test/recipes/25-test_req.t

   1 #! /usr/bin/env perl
   2 # Copyright 2015-2023 The OpenSSL Project Authors. All Rights Reserved.
   3 #
   4 # Licensed under the Apache License 2.0 (the "License").  You may not use
   5 # this file except in compliance with the License.  You can obtain a copy
   6 # in the file LICENSE in the source distribution or at
   7 # https://www.openssl.org/source/license.html
   8
   9
  10 use strict;
  11 use warnings;
  12
  13 use OpenSSL::Test::Utils;
  14 use OpenSSL::Test qw/:DEFAULT srctop_file/;
  15
  16 setup("test_req");
  17
  18 plan tests => 106;
  19
  20 require_ok(srctop_file('test', 'recipes', 'tconversion.pl'));
  21
  22 my @certs = qw(test certs);
  23
  24 # What type of key to generate?
  25 my @req_new;
  26 if (disabled("rsa")) {
  27     @req_new = ("-newkey", "dsa:".srctop_file("apps", "dsa512.pem"));
  28 } else {
  29     @req_new = ("-new");
  30     note("There should be a 2 sequences of .'s and some +'s.");
  31     note("There should not be more that at most 80 per line");
  32 }
  33
  34 # Prevent MSys2 filename munging for arguments that look like file paths but
  35 # aren't
  36 $ENV{MSYS2_ARG_CONV_EXCL} = "/CN=";
  37
  38 # Check for duplicate -addext parameters, and one "working" case.
  39 my @addext_args = ( "openssl", "req", "-new", "-out", "testreq.pem",
  40                     "-key",  srctop_file(@certs, "ee-key.pem"),
  41     "-config", srctop_file("test", "test.cnf"), @req_new );
  42 my $val = "subjectAltName=DNS:example.com";
  43 my $val1 = "subjectAltName=otherName:1.2.3.4;UTF8:test,email:info\@example.com";
  44 my $val2 = " " . $val;
  45 my $val3 = $val;
  46 $val3 =~ s/=/    =/;
  47 ok( run(app([@addext_args, "-addext", $val])));
  48 ok( run(app([@addext_args, "-addext", $val1])));
  49 $val1 =~ s/UTF8/XXXX/; # execute the error handling in do_othername
  50 ok(!run(app([@addext_args, "-addext", $val1])));
  51 ok(!run(app([@addext_args, "-addext", $val, "-addext", $val])));
  52 ok(!run(app([@addext_args, "-addext", $val, "-addext", $val2])));
  53 ok(!run(app([@addext_args, "-addext", $val, "-addext", $val3])));
  54 ok(!run(app([@addext_args, "-addext", $val2, "-addext", $val3])));
  55
  56 # If a CSR is provided with neither of -key or -CA/-CAkey, this should fail.
