#!/bin/bash
# fonte: https://github.com/OpenVPN/openvpn/blob/master/contrib/OCSP_check/OCSP_check.sh

ocsp_url="http://10.60.0.1:8888"
issuer="/etc/openvpn/server/ca.crt"
nonce="-no_nonce"
verify="/etc/openvpn/server/ca.crt"
check_depth=0

cur_depth=$1
common_name=$2

if [ -z "$issuer" ] || [ ! -e "$issuer" ] || [ -z "$verify" ] || [ ! -e "$verify" ] || [ -z "$ocsp_url" ]; then
  exit 1
fi

if [ $check_depth -eq -1 ] || [ $cur_depth -eq $check_depth ]; then
  eval serial="\$tls_serial_${cur_depth}"

  if [ -n "$serial" ]; then
    status=$(openssl ocsp -issuer "$issuer" "$nonce" -CAfile "$verify" -url "$ocsp_url" -serial "${serial}" 2>&1)

    if [ $? -eq 0 ]; then
      if echo "$status" | grep -Eq "(error|fail)"; then
          exit 1
      fi
      
      if echo "$status" | grep -Eq "^${serial}: good" && echo "$status" | grep -Eq "^Response verify OK"; then
        exit 0
      fi
    fi
  fi
  
  exit 1
fi