diff options
Diffstat (limited to 'test/recipes/80-test_ocsp.t')
| -rw-r--r-- | test/recipes/80-test_ocsp.t | 118 |
1 files changed, 62 insertions, 56 deletions
diff --git a/test/recipes/80-test_ocsp.t b/test/recipes/80-test_ocsp.t index 103a7aea0e..9f178dec62 100644 --- a/test/recipes/80-test_ocsp.t +++ b/test/recipes/80-test_ocsp.t @@ -29,6 +29,10 @@ sub test_ocsp { my $title = shift; my $inputfile = shift; my $CAfile = shift; + my $untrusted = shift; + if ($untrusted eq "") { + $untrusted = $CAfile; + } my $expected_exit = shift; run(app(["openssl", "base64", "-d", @@ -38,7 +42,7 @@ sub test_ocsp { sub { ok(run(app(["openssl", "ocsp", "-respin", "ocsp-resp-fff.dat", "-partial_chain", @check_time, "-CAfile", catfile($ocspdir, $CAfile), - "-verify_other", catfile($ocspdir, $CAfile), + "-verify_other", catfile($ocspdir, $untrusted), "-no-CApath"])), $title); }); unlink "ocsp-resp-fff.dat"; @@ -47,144 +51,146 @@ sub test_ocsp { plan tests => 10; subtest "=== VALID OCSP RESPONSES ===" => sub { - plan tests => 6; + plan tests => 7; test_ocsp("NON-DELEGATED; Intermediate CA -> EE", - "ND1.ors", "ND1_Issuer_ICA.pem", 0); + "ND1.ors", "ND1_Issuer_ICA.pem", "", 0); test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA", - "ND2.ors", "ND2_Issuer_Root.pem", 0); + "ND2.ors", "ND2_Issuer_Root.pem", "", 0); test_ocsp("NON-DELEGATED; Root CA -> EE", - "ND3.ors", "ND3_Issuer_Root.pem", 0); + "ND3.ors", "ND3_Issuer_Root.pem", "", 0); + test_ocsp("NON-DELEGATED; 3-level CA hierarchy", + "ND1.ors", "ND1_Cross_Root.pem", "ND1_Issuer_ICA-Cross.pem", 0); test_ocsp("DELEGATED; Intermediate CA -> EE", - "D1.ors", "D1_Issuer_ICA.pem", 0); + "D1.ors", "D1_Issuer_ICA.pem", "", 0); test_ocsp("DELEGATED; Root CA -> Intermediate CA", - "D2.ors", "D2_Issuer_Root.pem", 0); + "D2.ors", "D2_Issuer_Root.pem", "", 0); test_ocsp("DELEGATED; Root CA -> EE", - "D3.ors", "D3_Issuer_Root.pem", 0); + "D3.ors", "D3_Issuer_Root.pem", "", 0); }; subtest "=== INVALID SIGNATURE on the OCSP RESPONSE ===" => sub { plan tests => 6; test_ocsp("NON-DELEGATED; Intermediate CA -> EE", - "ISOP_ND1.ors", "ND1_Issuer_ICA.pem", 1); + "ISOP_ND1.ors", "ND1_Issuer_ICA.pem", "", 1); test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA", - "ISOP_ND2.ors", "ND2_Issuer_Root.pem", 1); + "ISOP_ND2.ors", "ND2_Issuer_Root.pem", "", 1); test_ocsp("NON-DELEGATED; Root CA -> EE", - "ISOP_ND3.ors", "ND3_Issuer_Root.pem", 1); + "ISOP_ND3.ors", "ND3_Issuer_Root.pem", "", 1); test_ocsp("DELEGATED; Intermediate CA -> EE", - "ISOP_D1.ors", "D1_Issuer_ICA.pem", 1); + "ISOP_D1.ors", "D1_Issuer_ICA.pem", "", 1); test_ocsp("DELEGATED; Root CA -> Intermediate CA", - "ISOP_D2.ors", "D2_Issuer_Root.pem", 1); + "ISOP_D2.ors", "D2_Issuer_Root.pem", "", 1); test_ocsp("DELEGATED; Root CA -> EE", - "ISOP_D3.ors", "D3_Issuer_Root.pem", 1); + "ISOP_D3.ors", "D3_Issuer_Root.pem", "", 1); }; subtest "=== WRONG RESPONDERID in the OCSP RESPONSE ===" => sub { plan tests => 6; test_ocsp("NON-DELEGATED; Intermediate CA -> EE", - "WRID_ND1.ors", "ND1_Issuer_ICA.pem", 1); + "WRID_ND1.ors", "ND1_Issuer_ICA.pem", "", 1); test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA", - "WRID_ND2.ors", "ND2_Issuer_Root.pem", 