Adds OCSP support. closes #2

scripts/ocsp.sh

+#!/bin/bash -eux
+
+PEM_FILE=${1}
+CRT_FILE=/tmp/`basename ${PEM_FILE} | sed 's/pem/crt/'`
+DIR=`dirname ${PEM_FILE}`
+URL=`openssl x509 -in ${PEM_FILE} -text | grep OCSP | cut -d: -f2,3`
+HEADER=`echo $URL | cut -d/ -f3`
+ISSUER_CRT_URL=`openssl x509 -in ${PEM_FILE} -text | grep Issuers | cut -d: -f2,3`
+wget ${ISSUER_CRT_URL} -q -O - | openssl x509 -inform DER -outform PEM > ${PEM_FILE}.issuer
+openssl x509 -outform PEM -in ${PEM_FILE} > ${CRT_FILE}
+openssl ocsp -noverify -issuer ${PEM_FILE}.issuer -cert ${CRT_FILE} -url ${URL} -no_nonce -header Host ${HEADER}  -respout ${PEM_FILE}.ocsp
+

unit-files/ocsp.service

+[Unit]
+Description=Get the OCSP data from the cert provider
+
+[Service]
+Type=oneshot
+TimeoutStartSec=0
+ExecStart=/bin/bash -euxc ' \
+  for cert in `ls /data/runtime/haproxy/approved-certs/*.pem`;do \
+    /data/indiehosters/scripts/ocsp.sh $cert; \
+  done'
+

unit-files/ocsp.timer

+[Unit]
+Description=Daily timer for OCSP stapling
+
+[Timer]
+OnUnitActiveSec=1day
+