[openssl] master update
tomas at openssl.org
tomas at openssl.org
Wed May 5 07:52:13 UTC 2021
The branch master has been updated
via 97b59744f2ad91adf606e6f77e355e97413e7b2c (commit)
via eca4826a2931d249a46ca0f7629b6a6ebcd77f07 (commit)
via c774f4e50fa0dad63b47d103f3113e9a7dfff63e (commit)
via 4f449d90ddf3f523c2fca7053e8437342738cef5 (commit)
from a485561b2efd17e3ff9a4df2013b636467dee59f (commit)
- Log -----------------------------------------------------------------
commit 97b59744f2ad91adf606e6f77e355e97413e7b2c
Author: Dr. David von Oheimb <David.von.Oheimb at siemens.com>
Date: Tue Mar 2 13:20:38 2021 +0100
cleanup where purpose is not needed in 25-test_verify.t
Reviewed-by: Viktor Dukhovni <viktor at openssl.org>
Reviewed-by: Tomas Mraz <tomas at openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14413)
commit eca4826a2931d249a46ca0f7629b6a6ebcd77f07
Author: Dr. David von Oheimb <David.von.Oheimb at siemens.com>
Date: Tue Mar 2 15:14:24 2021 +0100
test/certs/setup.sh: Fix two glitches
Reviewed-by: Viktor Dukhovni <viktor at openssl.org>
Reviewed-by: Tomas Mraz <tomas at openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14413)
commit c774f4e50fa0dad63b47d103f3113e9a7dfff63e
Author: Dr. David von Oheimb <David.von.Oheimb at siemens.com>
Date: Tue Mar 2 13:17:28 2021 +0100
update test/certs/ee-pathlen.pem to contain SKID and AKID
Reviewed-by: Viktor Dukhovni <viktor at openssl.org>
Reviewed-by: Tomas Mraz <tomas at openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14413)
commit 4f449d90ddf3f523c2fca7053e8437342738cef5
Author: Dr. David von Oheimb <David.von.Oheimb at siemens.com>
Date: Tue Mar 2 13:16:30 2021 +0100
test/certs/setup.sh: structural cleanup
Reviewed-by: Viktor Dukhovni <viktor at openssl.org>
Reviewed-by: Tomas Mraz <tomas at openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14413)
-----------------------------------------------------------------------
Summary of changes:
test/certs/cca-clientAuth.pem | 2 +-
test/certs/ee-pathlen.pem | 19 +++---
test/certs/nca+anyEKU.pem | 14 ++---
test/certs/setup.sh | 77 +++++++++++-------------
test/recipes/25-test_verify.t | 134 +++++++++++++++++++++---------------------
5 files changed, 119 insertions(+), 127 deletions(-)
diff --git a/test/certs/cca-clientAuth.pem b/test/certs/cca-clientAuth.pem
index 0f31101ff4..5e44dce787 100644
--- a/test/certs/cca-clientAuth.pem
+++ b/test/certs/cca-clientAuth.pem
@@ -15,5 +15,5 @@ YZYCppu6PTwp3UYgAFw6VN+2Hv6fWCwu2rsWLcqkJIJPkmjYATZJU2RkWrRpn23D
SWwnam7i+uiJpot8uKhOCIQtrCtP+0Q8lG+6reWHpaNRU3Gcsrc+I98wyWhsx5jd
fiLl1Cgb5G7Xz3Ff1ObdR6JdP4Wc9krj3Czbjv3oYFZ2p8LPgui+C7XDb4RBxGUu
c4mETHtGSRoX6n25uEXvIia2KCcS44VfA6wYaZtO/Lq7FmJI0QwI8tsm7FG6ccj+
-y54iNhHRG7FCAXOLy2RBrEwQddq5MAwwCgYIKwYBBQUHAwI=
+y54iNhHRG7FCAXOLy2RBrEwQddq5MAygCgYIKwYBBQUHAwI=
-----END TRUSTED CERTIFICATE-----
diff --git a/test/certs/ee-pathlen.pem b/test/certs/ee-pathlen.pem
index 0bcae1d7bd..b678a3a870 100644
--- a/test/certs/ee-pathlen.pem
+++ b/test/certs/ee-pathlen.pem
@@ -1,17 +1,18 @@
-----BEGIN CERTIFICATE-----
-MIICszCCAZugAwIBAgIBAjANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDDAJDQTAg
-Fw0yMDA0MDMwODA0MTVaGA8yMTIwMDQwNDA4MDQxNVowGTEXMBUGA1UEAwwOc2Vy
+MIIC8zCCAdugAwIBAgIBAjANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDDAJDQTAg
+Fw0yMTAzMDIxMTU3NDlaGA8yMTIxMDMwMzExNTc0OVowGTEXMBUGA1UEAwwOc2Vy
