#! /usr/bin/env perl
-# Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2015-2024 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
setup("test_req");
-plan tests => 43;
+plan tests => 108;
require_ok(srctop_file('test', 'recipes', 'tconversion.pl'));
note("There should not be more that at most 80 per line");
}
+# Prevent MSys2 filename munging for arguments that look like file paths but
+# aren't
+$ENV{MSYS2_ARG_CONV_EXCL} = "/CN=";
+
# Check for duplicate -addext parameters, and one "working" case.
my @addext_args = ( "openssl", "req", "-new", "-out", "testreq.pem",
+ "-key", srctop_file(@certs, "ee-key.pem"),
"-config", srctop_file("test", "test.cnf"), @req_new );
my $val = "subjectAltName=DNS:example.com";
+my $val1 = "subjectAltName=otherName:1.2.3.4;UTF8:test,email:info\@example.com";
my $val2 = " " . $val;
my $val3 = $val;
$val3 =~ s/=/ =/;
ok( run(app([@addext_args, "-addext", $val])));
+ok( run(app([@addext_args, "-addext", $val1])));
+$val1 =~ s/UTF8/XXXX/; # execute the error handling in do_othername
+ok(!run(app([@addext_args, "-addext", $val1])));
ok(!run(app([@addext_args, "-addext", $val, "-addext", $val])));
ok(!run(app([@addext_args, "-addext", $val, "-addext", $val2])));
ok(!run(app([@addext_args, "-addext", $val, "-addext", $val3])));
ok(!run(app([@addext_args, "-addext", $val2, "-addext", $val3])));
+ok(run(app([@addext_args, "-addext", "SXNetID=1:one, 2:two, 3:three"])));
+ok(run(app([@addext_args, "-addext", "subjectAltName=dirName:dirname_sec"])));
+
+# If a CSR is provided with neither of -key or -CA/-CAkey, this should fail.
+ok(!run(app(["openssl", "req", "-x509",
+ "-in", srctop_file(@certs, "x509-check.csr"),
+ "-out", "testreq.pem"])));
subtest "generating alt certificate requests with RSA" => sub {
plan tests => 3;
subtest "generating certificate requests with RSA" => sub {
- plan tests => 2;
+ plan tests => 8;
SKIP: {
skip "RSA is not supported by this OpenSSL build", 2
if disabled("rsa");
+ ok(!run(app(["openssl", "req",
+ "-config", srctop_file("test", "test.cnf"),
+ "-new", "-out", "testreq-rsa.pem", "-utf8",
+ "-key", srctop_file("test", "testrsa.pem"),
+ "-keyform", "DER"])),
+ "Checking that mismatching keyform fails");
+
ok(run(app(["openssl", "req",
"-config", srctop_file("test", "test.cnf"),
"-new", "-out", "testreq-rsa.pem", "-utf8",
- "-key", srctop_file("test", "testrsa.pem")])),
+ "-key", srctop_file("test", "testrsa.pem"),
+ "-keyform", "PEM"])),
"Generating request");
ok(run(app(["openssl", "req",
"-config", srctop_file("test", "test.cnf"),
"-verify", "-in", "testreq-rsa.pem", "-noout"])),
"Verifying signature on request");
+
+ ok(run(app(["openssl", "req",
+ "-config", srctop_file("test", "test.cnf"),
+ "-modulus", "-in", "testreq-rsa.pem", "-noout"])),
+ "Printing a modulus of the request key");
+
+ ok(run(app(["openssl", "req",
+ "-config", srctop_file("test", "test.cnf"),
+ "-new", "-out", "testreq_withattrs_pem.pem", "-utf8",
+ "-key", srctop_file("test", "testrsa_withattrs.pem")])),
+ "Generating request from a key with extra attributes - PEM");
