user-tools/ocspverify

   1 #!/bin/bash
   2
   3 usagedie()
   4 {
   5         echo "Usage: $0 [-v] server [port]" >&2
   6         exit 1
   7 }
   8
   9 capath=/etc/ssl/certs
  10 issuer=
  11 issuer_keyid=
  12 verbose=
  13
  14 n=0
  15 ANSI_NONE=$'\033[0m'
  16 for color in black red green yellow blue magenta cyan white
  17 do
  18         color=${color^^}
  19         eval "ANSI_$color=\$'\033[0;3${n}m'"
  20         eval "ANSI_BOLD_$color=\$'\033[1;3${n}m'"
  21         eval "ANSI_BG_$color=\$'\033[4${n}m'"
  22         let n++
  23 done
  24
  25
  26 set -e
  27
  28 while [ -n "$1" ]
  29 do
  30         case "$1" in
  31         -v|--verbose) verbose=1;;
  32         -h|--help)      usagedie;;
  33         -*)     false;;
  34         --)     shift; break;;
  35         *)      break;;
  36         esac
  37         shift
  38 done
  39
  40 if [ -z "$1" ]
  41 then
  42         usagedie
  43 fi
  44
  45 server=$1
  46 [ -n "$2" ] && port=$2 || port=https
  47 address=$server:$port
  48
  49
  50
  51 cert=`tempfile`
  52 issuer_file=`tempfile`
  53 tmp=`tempfile`
  54 trap "rm '$cert' '$issuer_file' '$tmp'" EXIT
  55
  56 echo "${ANSI_BOLD_YELLOW}${ANSI_BG_BLUE}Certificate${ANSI_NONE}"
  57 openssl s_client -CApath "$capath" -connect "$address" -servername "$server" -showcerts </dev/null \
  58         2> >(perl -ne '
  59                 if(($a,$b,$c,$d) = /^(verify )(return:(\d+)|error:)(.*)$/s)
  60                 {
  61                         if($b =~ /^error/)
  62                         {
  63                                 print "'"${ANSI_BOLD_RED}"'$a$b'"${ANSI_RED}"'";
  64                         }
  65                         elsif($c eq 1)
  66                         {
  67                                 print "'"${ANSI_BOLD_GREEN}"'$a$b";
  68                         }
  69                         else
  70                         {
  71                                 print "'"${ANSI_BOLD_YELLOW}"'$a$b";
  72                         }
  73                         print "$d'"${ANSI_NONE}"'";
  74                 }
  75                 else
  76                 {
  77                         print;
  78                 }
  79         ') \
  80         1> >(sed -n '/-----BEGIN/,/-----END/p' >"$cert")
  81 if [ "$verbose" = 1 ]
  82 then
  83         openssl x509 -noout -serial -issuer -fingerprint -sha1 -text -in "$cert"
  84 fi
  85
  86 ocsp_url=`openssl x509 -noout -ocsp_uri -in "$cert"`
  87 startdate=`openssl x509 -noout -startdate -in "$cert"`
  88 enddate=`openssl x509 -noout -enddate -in "$cert"`
  89 fingerprint=`openssl x509 -noout -fingerprint -in "$cert"`
  90 san=`openssl x509 -noout -text -in "$cert" | grep "X509v3 Subject Alternative Name" -A1 | tail -n 1 | sed -e 's/\bDNS://g'`
  91
  92 echo "${ANSI_BOLD_BLUE}${startdate%%=*}: ${ANSI_BOLD_CYAN}${startdate#*=}${ANSI_NONE}"
  93 echo "${ANSI_BOLD_BLUE}${enddate%%=*}: ${ANSI_BOLD_CYAN}${enddate#*=}${ANSI_NONE}"
  94 echo "${ANSI_BOLD_BLUE}${fingerprint%%=*}: ${ANSI_BOLD_CYAN}${fingerprint#*=}${ANSI_NONE}"
  95 echo "${ANSI_BOLD_BLUE}SAN:${ANSI_BOLD_CYAN}" $san "${ANSI_NONE}"
  96
  97
  98 if [ -n "$ocsp_url" ]
  99 then
 100         echo "${ANSI_BOLD_BLUE}OCSP URL: ${ANSI_BOLD_CYAN}$ocsp_url${ANSI_NONE}"
 101
 102         info=`openssl x509 -noout -text -in "$cert"`
 103         issuer_cert_url=`echo "$info" | grep -m1 "CA Issuers - URI" | cut -d: -f2-`
 104         if [ -n "$issuer_cert_url" ]
 105         then
 106                 wget -q "$issuer_cert_url" -O "$issuer_file"
 107                 if [ "$(file -b "$issuer_file")" != "PEM certificate" ]
 108                 then
 109                         cat "$issuer_file" > "$tmp"
 110                         openssl x509 -inform der -in "$tmp" -out "$issuer_file"
 111                 fi
 112                 issuer=$issuer_file
 113         else
 114                 issuer_keyid=`echo "$info" | grep -m1 -A1 "X509v3 Authority Key Identifier:" | grep "keyid:" | cut -d: -f2-`
 115         fi
 116
 117
 118         if [ -z "$issuer" ]
 119         then
 120                 if [ -z "$issuer_keyid" ]
 121                 then
 122                         echo "${ANSI_BOLD_YELLOW}Authority Key Identifier not found.${ANSI_NONE}" >&2
 123                         exit 1
 124                 fi
 125
 126                 for file in "$capath"/*
 127                 do
 128                         keyid=`openssl x509 -noout -text -in "$file" | grep -A1 "X509v3 Subject Key Identifier:" | tail -n1 | tr -d "   "`
 129                         if [ "$keyid" = "$issuer_keyid" ]
 130                         then
 131                                 file=`readlink -m -n "$file"`
 132                                 echo "${ANSI_BOLD_BLUE}Issuer file: ${ANSI_BOLD_CYAN}$file${ANSI_NONE}"
 133                                 issuer=$file
 134                                 break
 135                         fi
 136                 done
 137         fi
 138
 139         if [ -z "$issuer" ]
 140         then
 141                 echo "${ANSI_BOLD_YELLOW}Authority certificate ${ANSI_YELLOW}($issuer_keyid)${ANSI_BOLD_YELLOW} not found.${ANSI_NONE}" >&2
 142                 exit 1
 143         fi
 144
 145         export cert
 146         lnbuf=/usr/lib/yazzy-preload/lnbuf.so
 147         [ -e "$lnbuf" ] || lnbuf=
 148         LD_PRELOAD=$lnbuf openssl ocsp -issuer "$issuer" -cert "$cert" -url "$ocsp_url" ${verbose:+-text} 2>&1 |\
 149                 perl -ne '
 150                         $|++;
 151                         if(($a,$b) = /^(\Q$ENV{cert}\E:|Response verify) (.*)$/is)
 152                         {
 153                                 if($b =~ /^(good|OK)/)
 154                                 {
 155                                         print "'"${ANSI_BOLD_GREEN}"'";
 156                                 }
 157                                 else
 158                                 {
 159                                         print "'"${ANSI_BOLD_RED}"'";
 160                                 }
 161                                 print "$_'"${ANSI_NONE}"'";
 162                         }
 163                         elsif(/:error:/)
 164                         {
 165                                 print "'"${ANSI_RED}"'$_'"${ANSI_NONE}"'";
 166                         }
 167                         else
 168                         {
 169                                 print;
 170                         }
 171                 '
 172 else
 173         echo "${ANSI_BOLD_YELLOW}No OCSP URL found in certificate.${ANSI_NONE}" >&2
 174         exit 1
 175 fi