wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
openssl/test/recipes/80-test_ocsp.t

220 lines
8.3 KiB
Perl
Raw Normal View History

Unified copyright for test recipes Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-04-22 11:21:51 +00:00
#! /usr/bin/env perl
# Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
#
Following the license change, modify the boilerplates in test/ Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7767)
2018-12-06 12:05:25 +00:00
# Licensed under the Apache License 2.0 (the "License"). You may not use
Unified copyright for test recipes Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-04-22 11:21:51 +00:00
# this file except in compliance with the License. You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
use strict;
use warnings;
use POSIX;
use File::Spec::Functions qw/devnull catfile/;
use File::Copy;
Add OCSP API test executable Some of the OCSP APIs (such as the recently added OCSP_resp_get0_signer) do not really merit inclusion in the ocsp(1) utility, but we should still have unit tests for them. For now, only test OCSP_resp_get0_signer(), but it should be easy to add more tests in the future. Provide an X509 cert and private key in the test's data directory to use for signing responses, since constructing those on the fly is more effort than is needed. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4573)
2017-10-19 19:44:10 +00:00
use OpenSSL::Test qw/:DEFAULT with pipe srctop_dir data_file/;
Fix no-ocsp Misc fixes for no-ocsp Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-21 16:54:53 +00:00
use OpenSSL::Test::Utils;
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
setup("test_ocsp");
Fix no-ocsp Misc fixes for no-ocsp Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-21 16:54:53 +00:00
plan skip_all => "OCSP is not supported by this OpenSSL build"
if disabled("ocsp");
unified build scheme: adjust test framework for out of source build tree To be able to run tests when we've built in a directory other than the source tree, the testing framework needs a few adjustments. test/testlib/OpenSSL/Test.pm needs to know where it can find shlib_wrap.sh, and a number of other tests need to be told a different place to find engines than what they may be able to figure out on their own. Relying to $TOP is not enough, $SRCTOP and $BLDTOP can be used as an alternative. As part of this change, top_file and top_dir are removed and srctop_file, bldtop_file, srctop_dir and bldtop_dir take their place. Reviewed-by: Ben Laurie <ben@openssl.org>
2016-01-30 00:05:33 +00:00
my $ocspdir=srctop_dir("test", "ocsp-tests");
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
# 17 December 2012 so we don't get certificate expiry errors.
my @check_time=("-attime", "1355875200");
sub test_ocsp {
my $title = shift;
my $inputfile = shift;
my $CAfile = shift;
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
my $untrusted = shift;
if ($untrusted eq "") {
$untrusted = $CAfile;
}
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
my $expected_exit = shift;
Pipes on VMS do not work well with binary data, use an intermediary file VMS being a record oriented operating system, it's uncertain how the 'pipe' passes binary data from one process to another. Experience shows that we get in trouble, and it's probably due to the pipe in itself being opened in text mode (variable length records). It's safer to pass data via an intermediary file instead. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-13 16:27:06 +00:00
run(app(["openssl", "base64", "-d",
"-in", catfile($ocspdir,$inputfile),
"-out", "ocsp-resp-fff.dat"]));
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
with({ exit_checker => sub { return shift == $expected_exit; } },
Pipes on VMS do not work well with binary data, use an intermediary file VMS being a record oriented operating system, it's uncertain how the 'pipe' passes binary data from one process to another. Experience shows that we get in trouble, and it's probably due to the pipe in itself being opened in text mode (variable length records). It's safer to pass data via an intermediary file instead. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-13 16:27:06 +00:00
sub { ok(run(app(["openssl", "ocsp", "-respin", "ocsp-resp-fff.dat",
"-partial_chain", @check_time,
"-CAfile", catfile($ocspdir, $CAfile),
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"-verify_other", catfile($ocspdir, $untrusted),
Pipes on VMS do not work well with binary data, use an intermediary file VMS being a record oriented operating system, it's uncertain how the 'pipe' passes binary data from one process to another. Experience shows that we get in trouble, and it's probably due to the pipe in itself being opened in text mode (variable length records). It's safer to pass data via an intermediary file instead. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-13 16:27:06 +00:00
"-no-CApath"])),
$title); });
unlink "ocsp-resp-fff.dat";
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
}
Add OCSP API test executable Some of the OCSP APIs (such as the recently added OCSP_resp_get0_signer) do not really merit inclusion in the ocsp(1) utility, but we should still have unit tests for them. For now, only test OCSP_resp_get0_signer(), but it should be easy to add more tests in the future. Provide an X509 cert and private key in the test's data directory to use for signing responses, since constructing those on the fly is more effort than is needed. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4573)
