test/recipes/25-test_req.t

   1 #! /usr/bin/env perl
   2 # Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved.
   3 #
   4 # Licensed under the Apache License 2.0 (the "License").  You may not use
   5 # this file except in compliance with the License.  You can obtain a copy
   6 # in the file LICENSE in the source distribution or at
   7 # https://www.openssl.org/source/license.html
   8
   9
  10 use strict;
  11 use warnings;
  12
  13 use OpenSSL::Test::Utils;
  14 use OpenSSL::Test qw/:DEFAULT srctop_file/;
  15
  16 setup("test_req");
  17
  18 plan tests => 43;
  19
  20 require_ok(srctop_file('test', 'recipes', 'tconversion.pl'));
  21
  22 my @certs = qw(test certs);
  23
  24 # What type of key to generate?
  25 my @req_new;
  26 if (disabled("rsa")) {
  27     @req_new = ("-newkey", "dsa:".srctop_file("apps", "dsa512.pem"));
  28 } else {
  29     @req_new = ("-new");
  30     note("There should be a 2 sequences of .'s and some +'s.");
  31     note("There should not be more that at most 80 per line");
  32 }
  33
  34 # Check for duplicate -addext parameters, and one "working" case.
  35 my @addext_args = ( "openssl", "req", "-new", "-out", "testreq.pem",
  36     "-config", srctop_file("test", "test.cnf"), @req_new );
  37 my $val = "subjectAltName=DNS:example.com";
  38 my $val2 = " " . $val;
  39 my $val3 = $val;
  40 $val3 =~ s/=/    =/;
  41 ok( run(app([@addext_args, "-addext", $val])));
  42 ok(!run(app([@addext_args, "-addext", $val, "-addext", $val])));
  43 ok(!run(app([@addext_args, "-addext", $val, "-addext", $val2])));
  44 ok(!run(app([@addext_args, "-addext", $val, "-addext", $val3])));
  45 ok(!run(app([@addext_args, "-addext", $val2, "-addext", $val3])));
  46
  47 subtest "generating alt certificate requests with RSA" => sub {
  48     plan tests => 3;
  49
  50     SKIP: {
  51         skip "RSA is not supported by this OpenSSL build", 2
  52             if disabled("rsa");
  53
  54         ok(run(app(["openssl", "req",
  55                     "-config", srctop_file("test", "test.cnf"),
  56                     "-section", "altreq",
  57                     "-new", "-out", "testreq-rsa.pem", "-utf8",
  58                     "-key", srctop_file("test", "testrsa.pem")])),
  59            "Generating request");
  60
  61         ok(run(app(["openssl", "req",
  62                     "-config", srctop_file("test", "test.cnf"),
  63                     "-verify", "-in", "testreq-rsa.pem", "-noout"])),
  64            "Verifying signature on request");
  65
  66         ok(run(app(["openssl", "req",
  67                     "-config", srctop_file("test", "test.cnf"),
  68                     "-section", "altreq",
  69                     "-verify", "-in", "testreq-rsa.pem", "-noout"])),
  70            "Verifying signature on request");
  71     }
  72 };
  73
  74
  75 subtest "generating certificate requests with RSA" => sub {
  76     plan tests => 2;
  77
  78     SKIP: {
  79         skip "RSA is not supported by this OpenSSL build", 2
  80             if disabled("rsa");
  81
  82         ok(run(app(["openssl", "req",
  83                     "-config", srctop_file("test", "test.cnf"),
  84                     "-new", "-out", "testreq-rsa.pem", "-utf8",
  85                     "-key", srctop_file("test", "testrsa.pem")])),
  86            "Generating request");
  87
  88         ok(run(app(["openssl", "req",
  89                     "-config", srctop_file("test", "test.cnf"),
  90                     "-verify", "-in", "testreq-rsa.pem", "-noout"])),
  91            "Verifying signature on request");
  92     }
  93 };
  94
  95 subtest "generating certificate requests with RSA-PSS" => sub {
  96     plan tests => 4;
  97
  98     SKIP: {
  99         skip "RSA is not supported by this OpenSSL build", 2
 100             if disabled("rsa");