+
+ ok(run(app(["openssl", "req",
+ "-config", srctop_file("test", "test.cnf"),
+ "-verify", "-in", "testreq_withattrs_pem.pem", "-noout"])),
+ "Verifying signature on request from a key with extra attributes - PEM");
+
+ ok(run(app(["openssl", "req",
+ "-config", srctop_file("test", "test.cnf"),
+ "-new", "-out", "testreq_withattrs_der.pem", "-utf8",
+ "-key", srctop_file("test", "testrsa_withattrs.der"),
+ "-keyform", "DER"])),
+ "Generating request from a key with extra attributes - PEM");
+
+ ok(run(app(["openssl", "req",
+ "-config", srctop_file("test", "test.cnf"),
+ "-verify", "-in", "testreq_withattrs_der.pem", "-noout"])),
+ "Verifying signature on request from a key with extra attributes - PEM");
}
};
ok(!run(app(["openssl", "req",
"-config", srctop_file("test", "test.cnf"),
"-new", "-out", "testreq-rsapss3.pem", "-utf8",
- "-sigopt", "rsa_pss_saltlen:-4",
+ "-sigopt", "rsa_pss_saltlen:-5",
"-key", srctop_file("test", "testrsapss.pem")])),
"Generating request with expected failure");
SKIP: {
skip "Ed25519 is not supported by this OpenSSL build", 2
- if disabled("ec");
+ if disabled("ecx");
ok(run(app(["openssl", "req",
"-config", srctop_file("test", "test.cnf"),
SKIP: {
skip "Ed448 is not supported by this OpenSSL build", 2
- if disabled("ec");
+ if disabled("ecx");
ok(run(app(["openssl", "req",
"-config", srctop_file("test", "test.cnf"),
plan tests => 2;
ok(run(app(["openssl", "req", "-config", srctop_file("test", "test.cnf"),
+ "-key", srctop_file(@certs, "ee-key.pem"),
@req_new, "-out", "testreq.pem"])),
"Generating request");
my $cn = $is_ca ? "CA" : "EE";
my $ca_key = srctop_file(@certs, "ca-key.pem");
my $key = $is_ca ? $ca_key : srctop_file(@certs, "ee-key.pem");
- my @cmd = ("openssl", "req", "-config", "\"\"", "-x509",
- "-key", $key, "-subj", "/CN=$cn", @_, "-out", $cert);
+ my @cmd = ("openssl", "req", "-config", "", "-x509",
+ "-subj", "/CN=$cn", @_, "-out", $cert);
+ push(@cmd, ("-key", $key)) if $ss;
push(@cmd, ("-CA", $ca_cert, "-CAkey", $ca_key)) unless $ss;
ok(run(app([@cmd])), "generate $cert");
}
-sub has_SKID {
- my $cert = shift @_;
- my $expect = shift @_;
- cert_contains($cert, "Subject Key Identifier", $expect);
-}
-sub has_AKID {
- my $cert = shift @_;
- my $expect = shift @_;
- cert_contains($cert, "Authority Key Identifier", $expect);
-}
+
sub has_keyUsage {
my $cert = shift @_;
my $expect = shift @_;
my @v3_ca = ("-addext", "basicConstraints = critical,CA:true",
"-addext", "keyUsage = keyCertSign");
my $SKID_AKID = "subjectKeyIdentifier,authorityKeyIdentifier";
-my $cert = "self-signed_v1_CA_no_KIDs.pem";
+
+# # SKID
+
+my $cert = "self-signed_default_SKID_no_explicit_exts.pem";
generate_cert($cert);
-cert_ext_has_n_different_lines($cert, 0, $SKID_AKID); # no SKID and no AKID
-#TODO strict_verify($cert, 1); # self-signed v1 root cert should be accepted as CA
+has_version($cert, 3);
+has_SKID($cert, 1); # SKID added, though no explicit extensions given
+has_AKID($cert, 0);
-$ca_cert = "self-signed_v3_CA_default_SKID.pem";