dmVyLmV4YW1wbGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCo/4lY
YYWu3tssD9Vz++K3qBt6dWAr1H08c3a1rt6TL38kkG3JHPSKOM2fooAWVsu0LLuT
5Rcf/w3GQ/4xNPgo2HXpo7uIgu+jcuJTYgVFTeAxl++qnRDSWA2eBp4yuxsIVl1l
Dz9mjsI2oBH/wFk1/Ukc3RxCMwZ4rgQ4I+XndWfTlK1aqUAfrFkQ9QzBZK1KxMY1
U7OWaoIbFYvRmavknm+UqtKW5Vf7jJFkijwkFsbSGb6CYBM7YrDtPh2zyvlr3zG5
ep5LR2inKcc/SuIiJ7TvkGPX79ByST5brbkb1Ctvhmjd1XMSuEPJ3EEPoqNGT4tn
-iIQPYf55NB9KiR+3AgMBAAGjEDAOMAwGA1UdEwQFMAMCAQAwDQYJKoZIhvcNAQEL
-BQADggEBAApOUnWWd09I0ts3xa1oK7eakc+fKTF4d7pbGznFNONaCR3KFRgnBVlG
-Bm8/oehrrQ28Ad3XPSug34DQQ5kM6JIuaddx50/n4Xkgj8/fgXVA0HXizOJ3QpKC
-IojLVajXlQHhpo72VUQuNOha0UxG9daYjS20iXRhanTm9rUz7qQZEugVQCiR0z/f
-9NgM7FU9UaSidzH3gZu/Ufc4Ggn6nZV7LM9sf4IUV+KszS1VpcK+9phAmsB6BaAi
-cFXvVXZjTNualQgPyPwOD8c+vVCIfIemfF5TZ6fyqpOjprWQAphwrTtfNDSmqRTz
-FRhDf+vJERQclgUtg37EgWGKtnNQeRY=
+iIQPYf55NB9KiR+3AgMBAAGjUDBOMAwGA1UdEwQFMAMCAQAwHQYDVR0OBBYEFOeb
+4iqtimw6y3ZR5Y4HmCKX4XOiMB8GA1UdIwQYMBaAFLQRM/HX4l73U54gIhBPhga/
+H8leMA0GCSqGSIb3DQEBCwUAA4IBAQB2B+oEG+TZGSG4A2MTYF/Oa3if1bQQeWm6
+ysqitpvrfcGsFGGy6bHJgS2NHcmNuCqN6YBDJEMKoLSz+t4GDkmMghQ1HUpXZPzt
+A+Wzg3MTKvWbXeCJroVK/pq4kXWMJ5GihzVsgWHBYFDmzzcnDf/R1Y0XKOAld/vP
+ePVTDh1mAyjXHdUPsPi35GUny38+PyPRoyCN2399D35CJAGqyNNvTtygoS3ncjbe
+URXjfoDLQh4+y17aOPm8SAZQ4h5zyi6ioRuq+je1Cd+y2erhRyFzlvXDRlUlP9XA
+r4OtgpusNyeuAWGRx168TD8aOt+dcc9JiDqTnLpBCwQYI0Q3LASO
-----END CERTIFICATE-----
diff --git a/test/certs/nca+anyEKU.pem b/test/certs/nca+anyEKU.pem
index b97a4559fa..3ebfede09c 100644
--- a/test/certs/nca+anyEKU.pem
+++ b/test/certs/nca+anyEKU.pem
@@ -1,6 +1,6 @@
-----BEGIN TRUSTED CERTIFICATE-----
MIIDDTCCAfWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQDDAdSb290
-IENBMCAXDTE2MDExNTA4MTk0OVoYDzIxMTYwMTE2MDgxOTQ5WjANMQswCQYDVQQD
+IENBMCAXDTIwMTIxMjIwMTcwNFoYDzIxMjAxMjEzMjAxNzA0WjANMQswCQYDVQQD
DAJDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJadpD0ASxxfxsvd
j9IxsogVzMSGLFziaYuE9KejU9+R479RifvwfBANO62sNWJ19X//9G5UjwWmkiOz
n1k50DkYsBBA3mJzik6wjt/c58lBIlSEgAgpvDU8ht8w3t20JP9+YqXAeugqFj/W
@@ -10,10 +10,10 @@ ZGh7r2dqWgZUD1Dh+bT2vjrUzj8eTH3GdzI+oljt29102JIUaqj3yzRYkah8FLF9
CLNNsUcCAwEAAaNxMG8wHQYDVR0OBBYEFLQRM/HX4l73U54gIhBPhga/H8leMB8G
A1UdIwQYMBaAFI71Ja8em2uEPXyAmslTnE1y96NSMAkGA1UdEwQCMAAwEwYDVR0l
BAwwCgYIKwYBBQUHAwEwDQYDVR0RBAYwBIICQ0EwDQYJKoZIhvcNAQELBQADggEB
-AL/aEy4Nk2W2UQNi/0h9MLkiq4J5IkjUocJp4grPUsdUJKu68GFYgWnJSBZjKMhs
-X390IUWrRJ8C7SJtyGOhbh2E6Zn7TveI77Mnw2CZpGhy+xieqTFmaIIWJgZVzaTT
-3hMhnXImn06k8eJiJiQQAHKr9XKDK9HIiESyBpujIW5hI7wrklkn0asl6DwiXcUw
-AuXqNffWpomWI4ZZceOJkr5dSFM9HyksQi4uzj0qYTDyDHJ6BLuGYWbUoB64pnKF
-wCn0cPOmbo866l0XqzJlxQYPvwOicAptX8jTjSpYsx5SLripS4KwyfxbGy5If8mT
-X4st+BN48+n9wHuDQJ97sBswDDAKBggrBgEFBQcDAQ==
+AGMZ+jXtPoEaGGj3vBOxw4Uf9h8G5PWIZOqV8EGdJkPVWSUJ7NM12vqTN8Lfv7UO
++gv1VJL02UO1UWrvDcid37XWBbVLwSjk963se+S8Xzd+I2FQY8+Yy4m5VN6m6Krc
+pZt64zsgYROre5yP3gWIvzNa8Ayk/1nmQX1ADAe2tQJeWHROFBim0K3FcjIrhqZ8
+3MUAVJ5Nt3THrVrt3ojIWBOatBJHv+Q2Ii52UZVKG5HMGogRuMjFQy/mwshcBQSz
+pxAWfqT2oVmP+K/iBGxikYjtrOOYNW8L8RwShU3j1dFulQZb2SLRRj8/eDBSV++6
+KsEzVayX0uF80Hohuxbq7OAwCDAGBgRVHSUA
-----END TRUSTED CERTIFICATE-----
diff --git a/test/certs/setup.sh b/test/certs/setup.sh
index 07b9007674..c4a6f28fc9 100755
--- a/test/certs/setup.sh
+++ b/test/certs/setup.sh
@@ -1,14 +1,13 @@
#! /bin/bash
# Primary root: root-cert
-# root cert variants: CA:false, key2, DN2
-# trust variants: +serverAuth -serverAuth +clientAuth -clientAuth +anyEKU -anyEKU
-#
