OpenSSL scan directory for expired OCSP

check_for_expired_ocsp.sh

#!/usr/bin/env bash

set -eo pipefail

if [ -z "$1" ]
then
  echo "You need to supply the path to a certificate-directory to scan"
  exit 1
fi

set -u

CHECK_DIR="$1"
OCSP_FILE_EXT='.pem.ocsp'
MAX_AGE_DAYS=5
MAX_AGE_SEC="$(( MAX_AGE_DAYS * 24 * 3600 ))"
NOW="$(date +"%s")"

if ! [ -d "$CHECK_DIR" ]
then
  echo "Directory '${CHECK_DIR}' does not exist!"
  exit 1
fi

for file in "$CHECK_DIR"/*
do
  if [[ "$file" == *"$OCSP_FILE_EXT" ]]
  then
    ocsp_update_time_str="$(openssl ocsp -respin "$file" -text -noverify | grep 'This Update' | cut -d ':' -f2-)"
    ocsp_update_time="$(date -d "$ocsp_update_time_str" +"%s")"
    ocsp_expire_time="$(( ocsp_update_time + MAX_AGE_SEC ))"
    if (( ocsp_expire_time < NOW ))
    then
      ocsp_expired_since="$(( (NOW - ocsp_expire_time) / 3600 ))"
      echo "EXPIRED: ${file} (since ${ocsp_expired_since}h)"
    fi
  fi
done

Basically - extract the This Update time and convert it to a unix timestamp:
date -d "$(openssl ocsp -respin "${ocsp_file}" -text -noverify | grep "This Update" | cut -d ':' -f2-)" +"%s"