2017-10-19 19:44:10 +00:00
plan tests => 11;
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
subtest "=== VALID OCSP RESPONSES ===" => sub {
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
plan tests => 7;
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"ND1.ors", "ND1_Issuer_ICA.pem", "", 0);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"ND2.ors", "ND2_Issuer_Root.pem", "", 0);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("NON-DELEGATED; Root CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"ND3.ors", "ND3_Issuer_Root.pem", "", 0);
test_ocsp("NON-DELEGATED; 3-level CA hierarchy",
"ND1.ors", "ND1_Cross_Root.pem", "ND1_Issuer_ICA-Cross.pem", 0);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("DELEGATED; Intermediate CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"D1.ors", "D1_Issuer_ICA.pem", "", 0);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("DELEGATED; Root CA -> Intermediate CA",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"D2.ors", "D2_Issuer_Root.pem", "", 0);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("DELEGATED; Root CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"D3.ors", "D3_Issuer_Root.pem", "", 0);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
};
subtest "=== INVALID SIGNATURE on the OCSP RESPONSE ===" => sub {
plan tests => 6;
test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"ISOP_ND1.ors", "ND1_Issuer_ICA.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"ISOP_ND2.ors", "ND2_Issuer_Root.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("NON-DELEGATED; Root CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"ISOP_ND3.ors", "ND3_Issuer_Root.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("DELEGATED; Intermediate CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"ISOP_D1.ors", "D1_Issuer_ICA.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("DELEGATED; Root CA -> Intermediate CA",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"ISOP_D2.ors", "D2_Issuer_Root.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("DELEGATED; Root CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"ISOP_D3.ors", "D3_Issuer_Root.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
};
subtest "=== WRONG RESPONDERID in the OCSP RESPONSE ===" => sub {
plan tests => 6;
test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"WRID_ND1.ors", "ND1_Issuer_ICA.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"WRID_ND2.ors", "ND2_Issuer_Root.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("NON-DELEGATED; Root CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"WRID_ND3.ors", "ND3_Issuer_Root.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("DELEGATED; Intermediate CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"WRID_D1.ors", "D1_Issuer_ICA.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("DELEGATED; Root CA -> Intermediate CA",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"WRID_D2.ors", "D2_Issuer_Root.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("DELEGATED; Root CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"WRID_D3.ors", "D3_Issuer_Root.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
};
subtest "=== WRONG ISSUERNAMEHASH in the OCSP RESPONSE ===" => sub {
plan tests => 6;
test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"WINH_ND1.ors", "ND1_Issuer_ICA.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"WINH_ND2.ors", "ND2_Issuer_Root.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("NON-DELEGATED; Root CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"WINH_ND3.ors", "ND3_Issuer_Root.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("DELEGATED; Intermediate CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"WINH_D1.ors", "D1_Issuer_ICA.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("DELEGATED; Root CA -> Intermediate CA",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"WINH_D2.ors", "D2_Issuer_Root.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("DELEGATED; Root CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"WINH_D3.ors", "D3_Issuer_Root.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
};
subtest "=== WRONG ISSUERKEYHASH in the OCSP RESPONSE ===" => sub {
plan tests => 6;
test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"WIKH_ND1.ors", "ND1_Issuer_ICA.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"WIKH_ND2.ors", "ND2_Issuer_Root.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("NON-DELEGATED; Root CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"WIKH_ND3.ors", "ND3_Issuer_Root.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("DELEGATED; Intermediate CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"WIKH_D1.ors", "D1_Issuer_ICA.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("DELEGATED; Root CA -> Intermediate CA",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"WIKH_D2.ors", "D2_Issuer_Root.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("DELEGATED; Root CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"WIKH_D3.ors", "D3_Issuer_Root.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
};
subtest "=== WRONG KEY in the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub {
plan tests => 3;