./mkcert.sh genroot "Root CA" root-key root-cert
+# root cert variants: CA:false, key2, DN2, expired
./mkcert.sh genss "Root CA" root-key root-nonca
./mkcert.sh genroot "Root CA" root-key2 root-cert2
./mkcert.sh genroot "Root Cert 2" root-key root-name2
-#
+DAYS=-1 ./mkcert.sh genroot "Root CA" root-key root-expired
+# trust variants: +serverAuth -serverAuth +clientAuth -clientAuth,
openssl x509 -in root-cert.pem -trustout \
-addtrust serverAuth -out root+serverAuth.pem
openssl x509 -in root-cert.pem -trustout \
@@ -17,16 +16,19 @@ openssl x509 -in root-cert.pem -trustout \
-addtrust clientAuth -out root+clientAuth.pem
openssl x509 -in root-cert.pem -trustout \
-addreject clientAuth -out root-clientAuth.pem
-openssl x509 -in root-cert.pem -trustout \
- -addreject anyExtendedKeyUsage -out root-anyEKU.pem
+# trust variants: +anyEKU -anyEKU
openssl x509 -in root-cert.pem -trustout \
-addtrust anyExtendedKeyUsage -out root+anyEKU.pem
+openssl x509 -in root-cert.pem -trustout \
+ -addreject anyExtendedKeyUsage -out root-anyEKU.pem
+# root-cert2 trust variants: +serverAuth -serverAuth +clientAuth
openssl x509 -in root-cert2.pem -trustout \
-addtrust serverAuth -out root2+serverAuth.pem
openssl x509 -in root-cert2.pem -trustout \
-addreject serverAuth -out root2-serverAuth.pem
openssl x509 -in root-cert2.pem -trustout \
-addtrust clientAuth -out root2+clientAuth.pem
+# root-nonca trust variants: +serverAuth +anyEKU
openssl x509 -in root-nonca.pem -trustout \
-addtrust serverAuth -out nroot+serverAuth.pem
openssl x509 -in root-nonca.pem -trustout \
@@ -41,10 +43,8 @@ OPENSSL_KEYBITS=768 \
./mkcert.sh genroot "Root CA" root-key-768 root-cert-768
# primary client-EKU root: croot-cert
-# trust variants: +serverAuth -serverAuth +clientAuth +anyEKU -anyEKU
-#
./mkcert.sh genroot "Root CA" root-key croot-cert clientAuth
-#
+# trust variants: +serverAuth -serverAuth +clientAuth -clientAuth +anyEKU -anyEKU
openssl x509 -in croot-cert.pem -trustout \
-addtrust serverAuth -out croot+serverAuth.pem
openssl x509 -in croot-cert.pem -trustout \
@@ -53,16 +53,14 @@ openssl x509 -in croot-cert.pem -trustout \
-addtrust clientAuth -out croot+clientAuth.pem
openssl x509 -in croot-cert.pem -trustout \
-addreject clientAuth -out croot-clientAuth.pem
-openssl x509 -in croot-cert.pem -trustout \
- -addreject anyExtendedKeyUsage -out croot-anyEKU.pem
openssl x509 -in croot-cert.pem -trustout \
-addtrust anyExtendedKeyUsage -out croot+anyEKU.pem
+openssl x509 -in croot-cert.pem -trustout \
+ -addreject anyExtendedKeyUsage -out croot-anyEKU.pem
# primary server-EKU root: sroot-cert
-# trust variants: +serverAuth -serverAuth +clientAuth +anyEKU -anyEKU
-#
./mkcert.sh genroot "Root CA" root-key sroot-cert serverAuth
-#
+# trust variants: +serverAuth -serverAuth +clientAuth -clientAuth +anyEKU -anyEKU
openssl x509 -in sroot-cert.pem -trustout \
-addtrust serverAuth -out sroot+serverAuth.pem
openssl x509 -in sroot-cert.pem -trustout \
@@ -71,24 +69,21 @@ openssl x509 -in sroot-cert.pem -trustout \
-addtrust clientAuth -out sroot+clientAuth.pem
openssl x509 -in sroot-cert.pem -trustout \
-addreject clientAuth -out sroot-clientAuth.pem
-openssl x509 -in sroot-cert.pem -trustout \
- -addreject anyExtendedKeyUsage -out sroot-anyEKU.pem
openssl x509 -in sroot-cert.pem -trustout \
-addtrust anyExtendedKeyUsage -out sroot+anyEKU.pem
+openssl x509 -in sroot-cert.pem -trustout \