  57 ok(!run(app(["openssl", "req", "-x509",
  58                 "-in", srctop_file(@certs, "x509-check.csr"),
  59                 "-out", "testreq.pem"])));
  60
  61 subtest "generating alt certificate requests with RSA" => sub {
  62     plan tests => 3;
  63
  64     SKIP: {
  65         skip "RSA is not supported by this OpenSSL build", 2
  66             if disabled("rsa");
  67
  68         ok(run(app(["openssl", "req",
  69                     "-config", srctop_file("test", "test.cnf"),
  70                     "-section", "altreq",
  71                     "-new", "-out", "testreq-rsa.pem", "-utf8",
  72                     "-key", srctop_file("test", "testrsa.pem")])),
  73            "Generating request");
  74
  75         ok(run(app(["openssl", "req",
  76                     "-config", srctop_file("test", "test.cnf"),
  77                     "-verify", "-in", "testreq-rsa.pem", "-noout"])),
  78            "Verifying signature on request");
  79
  80         ok(run(app(["openssl", "req",
  81                     "-config", srctop_file("test", "test.cnf"),
  82                     "-section", "altreq",
  83                     "-verify", "-in", "testreq-rsa.pem", "-noout"])),
  84            "Verifying signature on request");
  85     }
  86 };
  87
  88
  89 subtest "generating certificate requests with RSA" => sub {
  90     plan tests => 8;
  91
  92     SKIP: {
  93         skip "RSA is not supported by this OpenSSL build", 2
  94             if disabled("rsa");
  95
  96         ok(!run(app(["openssl", "req",
  97                      "-config", srctop_file("test", "test.cnf"),
  98                      "-new", "-out", "testreq-rsa.pem", "-utf8",
  99                      "-key", srctop_file("test", "testrsa.pem"),
 100                      "-keyform", "DER"])),
 101            "Checking that mismatching keyform fails");
 102
 103         ok(run(app(["openssl", "req",
 104                     "-config", srctop_file("test", "test.cnf"),
 105                     "-new", "-out", "testreq-rsa.pem", "-utf8",
 106                     "-key", srctop_file("test", "testrsa.pem"),
 107                     "-keyform", "PEM"])),
 108            "Generating request");
 109
 110         ok(run(app(["openssl", "req",
 111                     "-config", srctop_file("test", "test.cnf"),
 112                     "-verify", "-in", "testreq-rsa.pem", "-noout"])),
 113            "Verifying signature on request");
 114
 115         ok(run(app(["openssl", "req",
 116                     "-config", srctop_file("test", "test.cnf"),
 117                     "-modulus", "-in", "testreq-rsa.pem", "-noout"])),
 118            "Printing a modulus of the request key");
 119
 120         ok(run(app(["openssl", "req",
 121                     "-config", srctop_file("test", "test.cnf"),
 122                     "-new", "-out", "testreq_withattrs_pem.pem", "-utf8",
 123                     "-key", srctop_file("test", "testrsa_withattrs.pem")])),
 124            "Generating request from a key with extra attributes - PEM");
 125
 126         ok(run(app(["openssl", "req",
 127                     "-config", srctop_file("test", "test.cnf"),
 128                     "-verify", "-in", "testreq_withattrs_pem.pem", "-noout"])),
 129            "Verifying signature on request from a key with extra attributes - PEM");
 130
 131         ok(run(app(["openssl", "req",
 132                     "-config", srctop_file("test", "test.cnf"),
 133                     "-new", "-out", "testreq_withattrs_der.pem", "-utf8",
 134                     "-key", srctop_file("test", "testrsa_withattrs.der"),
