Request and check OCSP response of queried domain name

ocsp-test.sh

#!/usr/bin/env bash

# Unofficial Bash strict mode
set \
  -o errexit \
  -o errtrace \
  -o noglob \
  -o nounset \
  -o pipefail
IFS=$'\n\t'
shopt -s inherit_errexit

set -o noclobber

# $1 - Domain name to check
main() {
  DOMAIN="${1}"
  shift

  # Get leaf certificate
  openssl s_client \
    -connect "${DOMAIN}:443" \
    -servername "${DOMAIN}" 2>&1 \
    </dev/null |
    sed -n '/-----BEGIN/,/-----END/p' >cert.pem

  # Get certificate chain
  # echo to prevent OpenSSL from waiting on input
  openssl s_client \
    -connect "${DOMAIN}:443" \
    -servername "${DOMAIN}" \
    -showcerts </dev/null 2>/dev/null |
    sed -n '/ 1 s:/,/-----END CERTIFICATE-----/p' |
    sed -n '/-----BEGIN CERTIFICATE-----/,//p' >chain.pem

  OCSP_ENDPOINT="$(openssl x509 -noout -ocsp_uri -in cert.pem)"

  # Request and verify the actual OCSP response
  openssl ocsp \
    -no_nonce \
    -url "${OCSP_ENDPOINT}" \
    -issuer chain.pem \
    -cert cert.pem \
    -verify_other chain.pem \
    -text \
    2>&-
}

trap "rm -f cert.pem chain.pem" EXIT

main "${@}"