-generate_cert($ca_cert, @v3_ca);
-has_SKID($ca_cert, 1);
-has_AKID($ca_cert, 0);
-strict_verify($ca_cert, 1);
+my $cert = "self-signed_v3_CA_hash_SKID.pem";
+generate_cert($cert, @v3_ca, "-addext", "subjectKeyIdentifier = hash");
+has_SKID($cert, 1); # explicit hash SKID
$cert = "self-signed_v3_CA_no_SKID.pem";
generate_cert($cert, @v3_ca, "-addext", "subjectKeyIdentifier = none");
cert_ext_has_n_different_lines($cert, 0, $SKID_AKID); # no SKID and no AKID
#TODO strict_verify($cert, 0);
-$cert = "self-signed_v3_CA_both_KIDs.pem";
-generate_cert($cert, @v3_ca, "-addext", "subjectKeyIdentifier = hash",
- "-addext", "authorityKeyIdentifier = keyid");
-cert_ext_has_n_different_lines($cert, 3, $SKID_AKID); # SKID == AKID
+$cert = "self-signed_v3_CA_given_SKID.pem";
+generate_cert($cert, @v3_ca, "-addext", "subjectKeyIdentifier = 45");
+cert_contains($cert, "Subject Key Identifier: 45 ", 1); # given SKID
strict_verify($cert, 1);
+# AKID of self-signed certs
+
+$cert = "self-signed_v1_CA_no_KIDs.pem";
+generate_cert($cert, "-x509v1");
+has_version($cert, 1);
+cert_ext_has_n_different_lines($cert, 0, $SKID_AKID); # no SKID and no AKID
+#TODO strict_verify($cert, 1); # self-signed v1 root cert should be accepted as CA
+
+$ca_cert = "self-signed_v3_CA_default_SKID.pem"; # will also be used below
+generate_cert($ca_cert, @v3_ca);
+has_SKID($ca_cert, 1); # default SKID
+has_AKID($ca_cert, 0); # no default AKID
+strict_verify($ca_cert, 1);
+
+$cert = "self-signed_v3_CA_no_AKID.pem";
+generate_cert($cert, @v3_ca, "-addext", "authorityKeyIdentifier = none");
+has_AKID($cert, 0); # forced no AKID
+
+$cert = "self-signed_v3_CA_explicit_AKID.pem";
+generate_cert($cert, @v3_ca, "-addext", "authorityKeyIdentifier = keyid");
+has_AKID($cert, 0); # for self-signed cert, AKID suppressed and not forced
+
+$cert = "self-signed_v3_CA_forced_AKID.pem";
+generate_cert($cert, @v3_ca, "-addext", "authorityKeyIdentifier = keyid:always");
+cert_ext_has_n_different_lines($cert, 3, $SKID_AKID); # forced AKID, AKID == SKID
+strict_verify($cert, 1);
+
+$cert = "self-signed_v3_CA_issuer_AKID.pem";
+generate_cert($cert, @v3_ca, "-addext", "authorityKeyIdentifier = issuer");
+has_AKID($cert, 0); # suppressed AKID since not forced
+
+$cert = "self-signed_v3_CA_forced_issuer_AKID.pem";
+generate_cert($cert, @v3_ca, "-addext", "authorityKeyIdentifier = issuer:always");
+cert_contains($cert, "Authority Key Identifier: DirName:/CN=CA serial:", 1); # forced issuer AKID
+
+$cert = "self-signed_v3_CA_nonforced_keyid_issuer_AKID.pem";
+generate_cert($cert, @v3_ca, "-addext", "authorityKeyIdentifier = keyid, issuer");
+has_AKID($cert, 0); # AKID not present because not forced and cert self-signed
+
+$cert = "self-signed_v3_CA_keyid_forced_issuer_AKID.pem";
+generate_cert($cert, @v3_ca, "-addext", "authorityKeyIdentifier = keyid, issuer:always");
+cert_contains($cert, "Authority Key Identifier: DirName:/CN=CA serial:", 1); # issuer AKID forced, with keyid not forced
+
+$cert = "self-signed_v3_CA_forced_keyid_issuer_AKID.pem";