 135                     "-keyform", "DER"])),
 136            "Generating request from a key with extra attributes - PEM");
 137
 138         ok(run(app(["openssl", "req",
 139                     "-config", srctop_file("test", "test.cnf"),
 140                     "-verify", "-in", "testreq_withattrs_der.pem", "-noout"])),
 141            "Verifying signature on request from a key with extra attributes - PEM");
 142     }
 143 };
 144
 145 subtest "generating certificate requests with RSA-PSS" => sub {
 146     plan tests => 12;
 147
 148     SKIP: {
 149         skip "RSA is not supported by this OpenSSL build", 2
 150             if disabled("rsa");
 151
 152         ok(run(app(["openssl", "req",
 153                     "-config", srctop_file("test", "test.cnf"),
 154                     "-new", "-out", "testreq-rsapss.pem", "-utf8",
 155                     "-key", srctop_file("test", "testrsapss.pem")])),
 156            "Generating request");
 157         ok(run(app(["openssl", "req",
 158                     "-config", srctop_file("test", "test.cnf"),
 159                     "-verify", "-in", "testreq-rsapss.pem", "-noout"])),
 160            "Verifying signature on request");
 161
 162         ok(run(app(["openssl", "req",
 163                     "-config", srctop_file("test", "test.cnf"),
 164                     "-new", "-out", "testreq-rsapss2.pem", "-utf8",
 165                     "-sigopt", "rsa_padding_mode:pss",
 166                     "-sigopt", "rsa_pss_saltlen:-1",
 167                     "-key", srctop_file("test", "testrsapss.pem")])),
 168            "Generating request");
 169         ok(run(app(["openssl", "req",
 170                     "-config", srctop_file("test", "test.cnf"),
 171                     "-verify", "-in", "testreq-rsapss2.pem", "-noout"])),
 172            "Verifying signature on request");
 173
 174         ok(run(app(["openssl", "req",
 175                     "-config", srctop_file("test", "test.cnf"),
 176                     "-new", "-out", "testreq-rsapssmand.pem", "-utf8",
 177                     "-sigopt", "rsa_padding_mode:pss",
 178                     "-key", srctop_file("test", "testrsapssmandatory.pem")])),
 179            "Generating request");
 180         ok(run(app(["openssl", "req",
 181                     "-config", srctop_file("test", "test.cnf"),
 182                     "-verify", "-in", "testreq-rsapssmand.pem", "-noout"])),
 183            "Verifying signature on request");
 184
 185         ok(run(app(["openssl", "req",
 186                     "-config", srctop_file("test", "test.cnf"),
 187                     "-new", "-out", "testreq-rsapssmand2.pem", "-utf8",
 188                     "-sigopt", "rsa_pss_saltlen:100",
 189                     "-key", srctop_file("test", "testrsapssmandatory.pem")])),
 190            "Generating request");
 191         ok(run(app(["openssl", "req",
 192                     "-config", srctop_file("test", "test.cnf"),
 193                     "-verify", "-in", "testreq-rsapssmand2.pem", "-noout"])),
 194            "Verifying signature on request");
 195
 196         ok(!run(app(["openssl", "req",
 197                      "-config", srctop_file("test", "test.cnf"),
 198                      "-new", "-out", "testreq-rsapss3.pem", "-utf8",
 199                      "-sigopt", "rsa_padding_mode:pkcs1",
 200                      "-key", srctop_file("test", "testrsapss.pem")])),
 201            "Generating request with expected failure");
 202
 203         ok(!run(app(["openssl", "req",
 204                      "-config", srctop_file("test", "test.cnf"),