+ -addreject anyExtendedKeyUsage -out sroot-anyEKU.pem
# Primary intermediate ca: ca-cert
-# ca variants: CA:false, key2, DN2, issuer2, expired
-# trust variants: +serverAuth, -serverAuth, +clientAuth, -clientAuth, -anyEKU, +anyEKU
-#
./mkcert.sh genca "CA" ca-key ca-cert root-key root-cert
-DAYS=-1 ./mkcert.sh genroot "Root CA" root-key root-expired
+# ca variants: CA:false, key2, DN2, issuer2, expired
./mkcert.sh genee "CA" ca-key ca-nonca root-key root-cert
./mkcert.sh gen_nonbc_ca "CA" ca-key ca-nonbc root-key root-cert
./mkcert.sh genca "CA" ca-key2 ca-cert2 root-key root-cert
./mkcert.sh genca "CA2" ca-key ca-name2 root-key root-cert
./mkcert.sh genca "CA" ca-key ca-root2 root-key2 root-cert2
DAYS=-1 ./mkcert.sh genca "CA" ca-key ca-expired root-key root-cert
-#
+# trust variants: +serverAuth, -serverAuth, +clientAuth, -clientAuth
openssl x509 -in ca-cert.pem -trustout \
-addtrust serverAuth -out ca+serverAuth.pem
openssl x509 -in ca-cert.pem -trustout \
@@ -97,14 +92,16 @@ openssl x509 -in ca-cert.pem -trustout \
-addtrust clientAuth -out ca+clientAuth.pem
openssl x509 -in ca-cert.pem -trustout \
-addreject clientAuth -out ca-clientAuth.pem
-openssl x509 -in ca-cert.pem -trustout \
- -addreject anyExtendedKeyUsage -out ca-anyEKU.pem
+# trust variants: +anyEKU, -anyEKU
openssl x509 -in ca-cert.pem -trustout \
-addtrust anyExtendedKeyUsage -out ca+anyEKU.pem
+openssl x509 -in ca-cert.pem -trustout \
+ -addreject anyExtendedKeyUsage -out ca-anyEKU.pem
+# ca-nonca trust variants: +serverAuth, +anyEKU
openssl x509 -in ca-nonca.pem -trustout \
-addtrust serverAuth -out nca+serverAuth.pem
openssl x509 -in ca-nonca.pem -trustout \
- -addtrust serverAuth -out nca+anyEKU.pem
+ -addtrust anyExtendedKeyUsage -out nca+anyEKU.pem
# Intermediate CA security variants:
# MD5 issuer signature,
@@ -123,10 +120,8 @@ OPENSSL_KEYBITS=768 \
./mkcert.sh genca "CA" ca-key-ec-named ca-cert-ec-named root-key root-cert
# client intermediate ca: cca-cert
-# trust variants: +serverAuth, -serverAuth, +clientAuth, -clientAuth
-#
./mkcert.sh genca -p clientAuth "CA" ca-key cca-cert root-key root-cert
-#
+# trust variants: +serverAuth, -serverAuth, +clientAuth, -clientAuth, +anyEKU, -anyEKU
openssl x509 -in cca-cert.pem -trustout \
-addtrust serverAuth -out cca+serverAuth.pem
openssl x509 -in cca-cert.pem -trustout \
@@ -134,17 +129,15 @@ openssl x509 -in cca-cert.pem -trustout \
openssl x509 -in cca-cert.pem -trustout \
-addtrust clientAuth -out cca+clientAuth.pem
openssl x509 -in cca-cert.pem -trustout \
- -addtrust clientAuth -out cca-clientAuth.pem
-openssl x509 -in cca-cert.pem -trustout \
- -addreject anyExtendedKeyUsage -out cca-anyEKU.pem
+ -addreject clientAuth -out cca-clientAuth.pem
openssl x509 -in cca-cert.pem -trustout \
-addtrust anyExtendedKeyUsage -out cca+anyEKU.pem
+openssl x509 -in cca-cert.pem -trustout \
+ -addreject anyExtendedKeyUsage -out cca-anyEKU.pem
# server intermediate ca: sca-cert
-# trust variants: +serverAuth, -serverAuth, +clientAuth, -clientAuth, -anyEKU, +anyEKU
-#
./mkcert.sh genca -p serverAuth "CA" ca-key sca-cert root-key root-cert
-#
+# trust variants: +serverAuth, -serverAuth, +clientAuth, -clientAuth, +anyEKU, -anyEKU
openssl x509 -in sca-cert.pem -trustout \
-addtrust serverAuth -out sca+serverAuth.pem
openssl x509 -in sca-cert.pem -trustout \
@@ -153,24 +146,22 @@ openssl x509 -in sca-cert.pem -trustout \