 101
 102         ok(run(app(["openssl", "req",
 103                     "-config", srctop_file("test", "test.cnf"),
 104                     "-new", "-out", "testreq-rsapss.pem", "-utf8",
 105                     "-key", srctop_file("test", "testrsapss.pem")])),
 106            "Generating request");
 107
 108         ok(run(app(["openssl", "req",
 109                     "-config", srctop_file("test", "test.cnf"),
 110                     "-verify", "-in", "testreq-rsapss.pem", "-noout"])),
 111            "Verifying signature on request");
 112
 113         ok(run(app(["openssl", "req",
 114                     "-config", srctop_file("test", "test.cnf"),
 115                     "-new", "-out", "testreq-rsapss2.pem", "-utf8",
 116                     "-sigopt", "rsa_padding_mode:pss",
 117                     "-sigopt", "rsa_pss_saltlen:-1",
 118                     "-key", srctop_file("test", "testrsapss.pem")])),
 119            "Generating request");
 120
 121         ok(run(app(["openssl", "req",
 122                     "-config", srctop_file("test", "test.cnf"),
 123                     "-verify", "-in", "testreq-rsapss2.pem", "-noout"])),
 124            "Verifying signature on request");
 125     }
 126 };
 127
 128 subtest "generating certificate requests with DSA" => sub {
 129     plan tests => 2;
 130
 131     SKIP: {
 132         skip "DSA is not supported by this OpenSSL build", 2
 133             if disabled("dsa");
 134
 135         ok(run(app(["openssl", "req",
 136                     "-config", srctop_file("test", "test.cnf"),
 137                     "-new", "-out", "testreq-dsa.pem", "-utf8",
 138                     "-key", srctop_file("test", "testdsa.pem")])),
 139            "Generating request");
 140
 141         ok(run(app(["openssl", "req",
 142                     "-config", srctop_file("test", "test.cnf"),
 143                     "-verify", "-in", "testreq-dsa.pem", "-noout"])),
 144            "Verifying signature on request");
 145     }
 146 };
 147
 148 subtest "generating certificate requests with ECDSA" => sub {
 149     plan tests => 2;
 150
 151     SKIP: {
 152         skip "ECDSA is not supported by this OpenSSL build", 2
 153             if disabled("ec");
 154
 155         ok(run(app(["openssl", "req",
 156                     "-config", srctop_file("test", "test.cnf"),
 157                     "-new", "-out", "testreq-ec.pem", "-utf8",
 158                     "-key", srctop_file("test", "testec-p256.pem")])),
 159            "Generating request");
 160
 161         ok(run(app(["openssl", "req",
 162                     "-config", srctop_file("test", "test.cnf"),
 163                     "-verify", "-in", "testreq-ec.pem", "-noout"])),
 164            "Verifying signature on request");
 165     }
 166 };
 167
 168 subtest "generating certificate requests with Ed25519" => sub {
 169     plan tests => 2;
 170
 171     SKIP: {
 172         skip "Ed25519 is not supported by this OpenSSL build", 2
 173             if disabled("ec");
 174
 175         ok(run(app(["openssl", "req",
 176                     "-config", srctop_file("test", "test.cnf"),
 177                     "-new", "-out", "testreq-ed25519.pem", "-utf8",
 178                     "-key", srctop_file("test", "tested25519.pem")])),
 179            "Generating request");
 180
 181         ok(run(app(["openssl", "req",
 182                     "-config", srctop_file("test", "test.cnf"),
 183                     "-verify", "-in", "testreq-ed25519.pem", "-noout"])),
 184            "Verifying signature on request");
 185     }
 186 };
 187
 188 subtest "generating certificate requests with Ed448" => sub {
 189     plan tests => 2;
 190
 191     SKIP: {
 192         skip "Ed448 is not supported by this OpenSSL build", 2
 193             if disabled("ec");
 194