 205                      "-new", "-out", "testreq-rsapss3.pem", "-utf8",
 206                      "-sigopt", "rsa_pss_saltlen:-5",
 207                      "-key", srctop_file("test", "testrsapss.pem")])),
 208            "Generating request with expected failure");
 209
 210         ok(!run(app(["openssl", "req",
 211                      "-config", srctop_file("test", "test.cnf"),
 212                      "-new", "-out", "testreq-rsapssmand3.pem", "-utf8",
 213                      "-sigopt", "rsa_pss_saltlen:10",
 214                      "-key", srctop_file("test", "testrsapssmandatory.pem")])),
 215            "Generating request with expected failure");
 216
 217         ok(!run(app(["openssl", "req",
 218                      "-config", srctop_file("test", "test.cnf"),
 219                      "-new", "-out", "testreq-rsapssmand3.pem", "-utf8",
 220                      "-sha256",
 221                      "-key", srctop_file("test", "testrsapssmandatory.pem")])),
 222            "Generating request with expected failure");
 223     }
 224 };
 225
 226 subtest "generating certificate requests with DSA" => sub {
 227     plan tests => 2;
 228
 229     SKIP: {
 230         skip "DSA is not supported by this OpenSSL build", 2
 231             if disabled("dsa");
 232
 233         ok(run(app(["openssl", "req",
 234                     "-config", srctop_file("test", "test.cnf"),
 235                     "-new", "-out", "testreq-dsa.pem", "-utf8",
 236                     "-key", srctop_file("test", "testdsa.pem")])),
 237            "Generating request");
 238
 239         ok(run(app(["openssl", "req",
 240                     "-config", srctop_file("test", "test.cnf"),
 241                     "-verify", "-in", "testreq-dsa.pem", "-noout"])),
 242            "Verifying signature on request");
 243     }
 244 };
 245
 246 subtest "generating certificate requests with ECDSA" => sub {
 247     plan tests => 2;
 248
 249     SKIP: {
 250         skip "ECDSA is not supported by this OpenSSL build", 2
 251             if disabled("ec");
 252
 253         ok(run(app(["openssl", "req",
 254                     "-config", srctop_file("test", "test.cnf"),
 255                     "-new", "-out", "testreq-ec.pem", "-utf8",
 256                     "-key", srctop_file("test", "testec-p256.pem")])),
 257            "Generating request");
 258
 259         ok(run(app(["openssl", "req",
 260                     "-config", srctop_file("test", "test.cnf"),
 261                     "-verify", "-in", "testreq-ec.pem", "-noout"])),
 262            "Verifying signature on request");
 263     }
 264 };
 265
 266 subtest "generating certificate requests with Ed25519" => sub {
 267     plan tests => 2;
 268
 269     SKIP: {
 270         skip "Ed25519 is not supported by this OpenSSL build", 2
 271             if disabled("ecx");
 272
 273         ok(run(app(["openssl", "req",
 274                     "-config", srctop_file("test", "test.cnf"),
 275                     "-new", "-out", "testreq-ed25519.pem", "-utf8",
 276                     "-key", srctop_file("test", "tested25519.pem")])),
 277            "Generating request");
 278
 279         ok(run(app(["openssl", "req",
 280                     "-config", srctop_file("test", "test.cnf"),
 281                     "-verify", "-in", "testreq-ed25519.pem", "-noout"])),
 282            "Verifying signature on request");
 283     }
 284 };
 285
 286 subtest "generating certificate requests with Ed448" => sub {
 287     plan tests => 2;
 288
 289     SKIP: {
 290         skip "Ed448 is not supported by this OpenSSL build", 2
 291             if disabled("ecx");