-addtrust clientAuth -out sca+clientAuth.pem
openssl x509 -in sca-cert.pem -trustout \
-addreject clientAuth -out sca-clientAuth.pem
-openssl x509 -in sca-cert.pem -trustout \
- -addreject anyExtendedKeyUsage -out sca-anyEKU.pem
openssl x509 -in sca-cert.pem -trustout \
-addtrust anyExtendedKeyUsage -out sca+anyEKU.pem
+openssl x509 -in sca-cert.pem -trustout \
+ -addreject anyExtendedKeyUsage -out sca-anyEKU.pem
-# Primary leaf cert: ee-cert
-# ee variants: expired, issuer-key2, issuer-name2, bad-pathlen
-# trust variants: +serverAuth, -serverAuth, +clientAuth, -clientAuth
-# purpose variants: client
-#
+# Primary leaf cert: ee-cert with default purpose: serverAuth
./mkcert.sh genee server.example ee-key ee-cert ca-key ca-cert
+# ee variants: expired, issuer-key2, issuer-name2, bad-pathlen
./mkcert.sh genee server.example ee-key ee-expired ca-key ca-cert -days -1
./mkcert.sh genee server.example ee-key ee-cert2 ca-key2 ca-cert2
./mkcert.sh genee server.example ee-key ee-name2 ca-key ca-name2
-./mkcert.sh genee -p clientAuth server.example ee-key ee-client ca-key ca-cert
./mkcert.sh genee server.example ee-key ee-pathlen ca-key ca-cert \
- -extfile <(echo "basicConstraints=CA:FALSE,pathlen:0") # bash needed here
-#
+ -extfile <(echo "basicConstraints=CA:false,pathlen:0") # bash needed here
+# purpose variants: clientAuth
+./mkcert.sh genee -p clientAuth server.example ee-key ee-client ca-key ca-cert
+# trust variants: +serverAuth, -serverAuth, +clientAuth, -clientAuth
openssl x509 -in ee-cert.pem -trustout \
-addtrust serverAuth -out ee+serverAuth.pem
openssl x509 -in ee-cert.pem -trustout \
diff --git a/test/recipes/25-test_verify.t b/test/recipes/25-test_verify.t
index 4b0cb40729..03a5e1fbdd 100644
--- a/test/recipes/25-test_verify.t
+++ b/test/recipes/25-test_verify.t
@@ -18,9 +18,10 @@ setup("test_verify");
sub verify {
my ($cert, $purpose, $trusted, $untrusted, @opts) = @_;
- my @args = qw(openssl verify -auth_level 1 -purpose);
my @path = qw(test certs);
- push(@args, "$purpose", @opts);
+ my @args = qw(openssl verify -auth_level 1);
+ push(@args, "-purpose", $purpose) if $purpose ne "";
+ push(@args, @opts);
for (@$trusted) { push(@args, "-trusted", srctop_file(@path, "$_.pem")) }
for (@$untrusted) { push(@args, "-untrusted", srctop_file(@path, "$_.pem")) }
push(@args, srctop_file(@path, "$cert.pem"));
@@ -47,11 +48,11 @@ ok(!verify("ee-cert", "sslserver", [qw(root-name2)], [qw(ca-cert)]),
# Critical extensions
-ok(verify("ee-cert-noncrit-unknown-ext", "sslserver", [qw(root-cert)], [qw(ca-cert)]),
+ok(verify("ee-cert-noncrit-unknown-ext", "", ["root-cert"], ["ca-cert"]),
"accept non-critical unknown extension");
-ok(!verify("ee-cert-crit-unknown-ext", "sslserver", [qw(root-cert)], [qw(ca-cert)]),
+ok(!verify("ee-cert-crit-unknown-ext", "", ["root-cert"], ["ca-cert"]),
"reject critical unknown extension");
-ok(verify("ee-cert-ocsp-nocheck", "sslserver", [qw(root-cert)], [qw(ca-cert)]),
+ok(verify("ee-cert-ocsp-nocheck", "", ["root-cert"], ["ca-cert"]),
"accept critical OCSP No Check");
# Explicit trust/purpose combinations
@@ -263,47 +264,47 @@ ok(!verify("pc6-cert", "sslclient", [qw(root-cert)], [qw(pc1-cert ee-client ca-c
"failed proxy cert where last CN was added as a multivalue RDN component");
# Security level tests
-ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "2"),
