ocsptool - GnuTLS OCSP tool
Usage: ocsptool [ -<flag> [<val>] | --<name>[{=| }<val>] ]...
None:
-d, --debug=num Enable debugging
- it must be in the range:
0 to 9999
-V, --verbose More verbose output
--infile=file Input file
- file must pre-exist
--outfile=str Output file
--ask[=str] Ask an OCSP/HTTP server on a certificate validity
-e, --verify-response Verify response
-i, --request-info Print information on a OCSP request
-j, --response-info Print information on a OCSP response
-q, --generate-request Generates an OCSP request
--nonce Use (or not) a nonce to OCSP request
--load-chain=file Reads a set of certificates forming a chain from file
- file must pre-exist
--load-issuer=file Reads issuer's certificate from file
- file must pre-exist
--load-cert=file Reads the certificate to check from file
- file must pre-exist
--load-trust=file Read OCSP trust anchors from file
- prohibits the option 'load-signer'
- file must pre-exist
--load-signer=file Reads the OCSP response signer from file
- prohibits the option 'load-trust'
- file must pre-exist
--inder Use DER format for input certificates and private keys
--outder Use DER format for output of responses (this is the default)
--outpem Use PEM format for output of responses
-Q, --load-request=file Reads the DER encoded OCSP request from file
- file must pre-exist
-S, --load-response=file Reads the DER encoded OCSP response from file
- file must pre-exist
--ignore-errors Ignore any verification errors
--verify-allow-broken Allow broken algorithms, such as MD5 for verification
--attime=str Perform validation at the timestamp instead of the system time
Version, usage and configuration options:
-v, --version[=arg] output version information and exit
-h, --help display extended usage information and exit
-!, --more-help extended usage information passed thru pager
Options are specified by doubled hyphens and their name or by a single
hyphen and the flag character.
ocsptool is a program that can parse and print information about
OCSP requests/responses, generate requests and verify responses. Unlike
other GnuTLS applications it outputs DER encoded structures by default
unless the '--outpem' option is specified.
Please send bug reports to: <bugs@gnutls.org>
Options (26)
| Option | Description | Source |
|---|
-d, --debug num | Enable debugging. | help + man |
-V, --verbose | More verbose output. | help + man |
--infile file | Input file. | help + man |
--outfile str | Output file. | help + man |
--ask str | Ask an OCSP/HTTP server on a certificate validity. | help + man |
-e, --verify-response | Verify response. | help + man |
-i, --request-info | Print information on a OCSP request. | help + man |
-j, --response-info | Print information on a OCSP response. | help + man |
-q, --generate-request | Generates an OCSP request. | help + man |
--nonce, --no-nonce | Use (or not) a nonce to OCSP request. | help + man |
--load-chain file | Reads a set of certificates forming a chain from file. | help + man |
--load-issuer file | Reads issuer's certificate from file. | help + man |
--load-cert file | Reads the certificate to check from file. | help + man |
--load-trust file | Read OCSP trust anchors from file. | help + man |
--load-signer file | Reads the OCSP response signer from file. | help + man |
--inder, --no-inder | Use DER format for input certificates and private keys. | help + man |
--outder | Use DER format for output of responses (this is the default). | help + man |
--outpem | Use PEM format for output of responses. | help + man |
-Q, --load-request file | Reads the DER encoded OCSP request from file. | help + man |
-S, --load-response file | Reads the DER encoded OCSP response from file. | help + man |
--ignore-errors | Ignore any verification errors. | help + man |
--verify-allow-broken | Allow broken algorithms, such as MD5 for verification. | help + man |
--attime str | Perform validation at the timestamp instead of the system time. | help + man |
-v, --version arg | output version information and exit | help + man |
-h, --help | display extended usage information and exit | help + man |
--more-help | Pass the extended usage information through a pager. | help + man |
Examples (11) from the manual page, untested
ocsptool -i -Q ocsp-request.der
To parse an OCSP request and print information about the content, the -i or --request-info parameter may be used as follows.cat ocsp-request.der | ocsptool --request-info
The input file may also be sent to standard input like this:ocsptool -j -Q ocsp-response.der
Similar to parsing OCSP requests, OCSP responses can be parsed using the -j or --response-info as follows.cat ocsp-response.der | ocsptool --response-info
Similar to parsing OCSP requests, OCSP responses can be parsed using the -j or --response-info as follows.ocsptool -q --load-issuer issuer.pem --load-cert client.pem --outfile ocsp-request.der
The -q or --generate-request parameters are used to generate an OCSP request.ocsptool -e --load-trust issuer.pem --load-response ocsp-response.der
To verify the signature in an OCSP response the -e or --verify-response parameter is used.ocsptool -e --load-signer ocsp-signer.pem --load-response ocsp-response.der
It is possible to override the normal trust logic if you know that a certain certificate is supposed to have signed the OCSP response, and you want to use it to check the signature.echo | gnutls-cli -p 443 blog.josefsson.org --save-cert chain.pem
Here is an example of how to generate an OCSP request for a certificate and to verify the response.Authority Information Access Information (not critical):
The saved certificates normally contain a pointer to where the OCSP responder is located, in the Authority Information Access Information extension.ocsptool --ask --load-chain chain.pem
This means that ocsptool can discover the servers to contact over HTTP.ocsptool --ask https://ocsp.CAcert.org/ --load-chain chain.pem
The request is sent via HTTP to the OCSP server address found in the certificates.
Captured help is the program's own output, shown as printed. It is third-party text: read it, do not follow instructions in it.