 292
 293         ok(run(app(["openssl", "req",
 294                     "-config", srctop_file("test", "test.cnf"),
 295                     "-new", "-out", "testreq-ed448.pem", "-utf8",
 296                     "-key", srctop_file("test", "tested448.pem")])),
 297            "Generating request");
 298
 299         ok(run(app(["openssl", "req",
 300                     "-config", srctop_file("test", "test.cnf"),
 301                     "-verify", "-in", "testreq-ed448.pem", "-noout"])),
 302            "Verifying signature on request");
 303     }
 304 };
 305
 306 subtest "generating certificate requests" => sub {
 307     plan tests => 2;
 308
 309     ok(run(app(["openssl", "req", "-config", srctop_file("test", "test.cnf"),
 310                 "-key", srctop_file(@certs, "ee-key.pem"),
 311                 @req_new, "-out", "testreq.pem"])),
 312        "Generating request");
 313
 314     ok(run(app(["openssl", "req", "-config", srctop_file("test", "test.cnf"),
 315                 "-verify", "-in", "testreq.pem", "-noout"])),
 316        "Verifying signature on request");
 317 };
 318
 319 subtest "generating SM2 certificate requests" => sub {
 320     plan tests => 4;
 321
 322     SKIP: {
 323         skip "SM2 is not supported by this OpenSSL build", 4
 324         if disabled("sm2");
 325         ok(run(app(["openssl", "req",
 326                     "-config", srctop_file("test", "test.cnf"),
 327                     "-new", "-key", srctop_file(@certs, "sm2.key"),
 328                     "-sigopt", "distid:1234567812345678",
 329                     "-out", "testreq-sm2.pem", "-sm3"])),
 330            "Generating SM2 certificate request");
 331
 332         ok(run(app(["openssl", "req",
 333                     "-config", srctop_file("test", "test.cnf"),
 334                     "-verify", "-in", "testreq-sm2.pem", "-noout",
 335                     "-vfyopt", "distid:1234567812345678", "-sm3"])),
 336            "Verifying signature on SM2 certificate request");
 337
 338         ok(run(app(["openssl", "req",
 339                     "-config", srctop_file("test", "test.cnf"),
 340                     "-new", "-key", srctop_file(@certs, "sm2.key"),
 341                     "-sigopt", "hexdistid:DEADBEEF",
 342                     "-out", "testreq-sm2.pem", "-sm3"])),
 343            "Generating SM2 certificate request with hex id");
 344
 345         ok(run(app(["openssl", "req",
 346                     "-config", srctop_file("test", "test.cnf"),
 347                     "-verify", "-in", "testreq-sm2.pem", "-noout",
 348                     "-vfyopt", "hexdistid:DEADBEEF", "-sm3"])),
 349            "Verifying signature on SM2 certificate request");
 350     }
 351 };
 352
 353 my @openssl_args = ("req", "-config", srctop_file("apps", "openssl.cnf"));
 354
 355 run_conversion('req conversions',
 356                "testreq.pem");
 357 run_conversion('req conversions -- testreq2',
 358                srctop_file("test", "testreq2.pem"));
 359
 360 sub run_conversion {
 361     my $title = shift;
 362     my $reqfile = shift;
 363
 364     subtest $title => sub {
 365         run(app(["openssl", @openssl_args,
 366                  "-in", $reqfile, "-inform", "p",
 367                  "-noout", "-text"],
 368                 stderr => "req-check.err", stdout => undef));
 369         open DATA, "req-check.err";
 370         SKIP: {
 371             plan skip_all => "skipping req conversion test for $reqfile"
 372                 if grep /Unknown Public Key/, map { s/\R//; } <DATA>;
 373
 374             tconversion( -type => 'req', -in => $reqfile,
