#3 OCSP 2: OpenSSL OCSP 校验
TLS TLSCert X.509 OpenSSL 2022-01-22上一篇：2021-08-08, OCSP 联机证书状态协议
OpenSSL 步骤
rm -rf /tmp/ocsptest/; mkdir -p /tmp/ocsptest/; cd /tmp/ocsptest/; ls
# 获取证书
openssl s_client -showcerts -connect markjour.com:443 < /dev/null | awk -v c=-1 '/-----BEGIN CERTIFICATE-----/{f=1;c++}f {print > ("l"c".crt")}/---END CERTIFICATE-----/{f=0}'
cat l*.crt > chain.crt
# 获取 OCSP URL
ocspUrl=$(openssl x509 -noout -text -in l0.crt | grep OCSP | xargs); ocspUrl=${ocspUrl#*URI:}; echo $ocspUrl;
# http://ocsp.digicert.com
# 获取证书序列号
serial=$(openssl x509 -serial -noout -in l0.crt); serial=${serial#*=}; echo $serial;
# 01F284D36E08179CF4CEB5D339FE95E9
# OCSP 校验
openssl ocsp -nonce -issuer l1.crt -CAfile chain.crt -url $ocspUrl -serial "0x${serial}"
# WARNING: no nonce in response
# Response verify OK
# 0x01F284D36E08179CF4CEB5D339FE95E9: good
# This Update: Jan 21 08:15:01 2022 GMT
# Next Update: Jan 28 07:30:01 2022 GMT