 195         ok(run(app(["openssl", "req",
 196                     "-config", srctop_file("test", "test.cnf"),
 197                     "-new", "-out", "testreq-ed448.pem", "-utf8",
 198                     "-key", srctop_file("test", "tested448.pem")])),
 199            "Generating request");
 200
 201         ok(run(app(["openssl", "req",
 202                     "-config", srctop_file("test", "test.cnf"),
 203                     "-verify", "-in", "testreq-ed448.pem", "-noout"])),
 204            "Verifying signature on request");
 205     }
 206 };
 207
 208 subtest "generating certificate requests" => sub {
 209     plan tests => 2;
 210
 211     ok(run(app(["openssl", "req", "-config", srctop_file("test", "test.cnf"),
 212                 @req_new, "-out", "testreq.pem"])),
 213        "Generating request");
 214
 215     ok(run(app(["openssl", "req", "-config", srctop_file("test", "test.cnf"),
 216                 "-verify", "-in", "testreq.pem", "-noout"])),
 217        "Verifying signature on request");
 218 };
 219
 220 subtest "generating SM2 certificate requests" => sub {
 221     plan tests => 4;
 222
 223     SKIP: {
 224         skip "SM2 is not supported by this OpenSSL build", 4
 225         if disabled("sm2");
 226         ok(run(app(["openssl", "req",
 227                     "-config", srctop_file("test", "test.cnf"),
 228                     "-new", "-key", srctop_file(@certs, "sm2.key"),
 229                     "-sigopt", "distid:1234567812345678",
 230                     "-out", "testreq-sm2.pem", "-sm3"])),
 231            "Generating SM2 certificate request");
 232
 233         ok(run(app(["openssl", "req",
 234                     "-config", srctop_file("test", "test.cnf"),
 235                     "-verify", "-in", "testreq-sm2.pem", "-noout",
 236                     "-vfyopt", "distid:1234567812345678", "-sm3"])),
 237            "Verifying signature on SM2 certificate request");
 238
 239         ok(run(app(["openssl", "req",
 240                     "-config", srctop_file("test", "test.cnf"),
 241                     "-new", "-key", srctop_file(@certs, "sm2.key"),
 242                     "-sigopt", "hexdistid:DEADBEEF",
 243                     "-out", "testreq-sm2.pem", "-sm3"])),
 244            "Generating SM2 certificate request with hex id");
 245
 246         ok(run(app(["openssl", "req",
 247                     "-config", srctop_file("test", "test.cnf"),
 248                     "-verify", "-in", "testreq-sm2.pem", "-noout",
 249                     "-vfyopt", "hexdistid:DEADBEEF", "-sm3"])),
 250            "Verifying signature on SM2 certificate request");
 251     }
 252 };
 253
 254 my @openssl_args = ("req", "-config", srctop_file("apps", "openssl.cnf"));
 255
 256 run_conversion('req conversions',
 257                "testreq.pem");
 258 run_conversion('req conversions -- testreq2',
 259                srctop_file("test", "testreq2.pem"));
 260
 261 sub run_conversion {
 262     my $title = shift;
 263     my $reqfile = shift;
 264
 265     subtest $title => sub {
 266         run(app(["openssl", @openssl_args,
 267                  "-in", $reqfile, "-inform", "p",
 268                  "-noout", "-text"],
 269                 stderr => "req-check.err", stdout => undef));
 270         open DATA, "req-check.err";
 271         SKIP: {
 272             plan skip_all => "skipping req conversion test for $reqfile"
 273                 if grep /Unknown Public Key/, map { s/\R//; } <DATA>;
 274
 275             tconversion( -type => 'req', -in => $reqfile,
 276                          -args => [ @openssl_args ] );
 277         }
 278         close DATA;
 279         unlink "req-check.err";
 280
 281         done_testing();
 282     };
 283 }
 284
 285 # Test both generation and verification of certs w.r.t. RFC 5280 requirements
 286
