diff options
author | Dr. David von Oheimb <David.von.Oheimb@siemens.com> | 2019-12-23 20:15:49 +0100 |
---|---|---|
committer | Dr. David von Oheimb <David.von.Oheimb@siemens.com> | 2020-07-01 11:14:54 +0200 |
commit | 4acd484d55ac3c86091e42f81479f514d0cf8b17 (patch) | |
tree | 2e1fb69cc6590d10c086e37075ff3edfc3c93d74 /test | |
parent | 023697870bcd4372a142a606546253d719a81024 (diff) |
Make x509 -force_pubkey test case with self-issued cert more realistic
by adding CA basic constraints, CA key usage, and key IDs to the cert
and by add -partial_chain to the verify call that trusts this cert
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/10587)
Diffstat (limited to 'test')
-rw-r--r-- | test/recipes/25-test_x509.t | 8 | ||||
-rw-r--r-- | test/v3_ca_exts.cnf | 5 |
2 files changed, 11 insertions, 2 deletions
diff --git a/test/recipes/25-test_x509.t b/test/recipes/25-test_x509.t index 427c6b7fea..250738487a 100644 --- a/test/recipes/25-test_x509.t +++ b/test/recipes/25-test_x509.t @@ -41,6 +41,7 @@ SKIP: { # producing and checking self-issued (but not self-signed) cert my @path = qw(test certs); my $subj = "/CN=CA"; # using same DN as in issuer of ee-cert.pem + my $extfile = srctop_file("test", "v3_ca_exts.cnf"); my $pkey = srctop_file(@path, "ca-key.pem"); # issuer private key my $pubkey = "ca-pubkey.pem"; # the corresponding issuer public key # use any (different) key for signing our self-issued cert: @@ -50,10 +51,13 @@ SKIP: { ok(run(app(["openssl", "pkey", "-in", $pkey, "-pubout", "-out", $pubkey])) && run(app(["openssl", "x509", "-new", "-force_pubkey", $pubkey, - "-subj", $subj, "-signkey", $signkey, "-out", $selfout])) + "-subj", $subj, "-extfile", $extfile, + "-signkey", $signkey, "-out", $selfout])) && run(app(["openssl", "verify", "-no_check_time", - "-trusted", $selfout, $testcert]))); + "-trusted", $selfout, "-partial_chain", $testcert]))); + unlink $pubkey; + unlink $selfout; } subtest 'x509 -- x.509 v1 certificate' => sub { diff --git a/test/v3_ca_exts.cnf b/test/v3_ca_exts.cnf new file mode 100644 index 0000000000..a6d3245fb4 --- /dev/null +++ b/test/v3_ca_exts.cnf @@ -0,0 +1,5 @@ +basicConstraints = CA:true +keyUsage = cRLSign, keyCertSign +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid:always + |