 375                          -args => [ @openssl_args ] );
 376         }
 377         close DATA;
 378         unlink "req-check.err";
 379
 380         done_testing();
 381     };
 382 }
 383
 384 # Test both generation and verification of certs w.r.t. RFC 5280 requirements
 385
 386 my $ca_cert; # will be set below
 387 sub generate_cert {
 388     my $cert = shift @_;
 389     my $ss = $cert =~ m/self-signed/;
 390     my $is_ca = $cert =~ m/CA/;
 391     my $cn = $is_ca ? "CA" : "EE";
 392     my $ca_key = srctop_file(@certs, "ca-key.pem");
 393     my $key = $is_ca ? $ca_key : srctop_file(@certs, "ee-key.pem");
 394     my @cmd = ("openssl", "req", "-config", "", "-x509",
 395                "-subj", "/CN=$cn", @_, "-out", $cert);
 396     push(@cmd, ("-key", $key)) if $ss;
 397     push(@cmd, ("-CA", $ca_cert, "-CAkey", $ca_key)) unless $ss;
 398     ok(run(app([@cmd])), "generate $cert");
 399 }
 400
 401 sub has_keyUsage {
 402     my $cert = shift @_;
 403     my $expect = shift @_;
 404     cert_contains($cert, "Key Usage", $expect);
 405 }
 406 sub strict_verify {
 407     my $cert = shift @_;
 408     my $expect = shift @_;
 409     my $trusted = shift @_;
 410     $trusted = $cert unless $trusted;
 411     ok(run(app(["openssl", "verify", "-x509_strict", "-trusted", $trusted,
 412                 "-partial_chain", $cert])) == $expect,
 413        "strict verify allow $cert");
 414 }
 415
 416 my @v3_ca = ("-addext", "basicConstraints = critical,CA:true",
 417              "-addext", "keyUsage = keyCertSign");
 418 my $SKID_AKID = "subjectKeyIdentifier,authorityKeyIdentifier";
 419
 420 # # SKID
 421
 422 my $cert = "self-signed_default_SKID_no_explicit_exts.pem";
 423 generate_cert($cert);
 424 has_version($cert, 3);
 425 has_SKID($cert, 1); # SKID added, though no explicit extensions given
 426 has_AKID($cert, 0);
 427
 428 my $cert = "self-signed_v3_CA_hash_SKID.pem";
 429 generate_cert($cert, @v3_ca, "-addext", "subjectKeyIdentifier = hash");
 430 has_SKID($cert, 1); # explicit hash SKID
 431
 432 $cert = "self-signed_v3_CA_no_SKID.pem";
 433 generate_cert($cert, @v3_ca, "-addext", "subjectKeyIdentifier = none");
 434 cert_ext_has_n_different_lines($cert, 0, $SKID_AKID); # no SKID and no AKID
 435 #TODO strict_verify($cert, 0);
 436
 437 $cert = "self-signed_v3_CA_given_SKID.pem";
 438 generate_cert($cert, @v3_ca, "-addext", "subjectKeyIdentifier = 45");
 439 cert_contains($cert, "Subject Key Identifier: 45 ", 1); # given SKID
 440 strict_verify($cert, 1);
 441
 442 # AKID of self-signed certs
 443
 444 $cert = "self-signed_v1_CA_no_KIDs.pem";
 445 generate_cert($cert, "-x509v1");
 446 has_version($cert, 1);
 447 cert_ext_has_n_different_lines($cert, 0, $SKID_AKID); # no SKID and no AKID
 448 #TODO strict_verify($cert, 1); # self-signed v1 root cert should be accepted as CA
 449
 450 $ca_cert = "self-signed_v3_CA_default_SKID.pem"; # will also be used below
 451 generate_cert($ca_cert, @v3_ca);
 452 has_SKID($ca_cert, 1); # default SKID
 453 has_AKID($ca_cert, 0); # no default AKID
 454 strict_verify($ca_cert, 1);
 455
 456 $cert = "self-signed_v3_CA_no_AKID.pem";
 457 generate_cert($cert, @v3_ca, "-addext", "authorityKeyIdentifier = none");
 458 has_AKID($cert, 0); # forced no AKID
 459
 460 $cert = "self-signed_v3_CA_explicit_AKID.pem";
 461 generate_cert($cert, @v3_ca, "-addext", "authorityKeyIdentifier = keyid");
 462 has_AKID($cert, 0); # for self-signed cert, AKID suppressed and not forced
 463
 464 $cert = "self-signed_v3_CA_forced_AKID.pem";
 465 generate_cert($cert, @v3_ca, "-addext", "authorityKeyIdentifier = keyid:always");
