上一篇：2021-08-08, OCSP 联机证书状态协议

OpenSSL 步骤

rm -rf /tmp/ocsptest/; mkdir -p /tmp/ocsptest/; cd /tmp/ocsptest/; ls

# 获取证书
openssl s_client -showcerts -connect markjour.com:443 < /dev/null | awk -v c=-1 '/-----BEGIN CERTIFICATE-----/{f=1;c++}f {print > ("l"c".crt")}/---END CERTIFICATE-----/{f=0}'
cat l*.crt > chain.crt

# 获取 OCSP URL
ocspUrl=$(openssl x509 -noout -text -in l0.crt | grep OCSP | xargs); ocspUrl=${ocspUrl#*URI:}; echo $ocspUrl;
# http://ocsp.digicert.com

# 获取证书序列号
serial=$(openssl x509 -serial -noout -in l0.crt); serial=${serial#*=}; echo $serial;
# 01F284D36E08179CF4CEB5D339FE95E9

# OCSP 校验
openssl ocsp -nonce -issuer l1.crt -CAfile chain.crt -url $ocspUrl -serial "0x${serial}"
# WARNING: no nonce in response
# Response verify OK
# 0x01F284D36E08179CF4CEB5D339FE95E9: good
#   This Update: Jan 21 08:15:01 2022 GMT
#   Next Update: Jan 28 07:30:01 2022 GMT