1); + "WRID_ND2.ors", "ND2_Issuer_Root.pem", "", 1); test_ocsp("NON-DELEGATED; Root CA -> EE", - "WRID_ND3.ors", "ND3_Issuer_Root.pem", 1); + "WRID_ND3.ors", "ND3_Issuer_Root.pem", "", 1); test_ocsp("DELEGATED; Intermediate CA -> EE", - "WRID_D1.ors", "D1_Issuer_ICA.pem", 1); + "WRID_D1.ors", "D1_Issuer_ICA.pem", "", 1); test_ocsp("DELEGATED; Root CA -> Intermediate CA", - "WRID_D2.ors", "D2_Issuer_Root.pem", 1); + "WRID_D2.ors", "D2_Issuer_Root.pem", "", 1); test_ocsp("DELEGATED; Root CA -> EE", - "WRID_D3.ors", "D3_Issuer_Root.pem", 1); + "WRID_D3.ors", "D3_Issuer_Root.pem", "", 1); }; subtest "=== WRONG ISSUERNAMEHASH in the OCSP RESPONSE ===" => sub { plan tests => 6; test_ocsp("NON-DELEGATED; Intermediate CA -> EE", - "WINH_ND1.ors", "ND1_Issuer_ICA.pem", 1); + "WINH_ND1.ors", "ND1_Issuer_ICA.pem", "", 1); test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA", - "WINH_ND2.ors", "ND2_Issuer_Root.pem", 1); + "WINH_ND2.ors", "ND2_Issuer_Root.pem", "", 1); test_ocsp("NON-DELEGATED; Root CA -> EE", - "WINH_ND3.ors", "ND3_Issuer_Root.pem", 1); + "WINH_ND3.ors", "ND3_Issuer_Root.pem", "", 1); test_ocsp("DELEGATED; Intermediate CA -> EE", - "WINH_D1.ors", "D1_Issuer_ICA.pem", 1); + "WINH_D1.ors", "D1_Issuer_ICA.pem", "", 1); test_ocsp("DELEGATED; Root CA -> Intermediate CA", - "WINH_D2.ors", "D2_Issuer_Root.pem", 1); + "WINH_D2.ors", "D2_Issuer_Root.pem", "", 1); test_ocsp("DELEGATED; Root CA -> EE", - "WINH_D3.ors", "D3_Issuer_Root.pem", 1); + "WINH_D3.ors", "D3_Issuer_Root.pem", "", 1); }; subtest "=== WRONG ISSUERKEYHASH in the OCSP RESPONSE ===" => sub { plan tests => 6; test_ocsp("NON-DELEGATED; Intermediate CA -> EE", - "WIKH_ND1.ors", "ND1_Issuer_ICA.pem", 1); + "WIKH_ND1.ors", "ND1_Issuer_ICA.pem", "", 1); test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA", - "WIKH_ND2.ors", "ND2_Issuer_Root.pem", 1); + "WIKH_ND2.ors", "ND2_Issuer_Root.pem", "", 1); test_ocsp("NON-DELEGATED; Root CA -> EE", - "WIKH_ND3.ors", "ND3_Issuer_Root.pem", 1); + "WIKH_ND3.ors", "ND3_Issuer_Root.pem", "", 1); test_ocsp("DELEGATED; Intermediate CA -> EE", - "WIKH_D1.ors", "D1_Issuer_ICA.pem", 1); + "WIKH_D1.ors", "D1_Issuer_ICA.pem", "", 1); test_ocsp("DELEGATED; Root CA -> Intermediate CA", - "WIKH_D2.ors", "D2_Issuer_Root.pem", 1); + "WIKH_D2.ors", "D2_Issuer_Root.pem", "", 1); test_ocsp("DELEGATED; Root CA -> EE", - "WIKH_D3.ors", "D3_Issuer_Root.pem", 1); + "WIKH_D3.ors", "D3_Issuer_Root.pem", "", 1); }; subtest "=== WRONG KEY in the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub { plan tests => 3; test_ocsp("DELEGATED; Intermediate CA -> EE", - "WKDOSC_D1.ors", "D1_Issuer_ICA.pem", 1); + "WKDOSC_D1.ors", "D1_Issuer_ICA.pem", "", 1); test_ocsp("DELEGATED; Root CA -> Intermediate CA", - "WKDOSC_D2.ors", "D2_Issuer_Root.pem", 1); + "WKDOSC_D2.ors", "D2_Issuer_Root.pem", "", 1); test_ocsp("DELEGATED; Root CA -> EE", - "WKDOSC_D3.ors", "D3_Issuer_Root.pem", 1); + "WKDOSC_D3.ors", "D3_Issuer_Root.pem", "", 1); }; subtest "=== INVALID SIGNATURE on the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub { plan tests => 3; test_ocsp("DELEGATED; Intermediate CA -> EE", - "ISDOSC_D1.ors", "D1_Issuer_ICA.pem", 1); + "ISDOSC_D1.ors", "D1_Issuer_ICA.pem", "", 