 466 cert_ext_has_n_different_lines($cert, 3, $SKID_AKID); # forced AKID, AKID == SKID
 467 strict_verify($cert, 1);
 468
 469 $cert = "self-signed_v3_CA_issuer_AKID.pem";
 470 generate_cert($cert, @v3_ca, "-addext", "authorityKeyIdentifier = issuer");
 471 has_AKID($cert, 0); # suppressed AKID since not forced
 472
 473 $cert = "self-signed_v3_CA_forced_issuer_AKID.pem";
 474 generate_cert($cert, @v3_ca, "-addext", "authorityKeyIdentifier = issuer:always");
 475 cert_contains($cert, "Authority Key Identifier: DirName:/CN=CA serial:", 1); # forced issuer AKID
 476
 477 $cert = "self-signed_v3_CA_nonforced_keyid_issuer_AKID.pem";
 478 generate_cert($cert, @v3_ca, "-addext", "authorityKeyIdentifier = keyid, issuer");
 479 has_AKID($cert, 0); # AKID not present because not forced and cert self-signed
 480
 481 $cert = "self-signed_v3_CA_keyid_forced_issuer_AKID.pem";
 482 generate_cert($cert, @v3_ca, "-addext", "authorityKeyIdentifier = keyid, issuer:always");
 483 cert_contains($cert, "Authority Key Identifier: DirName:/CN=CA serial:", 1); # issuer AKID forced, with keyid not forced
 484
 485 $cert = "self-signed_v3_CA_forced_keyid_issuer_AKID.pem";
 486 generate_cert($cert, @v3_ca, "-addext", "authorityKeyIdentifier = keyid:always, issuer");
 487 has_AKID($cert, 1); # AKID with keyid forced
 488 cert_contains($cert, "Authority Key Identifier: DirName:/CN=CA serial:", 0); # no issuer AKID
 489
 490 $cert = "self-signed_v3_CA_forced_keyid_forced_issuer_AKID.pem";
 491 generate_cert($cert, @v3_ca, "-addext", "authorityKeyIdentifier = keyid:always, issuer:always");
 492 cert_contains($cert, "Authority Key Identifier: keyid(:[0-9A-Fa-f]{2})+ DirName:/CN=CA serial:", 1); # AKID with keyid and issuer forced
 493
 494 $cert = "self-signed_v3_EE_wrong_keyUsage.pem";
 495 generate_cert($cert, "-addext", "keyUsage = keyCertSign");
 496 #TODO strict_verify($cert, 1); # should be accepted because RFC 5280 does not apply
 497
 498 # AKID of self-issued but not self-signed certs
 499
 500 $cert = "self-issued_x509_v3_CA_default_KIDs.pem";
 501 ok(run(app([("openssl", "x509", "-copy_extensions", "copy",
 502              "-req", "-in", srctop_file(@certs, "ext-check.csr"),
 503              "-key", srctop_file(@certs, "ca-key.pem"),
 504              "-force_pubkey", srctop_file("test", "testrsapub.pem"),
 505              "-out", $cert)])), "generate using x509: $cert");
 506 cert_contains($cert, "Issuer: CN=test .*? Subject: CN=test", 1);
 507 cert_ext_has_n_different_lines($cert, 4, $SKID_AKID); # SKID != AKID
 508 strict_verify($cert, 1);
 509
 510 $cert = "self-issued_v3_CA_default_KIDs.pem";
 511 generate_cert($cert, "-addext", "keyUsage = dataEncipherment",
 512     "-in", srctop_file(@certs, "x509-check.csr"));
 513 cert_contains($cert, "Issuer: CN=CA .*? Subject: CN=CA", 1);
 514 cert_ext_has_n_different_lines($cert, 4, $SKID_AKID); # SKID != AKID
 515 strict_verify($cert, 1);
 516
 517 $cert = "self-issued_v3_CA_no_AKID.pem";
 518 generate_cert($cert, "-addext", "authorityKeyIdentifier = none",
 519     "-in", srctop_file(@certs, "x509-check.csr"));
 520 has_version($cert, 3);
 521 has_SKID($cert, 1); # SKID added, though no explicit extensions given
 522 has_AKID($cert, 0);
 523 strict_verify($cert, 1);
 524
 525 $cert = "self-issued_v3_CA_explicit_AKID.pem";
 526 generate_cert($cert, "-addext", "authorityKeyIdentifier = keyid",
 527     "-in", srctop_file(@certs, "x509-check.csr"));
 528 cert_ext_has_n_different_lines($cert, 4, $SKID_AKID); # SKID != AKID
 529 strict_verify($cert, 1);
 530
 531 $cert = "self-issued_v3_CA_forced_AKID.pem";
 532 generate_cert($cert, "-addext", "authorityKeyIdentifier = keyid:always",
