-
Notifications
You must be signed in to change notification settings - Fork 2
/
x509-revcheck
executable file
·83 lines (66 loc) · 1.6 KB
/
x509-revcheck
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
#!/usr/bin/zsh
# Adapted from
# http://serverfault.com/questions/590504/how-do-i-check-if-my-ssl-certificates-have-been-revoked
function main() {
typeset -r CERT_FILE="$1"
typeset -r SUBJECT_CN="$(get_cn "${CERT_FILE}")"
typeset -r OCSP_URI="$(get_ocsp_uri "${CERT_FILE}")"
typeset -r CA_CERT_URI="$(get_ca_uri "${CERT_FILE}")"
typeset -r CA_CERT_FILE="$(mktemp ${TMPDIR:-/tmp}/ca.crt.XXXXXXXX)"
curl -so "${CA_CERT_FILE}" "${CA_CERT_URI}" || errout
is_pem_cert "${CA_CERT_FILE}" || der_to_pem "${CA_CERT_FILE}"
openssl ocsp \
-issuer ${CA_CERT_FILE} \
-cert ${CERT_FILE} \
-url ${OCSP_URI} \
-header "HOST=${SUBJECT_CN}"
rm "${CA_CERT_FILE}"
}
function errout() {
echo "Something went wrong." >& 2
exit 1
}
function is_pem_cert() {
typeset -r CERT_HEADER='-----BEGIN CERTIFICATE-----'
[[ "${CERT_HEADER}" == "$(head -n 1 $1)" ]]
return $?
}
function der_to_pem() {
typeset -r TMP_OUT="$(mktemp ${TMPDIR:-/tmp}/crt.XXXXXXXX)"
openssl x509 \
-inform DER \
-in "$1" \
-outform PEM \
> $TMP_OUT
if [[ $? != 0 ]]; then
[[ -f "${TMP_OUT}" ]] && rm "${TMP_OUT}"
errout
fi
mv $TMP_OUT $1
}
function get_cn() {
openssl x509 \
-noout \
-subject \
-in "$1" \
| sed 's|^.*CN = ||' \
|| errout
}
function get_ocsp_uri() {
openssl x509 \
-noout \
-ocsp_uri \
-in "$1" \
|| errout
}
function get_ca_uri() {
openssl x509 \
-in "$1" \
-noout \
-text \
| grep 'CA Issuers' \
| sed 's|^ *CA Issuers - URI:||' \
|| errout
}
main "$@"
# vim: autoindent expandtab sts=2 ts=2 tw=2 colorcolumn=81