test_ocsp("DELEGATED; Intermediate CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"WKDOSC_D1.ors", "D1_Issuer_ICA.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("DELEGATED; Root CA -> Intermediate CA",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"WKDOSC_D2.ors", "D2_Issuer_Root.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("DELEGATED; Root CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"WKDOSC_D3.ors", "D3_Issuer_Root.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
};
subtest "=== INVALID SIGNATURE on the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub {
plan tests => 3;
test_ocsp("DELEGATED; Intermediate CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"ISDOSC_D1.ors", "D1_Issuer_ICA.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("DELEGATED; Root CA -> Intermediate CA",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"ISDOSC_D2.ors", "D2_Issuer_Root.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("DELEGATED; Root CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"ISDOSC_D3.ors", "D3_Issuer_Root.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
};
subtest "=== WRONG SUBJECT NAME in the ISSUER CERTIFICATE ===" => sub {
plan tests => 6;
test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"ND1.ors", "WSNIC_ND1_Issuer_ICA.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"ND2.ors", "WSNIC_ND2_Issuer_Root.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("NON-DELEGATED; Root CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"ND3.ors", "WSNIC_ND3_Issuer_Root.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("DELEGATED; Intermediate CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"D1.ors", "WSNIC_D1_Issuer_ICA.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("DELEGATED; Root CA -> Intermediate CA",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"D2.ors", "WSNIC_D2_Issuer_Root.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("DELEGATED; Root CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"D3.ors", "WSNIC_D3_Issuer_Root.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
};
subtest "=== WRONG KEY in the ISSUER CERTIFICATE ===" => sub {
plan tests => 6;
test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"ND1.ors", "WKIC_ND1_Issuer_ICA.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"ND2.ors", "WKIC_ND2_Issuer_Root.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("NON-DELEGATED; Root CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"ND3.ors", "WKIC_ND3_Issuer_Root.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("DELEGATED; Intermediate CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"D1.ors", "WKIC_D1_Issuer_ICA.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("DELEGATED; Root CA -> Intermediate CA",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"D2.ors", "WKIC_D2_Issuer_Root.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("DELEGATED; Root CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"D3.ors", "WKIC_D3_Issuer_Root.pem", "", 1);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
};
subtest "=== INVALID SIGNATURE on the ISSUER CERTIFICATE ===" => sub {
plan tests => 6;
# Expect success, because we're explicitly trusting the issuer certificate.
test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"ND1.ors", "ISIC_ND1_Issuer_ICA.pem", "", 0);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"ND2.ors", "ISIC_ND2_Issuer_Root.pem", "", 0);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("NON-DELEGATED; Root CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"ND3.ors", "ISIC_ND3_Issuer_Root.pem", "", 0);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("DELEGATED; Intermediate CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"D1.ors", "ISIC_D1_Issuer_ICA.pem", "", 0);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("DELEGATED; Root CA -> Intermediate CA",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"D2.ors", "ISIC_D2_Issuer_Root.pem", "", 0);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
test_ocsp("DELEGATED; Root CA -> EE",
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL Now the certs arg is not any more neglected when building the signer cert chain. Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy. See also http://rt.openssl.org/Ticket/Display.html?id=4620 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4124)
2017-08-16 18:00:05 +00:00
"D3.ors", "ISIC_D3_Issuer_Root.pem", "", 0);
Add recipes for the larger protocols This covers the certificate authority commands, the cms and smime commands, OCSP, SSL and TSA. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-19 20:24:17 +00:00
};
Add OCSP API test executable Some of the OCSP APIs (such as the recently added OCSP_resp_get0_signer) do not really merit inclusion in the ocsp(1) utility, but we should still have unit tests for them. For now, only test OCSP_resp_get0_signer(), but it should be easy to add more tests in the future. Provide an X509 cert and private key in the test's data directory to use for signing responses, since constructing those on the fly is more effort than is needed. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4573)
2017-10-19 19:44:10 +00:00
subtest "=== OCSP API TESTS===" => sub {
plan tests => 1;
ok(run(test(["ocspapitest", data_file("cert.pem"), data_file("key.pem")])),
"running ocspapitest");
}
Reference in a new issue Copy permalink