// ocsprefreshMain is the main CLI of OCSP refresh functionality.
ocsprefreshMain is the main CLI of OCSP refresh functionality.
// ocsprefreshMain is the main CLI of OCSP refresh functionality .
func ocsprefreshMain(args []string, c cli.Config) error {
	if c.DBConfigFile == "" {
		return errors.New("need DB config file (provide with -db-config)")
	}
	if c.ResponderFile == "" {
		return errors.New("need responder certificate (provide with -responder)")
	}
	if c.ResponderKeyFile == "" {
		return errors.New("need responder key (provide with -responder-key)")
	}
	if c.CAFile == "" {
		return errors.New("need CA certificate (provide with -ca)")
	}
	s, err := SignerFromConfig(c)
	if err != nil {
		log.Critical("Unable to create OCSP signer: ", err)
		return err
	}
	db, err := dbconf.DBFromConfig(c.DBConfigFile)
	if err != nil {
		return err
	}
	dbAccessor := sql.NewAccessor(db)
	certs, err := dbAccessor.GetUnexpiredCertificates()
	if err != nil {
		return err
	}
	ocspExpiry := time.Now().Add(c.Interval)
	for _, certRecord := range certs {
		cert, err := helpers.ParseCertificatePEM([]byte(certRecord.PEM))
		if err != nil {
			log.Critical("Unable to parse certificate: ", err)
			return err
		}
		req := ocsp.SignRequest{
			Certificate: cert,
			Status:      certRecord.Status,
		}
		if certRecord.Status == "revoked" {
			req.Reason = int(certRecord.Reason)
			req.RevokedAt = certRecord.RevokedAt
		}
		resp, err := s.Sign(req)
		if err != nil {
			log.Critical("Unable to sign OCSP response: ", err)
			return err
		}
		err = dbAccessor.UpsertOCSP(cert.SerialNumber.String(), hex.EncodeToString(cert.AuthorityKeyId), string(resp), ocspExpiry)
		if err != nil {
			log.Critical("Unable to save OCSP response: ", err)
			return err
		}
	}
	return nil
}
func ocsprefreshMain ( args [ ] string , c cli . Config ) error { if c . DBConfigFile == " " { return errors . New ( " " ) } if c . ResponderFile == " " { return errors . New ( " " ) } if c . ResponderKeyFile == " " { return errors . New ( " " ) } if c . CAFile == " " { return errors . New ( " " ) } s , err := SignerFromConfig ( c ) if err != nil { log . Critical ( " " , err ) return err } db , err := dbconf . DBFromConfig ( c . DBConfigFile ) if err != nil { return err } dbAccessor := sql . NewAccessor ( db ) certs , err := dbAccessor . GetUnexpiredCertificates ( ) if err != nil { return err } ocspExpiry := time . Now ( ) . Add ( c . Interval ) for _ , certRecord := range certs { cert , err := helpers . ParseCertificatePEM ( [ ] byte ( certRecord . PEM ) ) if err != nil { log . Critical ( " " , err ) return err } req := ocsp . SignRequest { Certificate : cert , Status : certRecord . Status , } if certRecord . Status == " " { req . Reason = int ( certRecord . Reason ) req . RevokedAt = certRecord . RevokedAt } resp , err := s . Sign ( req ) if err != nil { log . Critical ( " " , err ) return err } err = dbAccessor . UpsertOCSP ( cert . SerialNumber . String ( ) , hex . EncodeToString ( cert . AuthorityKeyId ) , string ( resp ) , ocspExpiry ) if err != nil { log . Critical ( " " , err ) return err } } return nil }
ocsprefreshMain is the main CLI of OCSP refresh functionality.
ocsprefreshMain is the main CLI of OCSP refresh functionality .
// Set an expiry timestamp for all certificates refreshed in this batch