+generate_cert($cert, @v3_ca, "-addext", "authorityKeyIdentifier = keyid:always, issuer");
+has_AKID($cert, 1); # AKID with keyid forced
+cert_contains($cert, "Authority Key Identifier: DirName:/CN=CA serial:", 0); # no issuer AKID
+
+$cert = "self-signed_v3_CA_forced_keyid_forced_issuer_AKID.pem";
+generate_cert($cert, @v3_ca, "-addext", "authorityKeyIdentifier = keyid:always, issuer:always");
+cert_contains($cert, "Authority Key Identifier: keyid(:[0-9A-Fa-f]{2})+ DirName:/CN=CA serial:", 1); # AKID with keyid and issuer forced
+
$cert = "self-signed_v3_EE_wrong_keyUsage.pem";
generate_cert($cert, "-addext", "keyUsage = keyCertSign");
#TODO strict_verify($cert, 1); # should be accepted because RFC 5280 does not apply
-$cert = "v3_EE_default_KIDs.pem";
-generate_cert($cert, "-addext", "keyUsage = dataEncipherment");
+# AKID of self-issued but not self-signed certs
+
+$cert = "self-issued_x509_v3_CA_default_KIDs.pem";
+ok(run(app([("openssl", "x509", "-copy_extensions", "copy",
+ "-req", "-in", srctop_file(@certs, "ext-check.csr"),
+ "-key", srctop_file(@certs, "ca-key.pem"),
+ "-force_pubkey", srctop_file("test", "testrsapub.pem"),
+ "-out", $cert)])), "generate using x509: $cert");
+cert_contains($cert, "Issuer: CN=test .*? Subject: CN=test", 1);
+cert_ext_has_n_different_lines($cert, 4, $SKID_AKID); # SKID != AKID
+strict_verify($cert, 1);
+
+$cert = "self-issued_v3_CA_default_KIDs.pem";
+generate_cert($cert, "-addext", "keyUsage = dataEncipherment",
+ "-in", srctop_file(@certs, "x509-check.csr"));
+cert_contains($cert, "Issuer: CN=CA .*? Subject: CN=CA", 1);
+cert_ext_has_n_different_lines($cert, 4, $SKID_AKID); # SKID != AKID
+strict_verify($cert, 1);
+
+$cert = "self-issued_v3_CA_no_AKID.pem";
+generate_cert($cert, "-addext", "authorityKeyIdentifier = none",
+ "-in", srctop_file(@certs, "x509-check.csr"));
+has_version($cert, 3);
+has_SKID($cert, 1); # SKID added, though no explicit extensions given
+has_AKID($cert, 0);
+strict_verify($cert, 1);
+
+$cert = "self-issued_v3_CA_explicit_AKID.pem";
+generate_cert($cert, "-addext", "authorityKeyIdentifier = keyid",
+ "-in", srctop_file(@certs, "x509-check.csr"));
+cert_ext_has_n_different_lines($cert, 4, $SKID_AKID); # SKID != AKID
+strict_verify($cert, 1);
+
+$cert = "self-issued_v3_CA_forced_AKID.pem";
+generate_cert($cert, "-addext", "authorityKeyIdentifier = keyid:always",
+ "-in", srctop_file(@certs, "x509-check.csr"));
+cert_ext_has_n_different_lines($cert, 4, $SKID_AKID); # SKID != AKID
+
+$cert = "self-issued_v3_CA_issuer_AKID.pem";
+generate_cert($cert, @v3_ca, "-addext", "authorityKeyIdentifier = issuer",
+ "-in", srctop_file(@certs, "x509-check.csr"));
+cert_contains($cert, "Authority Key Identifier: DirName:/CN=CA serial:", 1); # just issuer AKID
+
+$cert = "self-issued_v3_CA_forced_issuer_AKID.pem";
+generate_cert($cert, @v3_ca, "-addext", "authorityKeyIdentifier = issuer:always",
+ "-in", srctop_file(@certs, "x509-check.csr"));
+cert_contains($cert, "Authority Key Identifier: DirName:/CN=CA serial:", 1); # just issuer AKID