1); test_ocsp("DELEGATED; Root CA -> Intermediate CA", - "ISDOSC_D2.ors", "D2_Issuer_Root.pem", 1); + "ISDOSC_D2.ors", "D2_Issuer_Root.pem", "", 1); test_ocsp("DELEGATED; Root CA -> EE", - "ISDOSC_D3.ors", "D3_Issuer_Root.pem", 1); + "ISDOSC_D3.ors", "D3_Issuer_Root.pem", "", 1); }; subtest "=== WRONG SUBJECT NAME in the ISSUER CERTIFICATE ===" => sub { plan tests => 6; test_ocsp("NON-DELEGATED; Intermediate CA -> EE", - "ND1.ors", "WSNIC_ND1_Issuer_ICA.pem", 1); + "ND1.ors", "WSNIC_ND1_Issuer_ICA.pem", "", 1); test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA", - "ND2.ors", "WSNIC_ND2_Issuer_Root.pem", 1); + "ND2.ors", "WSNIC_ND2_Issuer_Root.pem", "", 1); test_ocsp("NON-DELEGATED; Root CA -> EE", - "ND3.ors", "WSNIC_ND3_Issuer_Root.pem", 1); + "ND3.ors", "WSNIC_ND3_Issuer_Root.pem", "", 1); test_ocsp("DELEGATED; Intermediate CA -> EE", - "D1.ors", "WSNIC_D1_Issuer_ICA.pem", 1); + "D1.ors", "WSNIC_D1_Issuer_ICA.pem", "", 1); test_ocsp("DELEGATED; Root CA -> Intermediate CA", - "D2.ors", "WSNIC_D2_Issuer_Root.pem", 1); + "D2.ors", "WSNIC_D2_Issuer_Root.pem", "", 1); test_ocsp("DELEGATED; Root CA -> EE", - "D3.ors", "WSNIC_D3_Issuer_Root.pem", 1); + "D3.ors", "WSNIC_D3_Issuer_Root.pem", "", 1); }; subtest "=== WRONG KEY in the ISSUER CERTIFICATE ===" => sub { plan tests => 6; test_ocsp("NON-DELEGATED; Intermediate CA -> EE", - "ND1.ors", "WKIC_ND1_Issuer_ICA.pem", 1); + "ND1.ors", "WKIC_ND1_Issuer_ICA.pem", "", 1); test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA", - "ND2.ors", "WKIC_ND2_Issuer_Root.pem", 1); + "ND2.ors", "WKIC_ND2_Issuer_Root.pem", "", 1); test_ocsp("NON-DELEGATED; Root CA -> EE", - "ND3.ors", "WKIC_ND3_Issuer_Root.pem", 1); + "ND3.ors", "WKIC_ND3_Issuer_Root.pem", "", 1); test_ocsp("DELEGATED; Intermediate CA -> EE", - "D1.ors", "WKIC_D1_Issuer_ICA.pem", 1); + "D1.ors", "WKIC_D1_Issuer_ICA.pem", "", 1); test_ocsp("DELEGATED; Root CA -> Intermediate CA", - "D2.ors", "WKIC_D2_Issuer_Root.pem", 1); + "D2.ors", "WKIC_D2_Issuer_Root.pem", "", 1); test_ocsp("DELEGATED; Root CA -> EE", - "D3.ors", "WKIC_D3_Issuer_Root.pem", 1); + "D3.ors", "WKIC_D3_Issuer_Root.pem", "", 1); }; subtest "=== INVALID SIGNATURE on the ISSUER CERTIFICATE ===" => sub { @@ -192,15 +198,15 @@ subtest "=== INVALID SIGNATURE on the ISSUER CERTIFICATE ===" => sub { # Expect success, because we're explicitly trusting the issuer certificate. test_ocsp("NON-DELEGATED; Intermediate CA -> EE", - "ND1.ors", "ISIC_ND1_Issuer_ICA.pem", 0); + "ND1.ors", "ISIC_ND1_Issuer_ICA.pem", "", 0); test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA", - "ND2.ors", "ISIC_ND2_Issuer_Root.pem", 0); + "ND2.ors", "ISIC_ND2_Issuer_Root.pem", "", 0); test_ocsp("NON-DELEGATED; Root CA -> EE", - "ND3.ors", "ISIC_ND3_Issuer_Root.pem", 0); + "ND3.ors", "ISIC_ND3_Issuer_Root.pem", "", 0); test_ocsp("DELEGATED; Intermediate CA -> EE", - "D1.ors", "ISIC_D1_Issuer_ICA.pem", 0); + "D1.ors", "ISIC_D1_Issuer_ICA.pem", "", 0); test_ocsp("DELEGATED; Root CA -> Intermediate CA", - "D2.ors", "ISIC_D2_Issuer_Root.pem", 0); + "D2.ors", "ISIC_D2_Issuer_Root.pem", "", 0); test_ocsp("DELEGATED; Root CA -> EE", - "D3.ors", "ISIC_D3_Issuer_Root.pem", 0); + "D3.ors", "ISIC_D3_Issuer_Root.pem", "", 0); }; |