+ok(verify("ee-cert", "", ["root-cert"], ["ca-cert"], "-auth_level", "2"),
"accept RSA 2048 chain at auth level 2");
-ok(!verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "3"),
+ok(!verify("ee-cert", "", ["root-cert"], ["ca-cert"], "-auth_level", "3"),
"reject RSA 2048 root at auth level 3");
-ok(verify("ee-cert", "sslserver", ["root-cert-768"], ["ca-cert-768i"], "-auth_level", "0"),
+ok(verify("ee-cert", "", ["root-cert-768"], ["ca-cert-768i"], "-auth_level", "0"),
"accept RSA 768 root at auth level 0");
-ok(!verify("ee-cert", "sslserver", ["root-cert-768"], ["ca-cert-768i"]),
+ok(!verify("ee-cert", "", ["root-cert-768"], ["ca-cert-768i"]),
"reject RSA 768 root at auth level 1");
-ok(verify("ee-cert-768i", "sslserver", ["root-cert"], ["ca-cert-768"], "-auth_level", "0"),
+ok(verify("ee-cert-768i", "", ["root-cert"], ["ca-cert-768"], "-auth_level", "0"),
"accept RSA 768 intermediate at auth level 0");
-ok(!verify("ee-cert-768i", "sslserver", ["root-cert"], ["ca-cert-768"]),
+ok(!verify("ee-cert-768i", "", ["root-cert"], ["ca-cert-768"]),
"reject RSA 768 intermediate at auth level 1");
-ok(verify("ee-cert-768", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "0"),
+ok(verify("ee-cert-768", "", ["root-cert"], ["ca-cert"], "-auth_level", "0"),
"accept RSA 768 leaf at auth level 0");
-ok(!verify("ee-cert-768", "sslserver", ["root-cert"], ["ca-cert"]),
+ok(!verify("ee-cert-768", "", ["root-cert"], ["ca-cert"]),
"reject RSA 768 leaf at auth level 1");
#
-ok(verify("ee-cert", "sslserver", ["root-cert-md5"], ["ca-cert"], "-auth_level", "2"),
+ok(verify("ee-cert", "", ["root-cert-md5"], ["ca-cert"], "-auth_level", "2"),
"accept md5 self-signed TA at auth level 2");
-ok(verify("ee-cert", "sslserver", ["ca-cert-md5-any"], [], "-auth_level", "2"),
+ok(verify("ee-cert", "", ["ca-cert-md5-any"], [], "-auth_level", "2"),
"accept md5 intermediate TA at auth level 2");
-ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert-md5"], "-auth_level", "0"),
+ok(verify("ee-cert", "", ["root-cert"], ["ca-cert-md5"], "-auth_level", "0"),
"accept md5 intermediate at auth level 0");
-ok(!verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert-md5"]),
+ok(!verify("ee-cert", "", ["root-cert"], ["ca-cert-md5"]),
"reject md5 intermediate at auth level 1");
-ok(verify("ee-cert-md5", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "0"),
+ok(verify("ee-cert-md5", "", ["root-cert"], ["ca-cert"], "-auth_level", "0"),
"accept md5 leaf at auth level 0");
-ok(!verify("ee-cert-md5", "sslserver", ["root-cert"], ["ca-cert"]),
+ok(!verify("ee-cert-md5", "", ["root-cert"], ["ca-cert"]),
"reject md5 leaf at auth level 1");
# Explicit vs named curve tests
SKIP: {
skip "EC is not supported by this OpenSSL build", 3
if disabled("ec");
- ok(!verify("ee-cert-ec-explicit", "sslserver", ["root-cert"],
+ ok(!verify("ee-cert-ec-explicit", "", ["root-cert"],
["ca-cert-ec-named"]),
"reject explicit curve leaf with named curve intermediate");
- ok(!verify("ee-cert-ec-named-explicit", "sslserver", ["root-cert"],
+ ok(!verify("ee-cert-ec-named-explicit", "", ["root-cert"],
["ca-cert-ec-explicit"]),
"reject named curve leaf with explicit curve intermediate");
- ok(verify("ee-cert-ec-named-named", "sslserver", ["root-cert"],
+ ok(verify("ee-cert-ec-named-named", "", ["root-cert"],
["ca-cert-ec-named"]),
"accept named curve leaf with named curve intermediate");