+
+$cert = "self-issued_v3_CA_keyid_issuer_AKID.pem";
+generate_cert($cert, "-addext", "authorityKeyIdentifier = keyid, issuer",
+ "-in", srctop_file(@certs, "x509-check.csr"));
+cert_ext_has_n_different_lines($cert, 4, $SKID_AKID); # SKID != AKID, not forced
+
+$cert = "self-issued_v3_CA_keyid_forced_issuer_AKID.pem";
+generate_cert($cert, "-addext", "authorityKeyIdentifier = keyid, issuer:always",
+ "-in", srctop_file(@certs, "x509-check.csr"));
+cert_ext_has_n_different_lines($cert, 6, $SKID_AKID); # SKID != AKID, with forced issuer
+
+$cert = "self-issued_v3_CA_forced_keyid_and_issuer_AKID.pem";
+generate_cert($cert, "-addext", "authorityKeyIdentifier = keyid:always, issuer:always",
+ "-in", srctop_file(@certs, "x509-check.csr"));
+cert_ext_has_n_different_lines($cert, 6, $SKID_AKID); # SKID != AKID, both forced
+
+# AKID of not self-issued certs
+
+$cert = "regular_v3_EE_default_KIDs_no_other_exts.pem";
+generate_cert($cert, "-key", srctop_file(@certs, "ee-key.pem"));
+has_version($cert, 3);
+cert_ext_has_n_different_lines($cert, 4, $SKID_AKID); # SKID != AKID
+
+$cert = "regular_v3_EE_default_KIDs.pem";
+generate_cert($cert, "-addext", "keyUsage = dataEncipherment",
+ "-key", srctop_file(@certs, "ee-key.pem"));
cert_ext_has_n_different_lines($cert, 4, $SKID_AKID); # SKID != AKID
strict_verify($cert, 1, $ca_cert);
+$cert = "regular_v3_EE_copied_exts_default_KIDs.pem";
+generate_cert($cert, "-copy_extensions", "copy",
+ "-in", srctop_file(@certs, "ext-check.csr"));
+cert_ext_has_n_different_lines($cert, 4, $SKID_AKID); # SKID != AKID
+strict_verify($cert, 1);
+
$cert = "v3_EE_no_AKID.pem";
-generate_cert($cert, "-addext", "authorityKeyIdentifier = none");
+generate_cert($cert, "-addext", "authorityKeyIdentifier = none",
+ "-key", srctop_file(@certs, "ee-key.pem"));
has_SKID($cert, 1);
has_AKID($cert, 0);
strict_verify($cert, 0, $ca_cert);
-$cert = "self-issued_v3_EE_default_KIDs.pem";
-generate_cert($cert, "-addext", "keyUsage = dataEncipherment",
- "-in", srctop_file(@certs, "x509-check.csr"));
-cert_ext_has_n_different_lines($cert, 4, $SKID_AKID); # SKID != AKID
-strict_verify($cert, 1);
-my $cert = "self-signed_CA_no_keyUsage.pem";
+# Key Usage
+
+$cert = "self-signed_CA_no_keyUsage.pem";
generate_cert($cert, "-in", srctop_file(@certs, "ext-check.csr"));
has_keyUsage($cert, 0);
-my $cert = "self-signed_CA_with_keyUsages.pem";
+$cert = "self-signed_CA_with_keyUsages.pem";
generate_cert($cert, "-in", srctop_file(@certs, "ext-check.csr"),
"-copy_extensions", "copy");
has_keyUsage($cert, 1);
+
+# Generate cert using req with '-modulus'
+ok(run(app(["openssl", "req", "-x509", "-new", "-days", "365",
+ "-key", srctop_file("test", "testrsa.pem"),
+ "-config", srctop_file('test', 'test.cnf'),
+ "-out", "testreq-cert.pem",
+ "-modulus"])), "cert req creation - with -modulus");
+
+# Verify cert
+ok(run(app(["openssl", "x509", "-in", "testreq-cert.pem",
+ "-noout", "-text"])), "cert verification");
projects / thirdparty / openssl.git / blobdiff