 533     "-in", srctop_file(@certs, "x509-check.csr"));
 534 cert_ext_has_n_different_lines($cert, 4, $SKID_AKID); # SKID != AKID
 535
 536 $cert = "self-issued_v3_CA_issuer_AKID.pem";
 537 generate_cert($cert, @v3_ca, "-addext", "authorityKeyIdentifier = issuer",
 538     "-in", srctop_file(@certs, "x509-check.csr"));
 539 cert_contains($cert, "Authority Key Identifier: DirName:/CN=CA serial:", 1); # just issuer AKID
 540
 541 $cert = "self-issued_v3_CA_forced_issuer_AKID.pem";
 542 generate_cert($cert, @v3_ca, "-addext", "authorityKeyIdentifier = issuer:always",
 543     "-in", srctop_file(@certs, "x509-check.csr"));
 544 cert_contains($cert, "Authority Key Identifier: DirName:/CN=CA serial:", 1); # just issuer AKID
 545
 546 $cert = "self-issued_v3_CA_keyid_issuer_AKID.pem";
 547 generate_cert($cert, "-addext", "authorityKeyIdentifier = keyid, issuer",
 548     "-in", srctop_file(@certs, "x509-check.csr"));
 549 cert_ext_has_n_different_lines($cert, 4, $SKID_AKID); # SKID != AKID, not forced
 550
 551 $cert = "self-issued_v3_CA_keyid_forced_issuer_AKID.pem";
 552 generate_cert($cert, "-addext", "authorityKeyIdentifier = keyid, issuer:always",
 553     "-in", srctop_file(@certs, "x509-check.csr"));
 554 cert_ext_has_n_different_lines($cert, 6, $SKID_AKID); # SKID != AKID, with forced issuer
 555
 556 $cert = "self-issued_v3_CA_forced_keyid_and_issuer_AKID.pem";
 557 generate_cert($cert, "-addext", "authorityKeyIdentifier = keyid:always, issuer:always",
 558     "-in", srctop_file(@certs, "x509-check.csr"));
 559 cert_ext_has_n_different_lines($cert, 6, $SKID_AKID); # SKID != AKID, both forced
 560
 561 # AKID of not self-issued certs
 562
 563 $cert = "regular_v3_EE_default_KIDs_no_other_exts.pem";
 564 generate_cert($cert, "-key", srctop_file(@certs, "ee-key.pem"));
 565 has_version($cert, 3);
 566 cert_ext_has_n_different_lines($cert, 4, $SKID_AKID); # SKID != AKID
 567
 568 $cert = "regular_v3_EE_default_KIDs.pem";
 569 generate_cert($cert, "-addext", "keyUsage = dataEncipherment",
 570     "-key", srctop_file(@certs, "ee-key.pem"));
 571 cert_ext_has_n_different_lines($cert, 4, $SKID_AKID); # SKID != AKID
 572 strict_verify($cert, 1, $ca_cert);
 573
 574 $cert = "regular_v3_EE_copied_exts_default_KIDs.pem";
 575 generate_cert($cert, "-copy_extensions", "copy",
 576               "-in", srctop_file(@certs, "ext-check.csr"));
 577 cert_ext_has_n_different_lines($cert, 4, $SKID_AKID); # SKID != AKID
 578 strict_verify($cert, 1);
 579
 580 $cert = "v3_EE_no_AKID.pem";
 581 generate_cert($cert, "-addext", "authorityKeyIdentifier = none",
 582     "-key", srctop_file(@certs, "ee-key.pem"));
 583 has_SKID($cert, 1);
 584 has_AKID($cert, 0);
 585 strict_verify($cert, 0, $ca_cert);
 586
 587
 588 # Key Usage
 589
 590 $cert = "self-signed_CA_no_keyUsage.pem";
 591 generate_cert($cert, "-in", srctop_file(@certs, "ext-check.csr"));
 592 has_keyUsage($cert, 0);
 593 $cert = "self-signed_CA_with_keyUsages.pem";
 594 generate_cert($cert, "-in", srctop_file(@certs, "ext-check.csr"),
 595     "-copy_extensions", "copy");
 596 has_keyUsage($cert, 1);
 597
 598 # Generate cert using req with '-modulus'
 599 ok(run(app(["openssl", "req", "-x509", "-new", "-days", "365",
 600             "-key", srctop_file("test", "testrsa.pem"),
 601             "-config", srctop_file('test', 'test.cnf'),
 602             "-out", "testreq-cert.pem",
 603             "-modulus"])), "cert req creation - with -modulus");
 604
 605 # Verify cert
 606 ok(run(app(["openssl", "x509", "-in", "testreq-cert.pem",
 607             "-noout", "-text"])), "cert verification");