 287 my $ca_cert; # will be set below
 288 sub generate_cert {
 289     my $cert = shift @_;
 290     my $ss = $cert =~ m/self-signed/;
 291     my $is_ca = $cert =~ m/CA/;
 292     my $cn = $is_ca ? "CA" : "EE";
 293     my $ca_key = srctop_file(@certs, "ca-key.pem");
 294     my $key = $is_ca ? $ca_key : srctop_file(@certs, "ee-key.pem");
 295     my @cmd = ("openssl", "req", "-config", "\"\"", "-x509",
 296                "-key", $key, "-subj", "/CN=$cn", @_, "-out", $cert);
 297     push(@cmd, ("-CA", $ca_cert, "-CAkey", $ca_key)) unless $ss;
 298     ok(run(app([@cmd])), "generate $cert");
 299 }
 300 sub has_SKID {
 301     my $cert = shift @_;
 302     my $expect = shift @_;
 303     cert_contains($cert, "Subject Key Identifier", $expect);
 304 }
 305 sub has_AKID {
 306     my $cert = shift @_;
 307     my $expect = shift @_;
 308     cert_contains($cert, "Authority Key Identifier", $expect);
 309 }
 310 sub has_keyUsage {
 311     my $cert = shift @_;
 312     my $expect = shift @_;
 313     cert_contains($cert, "Key Usage", $expect);
 314 }
 315 sub strict_verify {
 316     my $cert = shift @_;
 317     my $expect = shift @_;
 318     my $trusted = shift @_;
 319     $trusted = $cert unless $trusted;
 320     ok(run(app(["openssl", "verify", "-x509_strict", "-trusted", $trusted,
 321                 "-partial_chain", $cert])) == $expect,
 322        "strict verify allow $cert");
 323 }
 324
 325 my @v3_ca = ("-addext", "basicConstraints = critical,CA:true",
 326              "-addext", "keyUsage = keyCertSign");
 327 my $SKID_AKID = "subjectKeyIdentifier,authorityKeyIdentifier";
 328 my $cert = "self-signed_v1_CA_no_KIDs.pem";
 329 generate_cert($cert);
 330 cert_ext_has_n_different_lines($cert, 0, $SKID_AKID); # no SKID and no AKID
 331 #TODO strict_verify($cert, 1); # self-signed v1 root cert should be accepted as CA
 332
 333 $ca_cert = "self-signed_v3_CA_default_SKID.pem";
 334 generate_cert($ca_cert, @v3_ca);
 335 has_SKID($ca_cert, 1);
 336 has_AKID($ca_cert, 0);
 337 strict_verify($ca_cert, 1);
 338
 339 $cert = "self-signed_v3_CA_no_SKID.pem";
 340 generate_cert($cert, @v3_ca, "-addext", "subjectKeyIdentifier = none");
 341 cert_ext_has_n_different_lines($cert, 0, $SKID_AKID); # no SKID and no AKID
 342 #TODO strict_verify($cert, 0);
 343
 344 $cert = "self-signed_v3_CA_both_KIDs.pem";
 345 generate_cert($cert, @v3_ca, "-addext", "subjectKeyIdentifier = hash",
 346             "-addext", "authorityKeyIdentifier = keyid");
 347 cert_ext_has_n_different_lines($cert, 3, $SKID_AKID); # SKID == AKID
 348 strict_verify($cert, 1);
 349
 350 $cert = "self-signed_v3_EE_wrong_keyUsage.pem";
 351 generate_cert($cert, "-addext", "keyUsage = keyCertSign");
 352 #TODO strict_verify($cert, 1); # should be accepted because RFC 5280 does not apply
 353
 354 $cert = "v3_EE_default_KIDs.pem";
 355 generate_cert($cert, "-addext", "keyUsage = dataEncipherment");
 356 cert_ext_has_n_different_lines($cert, 4, $SKID_AKID); # SKID != AKID
 357 strict_verify($cert, 1, $ca_cert);
 358
 359 $cert = "v3_EE_no_AKID.pem";
 360 generate_cert($cert, "-addext", "authorityKeyIdentifier = none");
 361 has_SKID($cert, 1);
 362 has_AKID($cert, 0);
 363 strict_verify($cert, 0, $ca_cert);
 364
 365 $cert = "self-issued_v3_EE_default_KIDs.pem";
 366 generate_cert($cert, "-addext", "keyUsage = dataEncipherment",
 367     "-in", srctop_file(@certs, "x509-check.csr"));
 368 cert_ext_has_n_different_lines($cert, 4, $SKID_AKID); # SKID != AKID
 369 strict_verify($cert, 1);
 370
 371 my $cert = "self-signed_CA_no_keyUsage.pem";
 372 generate_cert($cert, "-in", srctop_file(@certs, "ext-check.csr"));
 373 has_keyUsage($cert, 0);
 374 my $cert = "self-signed_CA_with_keyUsages.pem";
 375 generate_cert($cert, "-in", srctop_file(@certs, "ext-check.csr"),
 376     "-copy_extensions", "copy");
 377 has_keyUsage($cert, 1);