From 959d60789b6f0bd74296600f58f626cfa9738f78 Mon Sep 17 00:00:00 2001 From: Arne Schwabe Date: Fri, 28 Mar 2014 11:07:01 +0100 Subject: [PATCH] Fix man page and OSCP script: tls_serial_{n} is decimal Commit 7d5e26cbb53 fixed extracting serial but did not change the format, which always has been decimal. This patch fixes the manpage and OSCP.sh script to conform with the implementation. Acked-by: James Yonan Acked-by: Gert Doering Message-Id: <1396001222-5033-1-git-send-email-arne@rfc2549.org> URL: http://article.gmane.org/gmane.network.openvpn.devel/8409 Signed-off-by: Gert Doering --- contrib/OCSP_check/OCSP_check.sh | 2 +- doc/openvpn.8 | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/contrib/OCSP_check/OCSP_check.sh b/contrib/OCSP_check/OCSP_check.sh index 847be4501..7e9e1e89b 100644 --- a/contrib/OCSP_check/OCSP_check.sh +++ b/contrib/OCSP_check/OCSP_check.sh @@ -97,7 +97,7 @@ if [ $check_depth -eq -1 ] || [ $cur_depth -eq $check_depth ]; then "$nonce" \ -CAfile "$verify" \ -url "$ocsp_url" \ - -serial "0x${serial}" 2>/dev/null) + -serial "${serial}" 2>/dev/null) if [ $? -eq 0 ]; then # check that it's good diff --git a/doc/openvpn.8 b/doc/openvpn.8 index b7d6a3d72..ae3a4e0e2 100644 --- a/doc/openvpn.8 +++ b/doc/openvpn.8 @@ -6094,9 +6094,9 @@ where is the verification level. Only set for TLS connections. Set prior to execution of .B \-\-tls-verify -script. This is in the form of a hex string like "37AB46E0", which is -suitable for doing serial-based OCSP queries (with OpenSSL, you have -to prepend "0x" to the string). If something goes wrong while reading +script. This is in the form of a decimal string like "933971680", which is +suitable for doing serial-based OCSP queries (with OpenSSL, do not +prepend "0x" to the string) If something goes wrong while reading the value from the certificate it will be an empty string, so your code should check that. See the contrib/OCSP_check/OCSP_check.sh script for an example. -- 2.47.2