diff --git a/x509/ldapcrl_checkserial.sh b/x509/ldapcrl_checkserial.sh
new file mode 100755
index 0000000000000000000000000000000000000000..4d886657dc643e9f2a5e0b0fc115fc4c92debddc
--- /dev/null
+++ b/x509/ldapcrl_checkserial.sh
@@ -0,0 +1,239 @@
+#!/bin/bash
+#
+# ldapcrl_checkserial.sh
+#
+# Copyright (C) 2013, PrimeKey Solutions AB
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see .
+#
+
+program="ldapcrl_checkserial.sh"
+version="0.1"
+
+function usage() {
+ cat <.
+EOF
+}
+
+function version() {
+ cat <. |
++-----------------------------------------------------------------------+
+
+EOF
+}
+
+# If no arguments were given, just show usage help.
+if [[ -z $1 ]]; then
+ usage
+ exit 0
+fi
+
+# Set-up default parameters
+ldapOptions=()
+crlAttribute="certificateRevocationList"
+
+# Parse the arguments
+while getopts "L:a:vh" opt; do
+ case "$opt" in
+ L) ldapOptions+=("$OPTARG");;
+ a) crlAttribute="$OPTARG";;
+ v) version
+ exit 0;;
+ h) usage
+ exit 0;;
+ *) usage
+ exit 1;;
+ esac
+done
+i=$OPTIND
+shift $(($i-1))
+
+# Read the positional arguments.
+issuer="$1"
+serial="$2"
+
+# Verify the arguments.
+if [[ -z $issuer ]]; then
+ echo "Issuer was not specified." >&2
+ exit 3
+fi
+if [[ -z $serial ]]; then
+ echo "Serial number was not specified." >&2
+ exit 3
+fi
+if [[ ! $serial =~ ^[0123456789abcdefABCDEF]+$ ]]; then
+ echo "Invalid serial number specified: '$serial'" >&2
+ echo "Serial number may contain the following characters: 0123456789abcdefABCDEF" >&2
+ exit 3
+fi
+
+# Start assembling the ldapsearch command. Remove the cruft from output
+# (comments etc), and also disable wrapping of long line.x
+command=("ldapsearch" "-LLL" "-oldif-wrap=no")
+# Pass the user-provided options.
+command+=("${ldapOptions[@]}")
+# Look only for entities that have the request CRL attribute, and return only
+# that attribute.
+command+=("(${crlAttribute}=*)")
+command+=("${crlAttribute}")
+
+# Perform the ldap search. Store the result. Bail-out if an error has happened.
+if ! searchResult=$("${command[@]}"); then
+ echo "Failed to perform ldapsearch with the provided options." >&2
+ exit 10
+fi
+
+# Keep track of how many CRLs from the issuer have been processed, how many of
+# those did contain (matched) the serial number, and how many of those did _not_
+# contain the serial number (non-matches).
+processed=0
+matches=0
+nonMatches=0
+
+# Output a useful begin message.
+echo "CRL Issuer: $issuer"
+echo "Serial number: $serial"
+echo
+
+# Parse the LDAP search result.
+while read line; do
+ # Have we encountered the DN attribute?
+ if [[ $line =~ ^dn: ]]; then
+ dn="${line#*: }"
+ # Have we encountered the CRL?
+ elif [[ $line =~ ^$crlAttribute ]]; then
+ crl="${line#*:: }"
+ # If we have reached a blank line, that means we can process our DN and CRL now.
+ elif [[ $line =~ ^$ && dn != "" && crl != "" ]]; then
+ # Get the CRL issuer from the list.
+ crlIssuer=$(echo $crl | base64 --decode | openssl crl -noout -inform DER -issuer | sed -e 's#^issuer=/##;s#/#,#g')
+
+ # If the CRL was issued by requested issuer, process it.
+ if [[ $crlIssuer == $issuer ]]; then
+ echo "Located CRL for issuer under DN '$dn'."
+ let processed++
+
+ # Check if the requested serial number is present in the CRL.
+ if echo "$crl" | base64 --decode| openssl crl -inform DER -noout -text | grep 'Serial Number' \
+ | sed -e 's/[[:blank:]]*Serial Number: //' | grep -q -i "^${serial}$"; then
+ echo "Serial number present."
+ let matches++
+ else
+ echo "Serial number not present."
+ let nonMatches++
+ fi
+ fi
+
+ # Reset the parameters used for parsing.
+ unset dn crl
+ fi
+done < <(echo -e "${searchResult}\n")
+echo
+echo "Total number of CRLs with designated issuer in LDAP: $processed"
+echo "Number of CRLs that did contain the serial number: $matches"
+echo "Number of CRLs that did not contain the serial number: $nonMatches"
+echo
+if [[ $processed == 0 ]]; then
+ echo "No CRL was found in LDAP directory with the specified issuer DN."
+ exit 11
+elif [[ $matches != $processed ]]; then
+ echo "Not all CRLs have passed the test."
+ exit 12
+else
+ echo "All CRLs have passed the test."
+ exit 0
+fi
+