release/src/router/openvpn/contrib/OCSP_check/OCSP_check.sh

   1 #!/bin/sh
   2
   3 # Sample script to perform OCSP queries with OpenSSL
   4 # given a certificate serial number.
   5
   6 # If you run your own CA, you can set up a very simple
   7 # OCSP server using the -port option to "openssl ocsp".
   8
   9 # Full documentation and examples:
  10 # http://www.openssl.org/docs/apps/ocsp.html
  11
  12
  13 # Edit the following values to suit your needs
  14
  15 # OCSP responder URL (mandatory)
  16 # YOU MUST UNCOMMENT ONE OF THESE AND SET IT TO A VALID SERVER
  17 #ocsp_url="http://ocsp.example.com/"
  18 #ocsp_url="https://ocsp.secure.example.com/"
  19
  20 # Path to issuer certificate (mandatory)
  21 # YOU MUST SET THIS TO THE PATH TO THE CA CERTIFICATE
  22 issuer="/path/to/CAcert.crt"
  23
  24 # use a nonce in the query, set to "-no_nonce" to not use it
  25 nonce="-nonce"
  26
  27 # Verify the response
  28 # YOU MUST SET THIS TO THE PATH TO THE RESPONSE VERIFICATION CERT
  29 verify="/path/to/CAcert.crt"
  30
  31 # Depth in the certificate chain where the cert to verify is.
  32 # Set to -1 to run the verification at every level (NOTE that
  33 # in that case you need a more complex script as the various
  34 # parameters for the query will likely be different at each level)
  35 # "0" is the usual value here, where the client certificate is
  36 check_depth=0
  37
  38 cur_depth=$1     # this is the *CURRENT* depth
  39 common_name=$2   # CN in case you need it
  40
  41 # minimal sanity checks
  42
  43 err=0
  44 if [ -z "$issuer" ] || [ ! -e "$issuer" ]; then
  45   echo "Error: issuer certificate undefined or not found!" >&2
  46   err=1
  47 fi
  48
  49 if [ -z "$verify" ] || [ ! -e "$verify" ]; then
  50   echo "Error: verification certificate undefined or not found!" >&2
  51   err=1
  52 fi
  53
  54 if [ -z "$ocsp_url" ]; then
  55   echo "Error: OCSP server URL not defined!" >&2
  56   err=1
  57 fi
  58
  59 if [ $err -eq 1 ]; then
  60   echo "Did you forget to customize the variables in the script?" >&2
  61   exit 1
  62 fi
  63
  64 # begin
  65 if [ $check_depth -eq -1 ] || [ $cur_depth -eq $check_depth ]; then
  66
  67   eval serial="\$tls_serial_${cur_depth}"
  68
  69   # To successfully complete, the following must happen:
  70   #
  71   # - The serial number must not be empty
  72   # - The exit status of "openssl ocsp" must be zero
  73   # - The output of the above command must contain the line
  74   #   "${serial}: good"
  75   #
  76   # Everything else fails with exit status 1.
  77
  78   if [ -n "$serial" ]; then
  79
  80     # This is only an example; you are encouraged to run this command (without
  81     # redirections) manually against your or your CA's OCSP server to see how
  82     # it responds, and adapt accordingly.
  83     # Sample output that is assumed here:
  84     #
  85     # Response verify OK
  86     # 4287405: good
  87     #      This Update: Apr 24 19:38:49 2010 GMT
  88     #      Next Update: May  2 14:23:42 2010 GMT
  89     #
  90     # NOTE: It is needed to check the exit code of OpenSSL explicitly.  OpenSSL
  91     #       can in some circumstances give a "good" result if it could not
  92     #       reach the the OSCP server.  In this case, the exit code will indicate
  93     #       if OpenSSL itself failed or not.  If OpenSSL's exit code is not 0,
  94     #       don't trust the OpenSSL status.
  95
  96     status=$(openssl ocsp -issuer "$issuer" \
  97                     "$nonce" \
  98                     -CAfile "$verify" \
  99                     -url "$ocsp_url" \
 100                     -serial "${serial}" 2>&1)
 101
 102     if [ $? -eq 0 ]; then
 103       # check if ocsp didn't report any errors
 104       if echo "$status" | grep -Eq "(error|fail)"; then
 105           exit 1
 106       fi
 107       # check that the reported status of certificate is ok
 108       if echo "$status" | grep -Fq "^${serial}: good"; then
 109         # check if signature on the OCSP response verified correctly
 110         if echo "$status" | grep -Fq "^Response verify OK"; then
 111             exit 0
 112         fi
 113       fi
 114     fi
 115   fi
 116   # if we get here, something was wrong
 117   exit 1
 118 fi