/openvpn/server/ca.crt -no_nonce -CAfile /etc/openvpn/server/ca.crt -url http://10.60.0.1:8888 -serial "0x${hex_serial}" 2>&1)
if [ $? -eq 0 ]; then
if echo "$status" | grep -Eq "(error|fail)"; then
if echo "$status" | grep -Eq "(error|fail|revoked)"; then
exit 1
fi
if echo "$status" | grep -Eq "^${serial}: good" && echo "$status" | grep -Eq "^Response verify OK"; then
if echo "$status" | grep -Eq "good"; then
exit 0
fi
fi
fi
# se chegou aqui, falhou
exit 1
fi