Test OCSP server with OpenSSL

test_ocsp.sh

# We first download the certificate to check
openssl s_client -connect olivierlemoal.fr:443 2>&1 < /dev/null | sed -n '/-----BEGIN/,/-----END/p' > cert.pem
# We get the OCSP URI from the certificate
openssl x509 -in cert.pem -noout -ocsp_uri
# Get the Issuer URI :
openssl x509 -in cert.pem -noout -text | grep "CA Issuers"
# Download...
wget http://aia.startssl.com/certs/sub.class1.server.ca.crt
# Convert to PEM format from DER
openssl x509 -in sub.class1.server.ca.crt -inform DER -out sub.class1.server.ca.crt
# Get the CA Issuers URI until we got the root CA
openssl x509 -in sub.class1.server.ca.crt -noout -text | grep "CA Issuers"
# Download...
wget http://aia.startssl.com/certs/ca.crt
# Convert to PEM format from DER
openssl x509 -in ca.crt -inform DER -out ca.crt
# Chain the certificates
cat sub.class1.server.ca.crt ca.crt > issuer.pem

# Check OCSP
# More info on http://www.math.ucla.edu/~jimc/documents/bugfix/21-openssl-ocsp.html
# and https://raymii.org/s/articles/OpenSSL_Manually_Verify_a_certificate_against_an_OCSP.html
openssl ocsp -url http://ocsp.startssl.com/sub/class1/server/ca -header "HOST" "ocsp.startssl.com" -text -issuer issuer.pem -cert cert.pem -CAfile issuer.pem