}
@@ -312,129 +313,128 @@ SKIP: {
# between the trust-anchor and the leaf, so, for example, with a root->ca->leaf
# chain, depth = 1 is sufficient, but depth == 0 is not.
#
-ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"], "-verify_depth", "2"),
+ok(verify("ee-cert", "", ["root-cert"], ["ca-cert"], "-verify_depth", "2"),
"accept chain with verify_depth 2");
-ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"], "-verify_depth", "1"),
+ok(verify("ee-cert", "", ["root-cert"], ["ca-cert"], "-verify_depth", "1"),
"accept chain with verify_depth 1");
-ok(!verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"], "-verify_depth", "0"),
- "accept chain with verify_depth 0");
-ok(verify("ee-cert", "sslserver", ["ca-cert-md5-any"], [], "-verify_depth", "0"),
+ok(!verify("ee-cert", "", ["root-cert"], ["ca-cert"], "-verify_depth", "0"),
+ "reject chain with verify_depth 0");
+ok(verify("ee-cert", "", ["ca-cert-md5-any"], [], "-verify_depth", "0"),
"accept md5 intermediate TA with verify_depth 0");
# Name Constraints tests.
-ok(verify("alt1-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
+ok(verify("alt1-cert", "", ["root-cert"], ["ncca1-cert"], ),
"Name Constraints everything permitted");
-ok(verify("alt2-cert", "sslserver", ["root-cert"], ["ncca2-cert"], ),
+ok(verify("alt2-cert", "", ["root-cert"], ["ncca2-cert"], ),
"Name Constraints nothing excluded");
-ok(verify("alt3-cert", "sslserver", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
+ok(verify("alt3-cert", "", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
"Name Constraints nested test all permitted");
-ok(verify("goodcn1-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
+ok(verify("goodcn1-cert", "", ["root-cert"], ["ncca1-cert"], ),
"Name Constraints CNs permitted");
-ok(!verify("badcn1-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
+ok(!verify("badcn1-cert", "", ["root-cert"], ["ncca1-cert"], ),
"Name Constraints CNs not permitted");
-ok(!verify("badalt1-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
+ok(!verify("badalt1-cert", "", ["root-cert"], ["ncca1-cert"], ),
"Name Constraints hostname not permitted");
-ok(!verify("badalt2-cert", "sslserver", ["root-cert"], ["ncca2-cert"], ),
+ok(!verify("badalt2-cert", "", ["root-cert"], ["ncca2-cert"], ),
"Name Constraints hostname excluded");
-ok(!verify("badalt3-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
+ok(!verify("badalt3-cert", "", ["root-cert"], ["ncca1-cert"], ),
"Name Constraints email address not permitted");
-ok(!verify("badalt4-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
+ok(!verify("badalt4-cert", "", ["root-cert"], ["ncca1-cert"], ),
"Name Constraints subject email address not permitted");
-ok(!verify("badalt5-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
+ok(!verify("badalt5-cert", "", ["root-cert"], ["ncca1-cert"], ),
"Name Constraints IP address not permitted");
-ok(!verify("badalt6-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
+ok(!verify("badalt6-cert", "", ["root-cert"], ["ncca1-cert"], ),
"Name Constraints CN hostname not permitted");
-ok(!verify("badalt7-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
+ok(!verify("badalt7-cert", "", ["root-cert"], ["ncca1-cert"], ),
"Name Constraints CN BMPSTRING hostname not permitted");
-ok(!verify("badalt8-cert", "sslserver", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
+ok(!verify("badalt8-cert", "", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
"Name constraints nested DNS name not permitted 1");
-ok(!verify("badalt9-cert", "sslserver", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
+ok(!verify("badalt9-cert", "", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
"Name constraints nested DNS name not permitted 2");
-ok(!verify("badalt10-cert", "sslserver", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
+ok(!verify("badalt10-cert", "", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
"Name constraints nested DNS name excluded");
-ok(verify("ee-pss-sha1-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "0"),
+ok(verify("ee-pss-sha1-cert", "", ["root-cert"], ["ca-cert"], "-auth_level", "0"),
"Accept PSS signature using SHA1 at auth level 0");
-ok(verify("ee-pss-sha256-cert", "sslserver", ["root-cert"], ["ca-cert"], ),
+ok(verify("ee-pss-sha256-cert", "", ["root-cert"], ["ca-cert"], ),
"CA with PSS signature using SHA256");
-ok(!verify("ee-pss-sha1-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "1"),
