Certificate chain sorter

pkcs.sh

#!/bin/bash

if [ -z "$1" -o ! -f "$1" ]; then
    echo Usage: $0 pkcs-file-name
    exit 1
fi

openssl pkcs12 -in "$1" -nodes -out /dev/stdout |awk '/BEGIN/,/END/' | bash $(dirname $0)/sortchain.sh

sortchain.sh

#!/bin/bash

state=a
declare -A children
declare -A parents
declare -A certs
while read
do
    case $state in
        a)
            if [ "$REPLY" = "-----BEGIN CERTIFICATE-----" ]; then
                buf="${REPLY}\n"
                state=cert
            else
                echo $REPLY
                buf=""
            fi
            ;;
        cert)
            buf="${buf}${REPLY}\n"
            if [ "$REPLY" = "-----END CERTIFICATE-----" ]; then
                issuer=$(echo -e "$buf" | openssl x509 -out /dev/null -issuer_hash)
                subject=$(echo -e "$buf" | openssl x509 -out /dev/null -subject_hash)
                children["$issuer"]="$subject"
                parents["$subject"]="$issuer"
                certs["$subject"]="$buf"
                state=a
            fi
            ;;
    esac
done

for i in ${!certs[@]}; do
    if [ -z "${children["$i"]}" ]; then
        cert="$i"
    fi
done


while [ -n "${parents["$cert"]}" ]; do
    echo -ne "${certs["$cert"]}"
    if [ "$cert" = "${parents["$cert"]}" ]; then  #self-signed
        break
    fi
    cert="${parents["$cert"]}"
done