+ok(!verify("ee-pss-sha1-cert", "", ["root-cert"], ["ca-cert"], "-auth_level", "1"),
"Reject PSS signature using SHA1 and auth level 1");
-ok(verify("ee-pss-sha256-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "2"),
+ok(verify("ee-pss-sha256-cert", "", ["root-cert"], ["ca-cert"], "-auth_level", "2"),
"PSS signature using SHA256 and auth level 2");
-ok(verify("ee-pss-cert", "sslserver", ["root-cert"], ["ca-pss-cert"], ),
+ok(verify("ee-pss-cert", "", ["root-cert"], ["ca-pss-cert"], ),
"CA PSS signature");
-ok(!verify("ee-pss-wrong1.5-cert", "sslserver", ["root-cert"], ["ca-pss-cert"], ),
+ok(!verify("ee-pss-wrong1.5-cert", "", ["root-cert"], ["ca-pss-cert"], ),
"CA producing regular PKCS#1 v1.5 signature with PSA-PSS key");
-ok(!verify("many-names1", "sslserver", ["many-constraints"], ["many-constraints"], ),
+ok(!verify("many-names1", "", ["many-constraints"], ["many-constraints"], ),
"Too many names and constraints to check (1)");
-ok(!verify("many-names2", "sslserver", ["many-constraints"], ["many-constraints"], ),
+ok(!verify("many-names2", "", ["many-constraints"], ["many-constraints"], ),
"Too many names and constraints to check (2)");
-ok(!verify("many-names3", "sslserver", ["many-constraints"], ["many-constraints"], ),
+ok(!verify("many-names3", "", ["many-constraints"], ["many-constraints"], ),
"Too many names and constraints to check (3)");
-ok(verify("some-names1", "sslserver", ["many-constraints"], ["many-constraints"], ),
+ok(verify("some-names1", "", ["many-constraints"], ["many-constraints"], ),
"Not too many names and constraints to check (1)");
-ok(verify("some-names2", "sslserver", ["many-constraints"], ["many-constraints"], ),
+ok(verify("some-names2", "", ["many-constraints"], ["many-constraints"], ),
"Not too many names and constraints to check (2)");
-ok(verify("some-names2", "sslserver", ["many-constraints"], ["many-constraints"], ),
+ok(verify("some-names2", "", ["many-constraints"], ["many-constraints"], ),
"Not too many names and constraints to check (3)");
-ok(verify("root-cert-rsa2", "sslserver", ["root-cert-rsa2"], [], "-check_ss_sig"),
+ok(verify("root-cert-rsa2", "", ["root-cert-rsa2"], [], "-check_ss_sig"),
"Public Key Algorithm rsa instead of rsaEncryption");
- ok(verify("ee-self-signed", "sslserver", ["ee-self-signed"], []),
- "accept trusted self-signed EE cert excluding key usage keyCertSign");
+ok(verify("ee-self-signed", "", ["ee-self-signed"], []),
+ "accept trusted self-signed EE cert excluding key usage keyCertSign");
SKIP: {
skip "Ed25519 is not supported by this OpenSSL build", 6
if disabled("ec");
# ED25519 certificate from draft-ietf-curdle-pkix-04
- ok(verify("ee-ed25519", "sslserver", ["root-ed25519"], []),
+ ok(verify("ee-ed25519", "", ["root-ed25519"], []),
"accept X25519 EE cert issued by trusted Ed25519 self-signed CA cert");
- ok(!verify("ee-ed25519", "sslserver", ["root-ed25519"], [], "-x509_strict"),
+ ok(!verify("ee-ed25519", "", ["root-ed25519"], [], "-x509_strict"),
"reject X25519 EE cert in strict mode since AKID is missing");
- ok(!verify("root-ed25519", "sslserver", ["ee-ed25519"], []),
+ ok(!verify("root-ed25519", "", ["ee-ed25519"], []),
"fail Ed25519 CA and EE certs swapped");
- ok(verify("root-ed25519", "sslserver", ["root-ed25519"], []),
+ ok(verify("root-ed25519", "", ["root-ed25519"], []),
"accept trusted Ed25519 self-signed CA cert");
- ok(!verify("ee-ed25519", "sslserver", ["ee-ed25519"], []),
+ ok(!verify("ee-ed25519", "", ["ee-ed25519"], []),
"fail trusted Ed25519-signed self-issued X25519 cert");
- ok(verify("ee-ed25519", "sslserver", ["ee-ed25519"], [], "-partial_chain"),
+ ok(verify("ee-ed25519", "", ["ee-ed25519"], [], "-partial_chain"),
"accept last-resort direct leaf match Ed25519-signed self-issued cert");
}
SKIP: {
- skip "SM2 is not supported by this OpenSSL build", 2
- if disabled("sm2");
+ skip "SM2 is not supported by this OpenSSL build", 2 if disabled("sm2");
- ok_nofips(verify("sm2", "any", ["sm2-ca-cert"], [], "-vfyopt", "distid:1234567812345678"),
+ ok_nofips(verify("sm2", "", ["sm2-ca-cert"], [], "-vfyopt", "distid:1234567812345678"),
"SM2 ID test");
- ok_nofips(verify("sm2", "any", ["sm2-ca-cert"], [], "-vfyopt", "hexdistid:31323334353637383132333435363738"),
+ ok_nofips(verify("sm2", "", ["sm2-ca-cert"], [], "-vfyopt", "hexdistid:31323334353637383132333435363738"),
"SM2 hex ID test");
}
More information about the openssl-commits
mailing list